The UK faces ‘a real prospect of an unprecedented rise in the number of cyber incidents’, said the UK official National Cyber Security Centre (NCSC) CEO Richard Horne in a speech to launch the Centre’s Annual Review 2026: The State of the Cyber Nation.
He made the point that AI has not invented new ways of cyber attack, but rather that ‘vulnerabilities that have been tolerated for far too long can now be discovered and exploited, at a scale and pace that was once unimaginable’, and ‘far too many of our organisations and supply chains rest on weak technology and operational foundations’. For the speech in full visit the NCSC website. He called on leaders to take responsibility: “When food isn’t on the shelves, when lights aren’t on, businesses have gone under. We may have to explain that we saw the warning signs, understood the risks and still didn’t make the right choices.” He quoted the UK Government’s AI Minister Kanishka Narayan; ‘the consequences of this moment we find ourselves in could be felt for generations’.
For the review, visit https://www.ncsc.gov.uk/collection/annual-review-2026. The document, that argues that ‘proven cyber security foundations’ are more important than ever, has forewords by Home Office security minister Dan Jarvis, and GCHQ (the Government agency that the NCSC is a part of) Anne Keast-Butler.
Comments
Cynthia Overby, director of strategic security solutions, ZCOE, at Rocket Software, said that while the NCSC’s warning sounds alarming, it won’t surprise anyone close to the space. She said: “AI-driven threats have been steadily increasing over the past year, and it seems now that not a day goes by without news of an attack, newly discovered vulnerability or a widespread warning on the future cyber-landscape. The NCSC’s warning rightly pushes UK organisations to consider the current state of their cybersecurity, and crucially highlights that rapid advances in GenAI and machine learning will continue to expose vulnerabilities at an unprecedented speed and scale in the years to come.
“Due to this, building resilience in today’s threat landscape requires an entire ecosystem of defence. As the NCSC’s CEO highlighted, Cyber Essentials should be viewed as the starting point for cyber security, not the end goal. Our increasing technology dependencies and digitalisation of services means that cyber risk now comes hand in hand with business risk. Organisations must shift from asking ‘Are we protected?’ to ‘Can we prove that we understand our risk, that controls are working, and that operations can remain resilient when something goes wrong?’”
“Given today’s threat climate, organisations should assume incidents will happen and regularly test recovery, response, communications and decision making. Especially for institutions delivering critical services, the need to continuously anticipate and understand risk, along with practicing responses to threats and recovery processes is crucial. Most importantly, there must be a transition from perfect prevention to designing for resilience.”
“But the threat isn’t limited to external attackers. Shadow AI is already creating serious vulnerabilities inside organisations, something the NCSC has also recognised. Almost half of employees use AI tools their employer hasn’t approved, and a third have shared company research or datasets with them. This leaves businesses with little visibility or control over how sensitive information is stored, used or protected.
“Businesses cannot protect data they don’t know is leaving their organisation. Agentic AI widens that exposure further by giving autonomous systems access to sensitive information and the ability to act on it. Organisations must control what AI tools and agents can access, verify high-risk actions independently, and stop suspicious data transfers before they leave the business. Once sensitive information is gone, recovery becomes a race against time.”
