NCSC Annual Review 2026: What It Means for Your Small Business

The National Cyber Security Centre (NCSC), the part of GCHQ that helps keep the UK safe online, published its Annual Review 2026 today. Most of the news coverage will focus on artificial intelligence and attacks on national infrastructure such as energy and water. That matters, but it can make the report feel like something for big organisations and government only.

It isn’t. Read past the headlines and the message for a small business in Sussex is clear, and mostly good news: the attacks that succeed are still getting in through familiar gaps, and those gaps can be closed.

What the report says

The review covers the NCSC’s tenth year, from 1 September 2025 to 31 August 2026. A few points stand out.

• 1,831 reports of cyber attacks came in to the NCSC from organisations across the UK.
• 337 incidents needed hands-on support from its incident team, and 80 of those were nationally significant.
• Around 8,500 organisations were warned by the NCSC’s Early Warning service about signs that they might have been compromised.
• The NCSC judges it “highly likely” that, within two years, criminals and hostile states using AI will make ransomware, scam messages and attacks on software flaws faster and larger in scale.

The NCSC’s chief executive, Dr Richard Horne, put it bluntly: “For decades, we have collectively got away with doing tech on the cheap.” His point is that shortcuts which used to go unpunished are now being found and used much more quickly.

The lesson that matters most: it’s still the basics

Alongside the figures, the NCSC set out seven things it learned from those 337 incidents. The first one is the most useful for any business owner: basic weaknesses remain the main way in. Missing updates, poorly set up systems and things left exposed to the internet are still a leading route for attackers.

Some of the other lessons in plain English:

• People are still the target. Scam emails, fake login pages and stolen passwords continue to work.
• Criminals and foreign states use the same gaps. You don’t need to be an interesting target. You just need to have the same weakness as thousands of other firms.
• The clever part comes after they get in. The way in is usually simple. What attackers do once inside is where the skill shows.
• Preparation decides how bad it gets. Businesses with good records of what happens on their systems, a plan for what to do, and checks on their suppliers recover faster.
• Spotting it early makes a big difference. Some attacks are stopped before they turn into a crisis because someone noticed the warning signs.

The NCSC’s own summary is that “most successful attacks continue to exploit familiar weaknesses”. For a small business, that’s reassuring. You don’t need to defend against science fiction. You need to do the ordinary things well, and keep doing them.

Why AI makes the basics more urgent

The report doesn’t say AI is inventing brand new kinds of attack. It says AI lets criminals find and use old weaknesses much faster, and at a scale that wasn’t possible before.

Earlier this year the NCSC also warned organisations to prepare for a “patch wave”: a surge of security updates as software makers use AI to find and fix flaws in their own products. More updates arriving more often is good news, but only if they actually get installed. A laptop that hasn’t restarted in six weeks, or an old router nobody has looked at since it was fitted, is exactly the kind of gap the NCSC is talking about.

In other words, the time between a flaw being made public and criminals using it is getting shorter. “We’ll get round to the updates next month” is a riskier plan than it used to be.

Five things to do this month

None of these need a big budget. They are the same things we check in every IT audit we carry out.

1. Switch on automatic updates everywhere you can. Windows, Microsoft 365, web browsers, phones and tablets. Then make sure computers are actually restarting so the updates finish installing. If you’re still on old software that no longer gets updates, plan to replace it. Our article on why you should update Windows even when it isn’t broken explains why this matters so much.

2. Check what faces the internet. Your broadband router, firewall, remote access tools and any older server are the front door. The NCSC advises starting your updates there. Ask whoever looks after your IT when these were last updated, and whether anything is open to the internet that doesn’t need to be.

3. Turn on two-step sign-in for every email account. This is where a code on your phone, or an approval in an app, is needed as well as your password. Stolen passwords are one of the main ways in, and this stops most of them being useful to a criminal. Don’t forget shared mailboxes, old accounts and staff who have left: see old staff logins and the risk they carry.

4. Sign up to the NCSC’s free Early Warning service. It’s free for any UK organisation, takes about five minutes with a free MyNCSC account, and emails you if the NCSC sees signs that your internet connection or website has been compromised or has something vulnerable exposed. You’ll need your public IP address and website domain name, which your IT provider can give you.

5. Write down what you would do if it happened. Who do you call? Where are the backups, and have you tested restoring from them? Who tells customers? A single page is far better than nothing. Our guide to creating a cyber incident plan walks you through it.

Where Cyber Essentials fits

The NCSC is keen for organisations to treat Cyber Essentials, the government-backed scheme that covers the core security controls, as “the starting point for cyber security, not the end goal”.

That’s a fair way to see it. Cyber Essentials covers exactly the familiar weaknesses the report keeps coming back to: updates, secure settings, controlling who has access, protection against viruses and a properly set up firewall. If you haven’t done it yet, it’s a sensible first step, and many customers and insurers now ask for it. Our Cyber Essentials guide explains what’s involved. If you already have it, the job is to keep those controls working all year round, not just on the day of the assessment.

The bottom line for Sussex businesses

The NCSC’s report is a reminder that being small doesn’t keep you off the radar. Criminals, increasingly helped by AI, scan for the same gaps everywhere, and a garage in Hailsham or a charity in Crawley has the same router and the same Microsoft 365 account as a firm in the City.

The good news is that the fixes are well understood. Updates installed promptly, two-step sign-in on every account, a clear view of what faces the internet, tested backups and a simple plan will put you ahead of most of the incidents in this report. You can read the full review on the NCSC website.

Need a hand?

If you’re not sure where your business stands, we can help. Our free Get It Green IT audit takes about half a day and gives you a simple red, amber and green report showing what’s fine, what needs attention and what to fix first. You can see more about how we protect businesses on our cyber security page.

Book a free IT audit or a 30-minute call and we’ll talk it through, no obligation.