Insights Cyber resilience
CYBER INTELLIGENCE / NCSC ANNUAL REVIEW 2026
Familiar weaknesses. Faster attackers.
The NCSC’s latest review shows where AI is speeding up attacks, why familiar entry points still matter and what the evidence says about responding sooner.
Explore the findings- Public-facing applications
An exposed application gives an attacker a reachable target.
- Phishing
A convincing message can lead someone to hand over access.
- Valid accounts
Stolen or misused credentials can make access look legitimate.
- Remote services
A reachable remote access service can provide a route into systems.
AI can speed up discovery and targeting. Patching exposed services, protecting identities and monitoring access interrupt different routes.
The threat
The attack is getting quicker. The entry point is often familiar.
AI can speed up reconnaissance, vulnerability discovery, social engineering and exploit development. The NCSC describes uneven adoption and continued human direction. Its account of recent state-backed incidents still centres on familiar weaknesses rather than routine, fully autonomous attacks.
Four familiar routes accounted for 88% of incidents involving large organisations that the NCSC handled in its analysis. That is not a share of all UK attacks. Finding an exposed service, recognising an unusual sign-in and knowing who can contain it matter more when attackers can do the early work faster.
The same service may be reachable by several routes. A customer portal can be exposed through its software, a reused account or a supplier connection. Map those routes before assuming a control covers the service.
Where initial access started
Four routes in the NCSC’s large-organisation cases
12% other routes- Public-facing applications
- Phishing
- Misuse of valid accounts
- External remote services
The patch wave
More vulnerability disclosures don’t make every patch urgent.
The NCSC expects AI-assisted discovery to increase the pace and volume of vulnerability disclosures. A flaw in an internet-facing application that attackers are already exploiting deserves different treatment from a flaw on a system with no reachable attack path.
Exposure, service criticality and available mitigations should shape the response. Sometimes restricting access buys time for a tested fix; sometimes active exploitation means taking a service offline and investigating before bringing it back. Automated inventory and update verification can speed up those decisions without removing the need for judgement.
Separate the decision to contain exposure from the decision to install an update. The first can be urgent even when the second needs compatibility testing.
| Exposure | Response |
|---|---|
| Public service with active exploitation | Restrict access where feasible, look for compromise, then test and verify the fix. |
| Internal tool with restricted access | Verify the reachability assumptions, apply change control and set an owner and review date. |
Early warning
Earlier warning can help, even without another product.
Early Warning is a free NCSC service for UK organisations. Its 2026 review counted 19,922 organisations signed up. It can alert subscribers to indications of malicious activity or vulnerabilities associated with registered networks, alongside the monitoring and response arrangements an organisation already needs.
The separate Proactive Notifications Service identifies vulnerable internet-facing services and contacts affected organisations. The NCSC compared trial participants receiving those notifications with organisations that didn’t receive them. The result is about remediation speed in that trial.
Route an external alert to an owner who can identify the asset, validate the finding and confirm that exposure has been removed. That handoff is where an earlier warning becomes an earlier fix.
Remediation of identified vulnerabilities among organisations receiving notifications versus those not receiving them. This is not a finding about Early Warning.
Recovery
Getting the files back is only part of recovery.
A restored database is of little use if people cannot sign in safely, the application configuration is missing or a connected service cannot be trusted. The NCSC’s recovery guidance covers the ability to rebuild services as well as recover data.
Map the identities, configuration, data and external connections an essential service needs. Separate and protect backups, then check whether the people who use the service can complete the work it supports.
Choose a representative transaction before recovery testing. An application that starts successfully may still use stale permissions or fail when it sends data to another service.
| Dependency | Evidence before reopening |
|---|---|
| Identity and trust | Known-good administrators and sign-in controls. |
| Data and configuration | A recovery point and configuration verified for integrity. |
| Application and integrations | The application can exchange data with trusted connected services. |
| Business acceptance | A service owner can complete and verify a representative task. |
How Assured Digital can help
Talk through what you found
We work with IT teams and existing providers on Microsoft identity and endpoint security, monitoring, response, backup and service recovery. Bring a technical question, an exposed service or a recovery dependency you want to understand.
Ask Matthew a question
Loading the enquiry form…
We use your details to reply to your enquiry. Any additional marketing subscription is separate. Read our privacy notice.
Read the original sources
- NCSC Annual Review 2026 · Continuity and change
- NCSC Annual Review 2026 · AI and the cyber threat
- NCSC Annual Review 2026 · Preparing for a vulnerability patch wave
- NCSC · Early Warning
- NCSC Annual Review 2026 · Early Warning figures
- NCSC Annual Review 2026 · Securing the UK’s internet
- NCSC · Preparing technical recovery capability