NCSC Annual Review 2026: What it tells us about cyber resilience

Ten years after the National Cyber Security Centre (NCSC) opened its doors, its Annual Review 2026 paints a familiar picture. Cyber threats are growing, attacks are becoming more sophisticated and organisations need to do more to protect themselves.

It is difficult to imagine an annual review reporting that the cyber threat is diminishing. But that does not make the findings less concerning. Malicious cyber activity costs UK organisations an estimated £14.7 billion every year.

In the last year, the NCSC provided support for 337 cyber incidents, including 80 classified as nationally significant.

Beyond the headline figures, the review raises important questions about how organisations prepare for disruption and what happens when their defences fail.

1. AI is accelerating cyber attacks… but is a “net positive” for cyber security

AI is making cyber attacks faster, cheaper and easier to carry out at scale. The NCSC believes that AI-powered malware is “highly likely” to have been used in a ransomware attack on UK critical national infrastructure by 2028.

Yet the report also takes an optimistic view of AI’s defensive potential, forecasting its long-term impact on cyber security as a “net positive”. The same tension appears in the findings from the Data Health Check 2026. Organisations identify AI-driven cyber threats as their biggest resilience challenge, but 79% still see AI as a greater benefit than threat to security.

2. Cyber resilience is about more than preventing an attack

Cyber security reduces the likelihood of an attack succeeding. But what happens when it does?

One of the NCSC’s clearest messages is also one of its simplest: “Preparation determines outcomes.”

The NCSC is right to emphasise this. Having a business continuity plan or disaster recovery solution does not guarantee recovery. Organisations need to exercise their plans, test their recovery capabilities and rehearse how teams will work together during a crisis. The time to discover gaps in these arrangements is before an attack, not during one.

3. Supply chain resilience is an organisational responsibility

The NCSC also warns about the growing threat of supply chain attacks, highlighting the need to understand the suppliers and dependencies supporting critical services.

Supplier assessments alone cannot provide that assurance. Organisations need to understand how disruption to a critical supplier could cascade through their operations and whether they have workable alternatives.

In the last 12 months, 26% of organisations experienced a cyber incident originating in their supply chain. It is a reminder that the more you depend on third parties, the more their resilience becomes your concern.

One practical step organisations can take is to include critical suppliers in business continuity exercises. Rehearsing your response together helps identify gaps in responsibilities, communication and recovery arrangements before a real disruption.

A moment of choice for cyber resilience

Ten years of NCSC reporting have shown how much the cyber threat has grown. But the fundamentals of cyber resilience are the same. Organisations must continue to strengthen their defences, but give equal attention to their ability to respond, maintain critical operations and recover when those defences fail.

The NCSC is right to call this a “moment of choice”. Organisations can continue to treat resilience as a matter of compliance, or take the steps needed to ensure they can withstand disruption and recover: putting the right technology in place, developing effective business continuity and crisis management plans and preparing teams to respond under pressure.

Resilience is not something you achieve once and then forget about. These capabilities must be maintained, exercised and tested as the organisation changes.

The NCSC’s message that “Preparation determines outcomes” is worth remembering. The time to discover whether your resilience arrangements work is before you need them.

Read the NCSC Annual Review 2026

Put your cyber incident response plans to the test

Databarracks is an NCSC Assured Cyber Incident Exercising Provider.

Our expert-led exercises give your organisation practical experience of responding to a cyber attack, helping you test your plans, identify weaknesses and prepare for a real crisis.