The review

NCSC Annual Review 2026: what the numbers say

The NCSC handled 80 nationally significant incidents in its latest reporting year. It warns against reading incident totals as a simple measure of rising or falling threat.

Last reviewed against National Cyber Security Centre, SecurityWeek and Cyber Security News. Sources

A globe in a wire frame with a padlock and coins around it

The figures

What was reported

The review covers 1 September 2025 to 31 August 2026 and was published on 3 November 2026 [3]. As reported, it records 1,831 attack reports, 337 incidents that needed support from the NCSC's Incident Management Team and 80 nationally significant incidents [7].

The 80 are a subset of the 337, not the total number of attacks on the UK [7]. The NCSC also notified 8,500 organisations of events suggesting suspected compromise through its Early Warning service [7].

Reading them

A caution from the NCSC

The NCSC cautions against treating incident totals as a measure of whether threats are rising or falling [7].

A wireless signal above a padlock

Why totals mislead

Reporting levels vary, major incidents can influence annual figures, and early alerts may stop smaller compromises from becoming cases that need national support [7]. Response complexity also differs widely between incidents [7].

A cloud with a secured dial at its centre

What follows

A lower count does not prove organisations face less risk, or that the impact of individual attacks has fallen [7].

The message

AI as pressure on known weaknesses

The review's central point is that AI increases pressure on organisations still struggling to fix known weaknesses [7]. It does not say attackers have dropped established techniques [7].

Where the figures came from

The statistics on this page come from reporting of the review by Cyber Security News, which we could not cross-check against the review PDF. Check the NCSC's own publication before quoting them in a board paper.

A brick wall with a flame burning in it

Also in it

Defence and suppliers

The review supports wider passkey adoption and better understanding of supplier dependencies [7]. It sets these alongside the practical priorities of patching exposed services and protecting backups [7].

Keep reading

Read next

A person in a suit standing at a badge-controlled security gate

Four routes

Public-facing apps, phishing, valid accounts and external remote services: the four routes behind 88% of incidents at large organisations.

Read the guide Two figures in dark clothing working at an open equipment cabinet with a red alarm light

Shadow AI

Unapproved AI services can expose company data, and agentic AI adds access risk. What the NCSC says organisations should do about both.

Read the guide A blue badge with a large green and blue tick

Cyber Essentials

The NCSC chief calls Cyber Essentials the starting point against AI-assisted attacks. What that means and the 75% first-certificate discount.

Read the guide

How CyPro can help

Need a hand getting ready?

Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.

Security lead advising a board

Fractional CISO for the board

A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.

More on cypro.co.uk
Penetration tester probing an application for weaknesses

Penetration testing

A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.

More on cypro.co.uk
Cyber security consultants planning hardening work

Hardening and segmentation

Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.

More on cypro.co.uk
Security analysts monitoring systems around the clock

24/7 security monitoring

Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.

More on cypro.co.uk
Incident responders containing an attack

Incident response

If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.

More on cypro.co.uk
Scanner checking internet-facing systems for weaknesses

Vulnerability scanning

Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.

See the scanning service
Talk to us Book a Free Consultation
Rocket launching from a cloud

Get ready

Need to know what this means for you?

The NCSC expects ransomware to get faster and cheaper to run. CyPro can help you plan and rehearse your response before an attack and take charge of containment and recovery if one happens.

See Cyber Incident Response Book a Free Consultation