NCSC handled 337 cyber incidents in a year, 80 of them nationally significant

The National Cyber Security Centre's incident team received 1,831 reports of cyber attacks on UK organisations in the 12 months to the end of August. After triage, 337 needed its help, and 80 of those were classed as nationally significant.

The figures are in the NCSC's Annual Review 2026, published on Tuesday, which covers 1 September 2025 to 31 August 2026, the centre's tenth year.

Separately, the NCSC's Early Warning service sent notices to 8,500 organisations about events suggesting their systems might have been compromised. The centre says alerts at that early stage are likely to have stopped a number of problems from growing into incidents that needed its support. It also cautions that incident numbers never move in a straight line from year to year, because past peaks have often come from a handful of very serious cases.

How attackers got in

Most successful compromises used familiar methods, the review found. Attackers exploited known vulnerabilities in internet-facing systems, used stolen login details and relied on social engineering. A number of incidents were assessed as having links to states or state-aligned groups. Some involved previously unknown flaws, but many used vulnerabilities for which patches existed and had not been installed quickly enough.

Suppliers were another route. Organisations increasingly depend on third parties for critical work, and a weakness in one of them can expose everyone they serve.

The incident team has started to see attackers using AI tools. None of the uses it observed opened up a new kind of attack.

Where AI is heading

In a separate assessment within the review, the NCSC judges it almost certain that AI will act as a force multiplier, letting skilled attackers work faster and at greater scale. It expects AI mostly to speed up existing techniques rather than run attacks from start to finish on its own.

The centre also judges it highly likely that:

• AI-assisted discovery of vulnerabilities will give attackers more chances to strike before systems are patched
• staff moving work data to personal devices to use unapproved AI tools, which it calls shadow AI, will leave organisations open to attack
• AI malware will be used in a ransomware attack on UK critical national infrastructure

It adds that organisations with mature security and more resources will gain most from AI for defence, leaving a widening gap with those that cannot keep up.

Passkeys for individuals

For the public, the review returns to passkeys, which the NCSC officially recommended in 2025 as the preferred way for individuals to sign in. A passkey replaces a password with a cryptographic credential stored on the user's device and tied to the real service, which makes it far harder to phish or reuse. One Login, the Government Digital Service's single account for public services, now offers passkeys, and the NCSC says it helped early adopters such as NHS England, whose app was the first government-sponsored app to offer them as a login option.