The NCSC’s 2026 review explains why familiar attacks are getting faster

A public application, a plausible email, a valid account and a remote service are familiar entries in any threat model. What changes when finding vulnerable systems and preparing a convincing approach takes less time? The NCSC’s review points to a practical consequence: defenders may have less time to identify what is exposed and decide how to respond.

What the four routes tell us

The NCSC grouped four initial-access routes across 88% of its analysed incidents involving large organisations. That combines exposed public applications, phishing, valid accounts and remote services in one figure. The review covers September 2025 to August 2026. Its incident caseload describes organisations and incidents the NCSC handled, so applying that percentage to every UK business would exceed the evidence. The review supplies no individual percentage for any of the four routes. NCSC Annual Review 2026 · Continuity and change

One useful way to apply that finding is to map routes to a service, rather than organising the whole problem around software products. A customer portal may be reachable through the application, an administrator’s account or a support provider’s connection. Updating the application deals with one path. Restricting administrative access and noticing unusual sign-ins deal with others. The service owner needs an answer about all three.

Where speed changes the defensive decision

AI can help operators search for vulnerable components, tailor messages, analyse code and develop exploits. Those uses can lower effort and increase throughput. The NCSC describes uneven adoption and a near-term role for human direction. A faster stage of an attack can still change the overall response window even when the rest of the operation depends on people. NCSC Annual Review 2026 · AI and the cyber threat

Imagine an internet-facing file exchange and an internal tool both receive an urgent-looking advisory. The external service is reachable and there is evidence that attackers are using the flaw. Restricting access and examining logs may be prudent before a patch can be tested. For the internal tool, validate which accounts and systems can reach it before choosing the urgency. A mistaken exposure assumption is a reason to change that decision. NCSC Annual Review 2026 · Preparing for a vulnerability patch wave

Inventory and scanning can assist this work. An accountable owner still needs to decide whether to interrupt a service, apply an interim restriction or accept a short delay. After an update, check the exposed version and the route that was accessible. A closed ticket alone provides little evidence about either.

Turn an alert into a verified change

Early Warning is an NCSC service UK organisations can register for. It sends relevant indicators tied to registered networks. The separate Proactive Notifications Service identifies exposed vulnerable services and notifies organisations. In the reported trial, recipients remediated identified vulnerabilities up to 45% faster than those who did not receive notifications. That measures remediation in the trial, rather than compromise rates or a guaranteed result. NCSC Annual Review 2026 · Early Warning figures · NCSC Annual Review 2026 · Securing the UK’s internet

A good handoff identifies who checks the external finding, how they match it to an asset and how they verify the fix. The same ownership question comes back in recovery. A server can start while identities, configuration or connected services are still untrusted. A test that ends with a real service task gives a more meaningful result than a successful boot. NCSC · Preparing technical recovery capability

See the IT research page and recovery diagram for how these dependencies fit together.