What the NCSC says
At the launch of its 10th Annual Review and the aptly named “State of Cyber Nation”, the UK’s National Cyber Security Centre (NCSC) retold the plot of the film Sliding Doors, in which a woman’s whole future is decided by whether she catches the closing doors of a tube train. The NCSC called this “a sliding doors moment, a moment of choice” for the UK, where we are faced with a series of choices which will impact the direction of our businesses, organisations and countries.
In the review, chief executive Richard Horne opens with an admission: The UK’s cyber resilience “is not yet where it should be”, and the threat “has increased faster than our defensive capabilities”. Richard highlights that AI didn’t create today’s weaknesses – more so, is revealing them, and years of technical debt and deferred investment are now easier for attackers to find at scale.
The numbers back that up; over the year the NCSC received 1,831 reports of cyber attacks and supported 337 incidents. Of those, 80 were nationally significant. The well documented 2025 JLR attack reported approximately £196 million in direct costs, and the NCSC says it contributed to UK economic growth of only 0.1% in the third quarter of 2025.
What’s striking is how ordinary the attacks are. For large organisations 88% of the incidents the NCSC handled came through four routes – public-facing applications, phishing, misuse of valid accounts and external remote access services.
Why the Basics Are Still Hard
The NCSC report highlights the tools, standards and frameworks to protect the UK from conventional and AI-powered attacks already exist, so the real challenge is implementing quickly and holistically at scale. The painpoints that have long plagued cybersecurity still exist today – too many alerts from too many fragmented tools and platforms, and too few skilled people in house to work through them without burning out.
AI amplifies these challenges, because it speeds up the attacker’s side of the race. The NCSC highlights that it’s “almost certain” that AI will act as a force multiplier for attackers, and expects defenders to face “a race to shorten patch deployment timelines.”
The NCSC also warns that organisations with legacy technology and limited resources “may struggle to keep pace.” The Arctic Wolf 2026 Threat Report reflects this, with the vulnerabilities Arctic Wolf Aurora Incident Response met most often skewing towards edge devices such as firewalls and VPNs and including Exchange flaws first discovered in 2021.
What Arctic Wolf Research Shows for the UK
Earlier in 2026 Arctic Wolf published our AI and Cybersecurity Trends Report, which surveyed 1,350 Global IT and security decision makers including those in the UK and Ireland. The report highlights that teams are stretched thin, and respondents show a confidence problem. For the first time, AI risk is now the top concern at 35%, ahead of ransomware at 25%. The gap shows up implementing AI for defences – only 14% have made AI central to security operations, and blocking malicious addresses at the firewall is the only task a majority (53%) trust AI to do without human supervision. Leaders want the speed of AI but don’t yet trust it to act centrally.
Defence in Depth with AI in the Picture
AI security doesn’t replace defence in depth, and arguably it shows why this approach matters more than ever because no single AI security control or “simple button” will be enough. AI attacks still exploit the weaknesses defenders have always seen and exploited – such as poor identity controls, excessive privileges, exposed data, unmanaged assets, vulnerable systems and weak monitoring. AI just adds speed and scale.
Be wary of an AI silver bullet. An AI firewall doesn’t solve AI risk, and AI doesn’t create entirely new security principles. Instead, treat AI risk as a security operations problem, because attackers using AI still target identities, endpoints, cloud environments and data. Defence in depth is built on independent layers, so if one is compromised another can protect you.
Five Decisions for Business Leaders
- Maintain an inventory of your attack surface and your time to resolve for patching. Continuously map internet-facing assets and benchmark a realistic time to fix a critical flaw. Replace end-of-life technology with urgency and keep critical operational systems, such as water controls and refrigeration, out of attackers’ reach. You can’t remediate a vulnerability in hours if you don’t know the system exists.
- Tighten identity and privileges. Deploy multi-factor authentication on every remote route and lock down remote access to the concepts of Zero Trust, including inactive VPN accounts and excess admin rights. Attackers often steal session tokens to get past standard multi-factor authentication, so use passkeys or other phishing-resistant methods where you can. Grant access where necessary rather than where it is convenient.
- Find your exposed data, including compromised user profile data. This information is useful for AI reconnaissance for spear phishing or coercing your staff.
- Monitor around the clock with humans and trusted, validated AI technologies working in concert, and work with your experts to agree the authority and guardrails to contain emerging threat as it lands.
- Have a plan, and test where your controls fail. Document your incident response and recovery steps and run simulation exercises to see which layer of defence in depth notices first. Treat every AI agent like a new contractor with its own identity, scoped access and logged actions. Buy on resilience as well as price and fund technology across its whole life.
Partnering with Your Board
Cybersecurity is a business risk and not solely a technical issue, and the NCSC wants boards and executive teams to look for measurable improvement in preparedness, recovery capability and resilience outcomes rather than proof that policies exist. The upcoming Cyber Security and Resilience Bill is the route for putting that expectation into regulation. The bill is in the House of Lords and updates the Network and Information Systems (NIS) Regulations 2018, with fines of up to £17 million or 4% of turnover for serious breaches, and a requirement to notify an incident within 24 hours and report in full within 72 hours. The UK government has said secondary legislation will mandate board-level governance in line with the NCSC Cyber Assessment Framework. NCSC maintains a board engagement kit for IT leaders that provides a valuable framework for board-level cyber discussions.
What Government Announced at the Launch
Cybersecurity minister Baroness Lloyd of Effra announced nearly £10 million to fund 75% of the cost of Cyber Essentials for small and medium-sized businesses until the end of March 2027. The UK Government is also backing a £4 million national agentic security unit at the NCSC, and the National Cyber Action Plan is due shortly.
How Arctic Wolf helps
Organisations that will manage AI risk best respond dynamically as the threat landscape continues to shift and accelerate. This requires continual visibility, detection, response and risk management, with security experts to resolve issues as they arise. That’s what Arctic Wolf delivers to 12,000+ customers 24×7 around the globe. The Aurora Superintelligence Platform focuses on Cyber Resilience, and unifies visibility of your attack surface with in-house threat research, expert security practitioners and over 300 purpose built AI agents working in concert for transparent threat detection, response and resolution at machine speed for your organisation; delivering efficacy and speed, yet trust, transparency and validation for Cyber Resilience, focusing on Mean Time to Trusted Actions as the new benchmark for performance and accountability within agentic threat detection response.
Sources:
NCSC Annual Review 2026. Arctic Wolf 2026 Threat Report (EMEA), 2026 AI and Cybersecurity Trends Report (Sapio Research survey of 1,350 decision makers, April 2026) and 2026 Agentic Security Operations Report.
