NCSC: we have got away with tech on the cheap for decades. The habits it wants businesses to drop
Launching its Annual Review, the NCSC's chief executive warned of a real prospect of an unprecedented rise in cyber incidents, and named the everyday shortcuts that leave organisations exposed.
The National Cyber Security Centre published its Annual Review 2026, titled The State of the Cyber Nation, on 3 November. Launching it in London, NCSC chief executive Richard Horne said: "In the coming months, we face a real prospect of an unprecedented rise in the number of cyber incidents." He was clear that this is not because AI has invented new ways to attack, but because "vulnerabilities that have been tolerated for far too long can now be discovered and exploited, at a scale and pace that was once unimaginable."
The habits he named
"For decades we have collectively got away with tech on the cheap," Horne said. His examples were specific: end of life systems kept running for just one more year, needed upgrades pushed back as a cost efficiency, technology installed and then not invested in throughout its life, access granted where it was convenient rather than where it was necessary, services procured on price alone without asking whether the technology and operations behind them were resilient or secure, and a failure to put in place the monitoring needed to detect when things go wrong. He said leaders of organisations of every size and type need to take responsibility now to make different choices.
The AI warning
The Register reports that the NCSC says AI powered malware is "highly likely" to be part of a ransomware attack on Britain's critical national infrastructure between now and 2028, in a warning that accompanies the review and a separate assessment of how AI could change cyber threats over the next two years. Horne also described the scale of recent work: in response to the PHP vulnerability, the NCSC and its industry partners issued more than 110,000 proactive notifications and Early Warning alerts to UK organisations.
Where Cyber Essentials fits
Horne said the foundations recognised through Cyber Essentials are the foundations of a resilient business for most organisations in an AI enabled world. According to The Register, he said organisations should treat Cyber Essentials as the starting point and scale up their resilience in line with their size, complexity and risk. The same day the government launched a 75 per cent discount on Cyber Essentials for eligible small and medium sized businesses. The NCSC also says organisations that use a managed service provider can face additional complexity when working towards certification, and that a formal scheme to badge providers offering Cyber Essentials compatible services is expected to launch in late 2026.
What this means for your business
Horne's list works as a checklist for a business of any size. Is anything still running past the end of its support, kept on for one more year? Who has admin rights, and does each of them need them? When you last chose an IT, phone or cloud supplier, did you ask how they keep it secure and running, or only what it cost? And if someone got into your email or your server tonight, would anybody notice? None of these needs a big budget to answer, and Cyber Essentials covers much of the ground. If you are in Exeter or the wider South West and want a second pair of eyes on those questions, we can help.
#WEARECOBALT
Ready when you are.
Tell us what's slowing your business down. We'll tell you exactly how we'd fix it — plainly, with no obligation.