Ten years after its founding, the National Cyber Security Centre has released its 2026 Annual Review, showing how much the world of cybersecurity has changes and stayed the same over the past decade.

The reflective piece stipulated that the world of cyber has evolved but not necessarily transformed, with new technologies revealing old vulnerabilities rather than creating novel threats. As cyber becomes a more commonly used vector in warfare and espionage, threats continue to change and evolve with emerging global competition and conflicts.

For large organisations, 88% of incidents come from four initial access vectors: exploiting external public-facing applications; phishing; misuse of valid accounts; and exploiting external remote services.

While these have been largely consistent, AI has seen the scale of these attacks and threats expand, challenging defences further.

While the review of course focuses on AI, it offers a refreshing perspective: AI has revealed vulnerabilities and shortfalls in cyber defences, and its making cyber threats more common and at a faster pace, but it is not necessarily introducing completely new threats.

That being said, the review acknowledges that we are at the precipise of true cyber transformation as automated threats using AI are just starting to emerge from our collective nightmares and into reality.

So how have these changes and continuity affected the UK cyber threat landscape over the past year?

The NCSC has said that China is changing the scale of competition in cybersecurity, which is grounded in its data-centric approach to cyber.

Further, cyber has become a common tool for weilding state power, be it through state-backed cyber-attacks or influencing elections and spreading misinformation. Cyber attacks have also grown as a service, with threat actors providing commercial intrusion capabilities, providing more people and organisations with the ability to carry out attacks.

Heightened geopolitical tensions have seen threats from China and other states expand as well, as cyber threats are a hallmark of the Russian invasion of Ukraine.

Increasingly, economic security is dependent on cybersecurity: “Cyber espionage is highly likely to be the most significant cyber threat to the UK’s long-term economic growth,” the report said.

Malicious cyber activity cost UK organisations an estimated £14.7 billion every year, according to UK government research. The NCSC likened this to wiping out the entire value of the UK’s cybersecurity sector each year.

And of course, AI and automation are helping threat actors identify more vulnerabilities, enhance attacks, and even generate malware.

All of these trends point to a more contested, competitive, and technologically accelerated cyber environment that the UK must contend with.

While the vulnerabilities being used are well understood, the speed and scale of attacks present increasing challenges to the UK cyberdefences.

The report gave special credence to AI, saying that it is almost certain that the emergent technology will “act as a force multiplier across the cyber threat landscape, allowing skilled threat actors to carry out operational tasking at increasing scale, speed and efficiency.”

Recommended reading

• 65% of Cyber-leaders Reuse Old Passwords
• NCSC Warns of Russian Zero-click Exploit Campaign
• NCSC Warns of Covert China-linked Networks
• NCSC Endorses Passkeys Over Passwords
• World Password Day: Are Passkeys the Future?
• Kaspersky: 45% of Passwords Could be Hacked Within 1 Minute

It is also likely that AI will continue to be used by threat actors across the scope of their activities, often being used to increase the speed and scale of existing methods rather than being used to autonomously conduct end-to-end attacks.

The NCSC says that AI-assisted vulnerability discovery will also post a threat as threat actors are better able to target systems via unpatched exploits.

All of these threats are likely to compound in a widening digital divide between organisations adopting and deploying AI in defence and those that do not.

The review says that China is highly likely to have the most intent and be best positioned to use AI for operations against critical national infrastructure and other strategic targets.

Further, the NCSC thinks that shadow AI is likley to continue to leave organisations open to exploitation.

AI malware is also predicted to be used in a ransomware attack on the UK’s critical national infrastructure, with the NCSC saying this is “highly likely” to occur.

AI is changing the level of sophistication, and after studying 337 incidents last year, the NCSC took home seven key lessons.

1. Attackers exploit the basics: Known vulnerabilities on poorly secured systems are still key to most exploites
2. People remain a target: Social engineering and credential threats remain lucrative for threat actors – security culture therefore is key.
3. State and criminal actors share weaknesses: These actors use similar routes to compromise, relying on vulnerbilities and compromised credentials. Poor cyber hygeine increases opportunities for threat actors across the board.
4. Ransomware remains highly disruptive: Extortion, data theft, operation disruption, and long recovery timelines were seen across the last year.
5. Preparation determines outcomes: Being prepared –  from logging and monitoring to incident response planning and supply chain resilience – determines the fallout of an attack.
6. Early action reduces impact: Similarly, early warning notifications, faster detection, and containment can stop an attack from becoming a catastrophe.
7. Sophisticated actors don’t have to be sophisticated to gain access: Initial access doesn’t need to be complicated, but sophistication is seen at later stages of attacks.

“Most successful attacks continue to exploit familiar weaknesses. Improving cyber mresilience fundamentals remains the most effective way to reduce both the likelihood and impact of cyber incidents,” the report concluded.