AI didn’t create the weaknesses, it’s revealed them – now we need to fix the fundamentals
Ten years on from its formation, the National Cyber Security Centre has published its Annual Review, announcing that the UK is entering 2027 at a watershed moment and setting out a strong call to action to strengthen our cyber defences now, getting the fundamentals right, or risking not being able to keep up with the threat in the age of AI.
On 3rd November, the great and the good of the organisation gathered at The State of the Cyber Nation launch event to point to the challenges and opportunities ahead. The Cyber Minister (Baroness Lloyd) announced a package of measures to help SMEs build their cyber resilience, including a £2.4 million Cyber Essentials First Step Fund which gives SMEs 75% off a new Cyber Essentials certification. Then Richard Horne made use of a number of analogies (from Sliding Doors to the Leaning Tower of Pisa) to describe the predicament that we now find ourselves in at a time when geopolitical instability and the unprecedented scale and speed of technological advancement have converged. A panel session with the NCSC’s leadership team followed the speeches, who, unsurprisingly given recent attacks on operational technology, found themselves answering several questions about fridges.
Key takeaways from the NCSC Annual Review 2026: cyber resilience in the age of AI
1. The UK’s resilience isn’t where it needs to be. The central message is that the threat has grown faster than the UK’s defences, leaving too many organisations exposed to attacks that should have been preventable. The main challenge going forward is framed around whether organisations can modernise and build resilience quickly enough, which ‘requires us to look not at our attackers, but at ourselves.’
2. AI exposed existing weaknesses rather than creating new ones. The prevailing view is that AI has laid bare years of technical debt and missing basic protections, with security investment too often deferred. AI’s main effect will be to speed up and scale existing attack techniques, not to open new attack vectors. Incident data supports this, since none of the AI use that the NCSC observed in real attacks enabled a new class of attack.
3. Attackers are still exploiting the basics. The ‘7 things we learned’ page of the report condenses the 337 incidents into one takeaway: most successful attacks still exploit familiar weaknesses, so strengthening fundamentals remains the most effective way to reduce both the likelihood and the impact of incidents. Even state-linked intrusions often exploited vulnerabilities where available patches hadn’t been applied in time, and poor cyber hygiene creates opportunities for all sorts of threat actors.
4. The AI “digital divide” is both a market opportunity and a responsibility. The NCSC judges that well-resourced organisations will gain most from AI-enabled defence, while those with legacy technology and limited resources fall behind and become more attractive targets. AI has the potential to bring advanced capabilities to organisations that previously couldn’t afford them. Products and services that bring defensive AI to smaller and less mature organisations fit that gap directly. The Review also flags “shadow AI”, meaning staff moving sensitive data to personal devices to use unapproved AI tools, as a route for attackers.
5. Secure by design and resilient by default are the long-term answers. Discovering and manually patching every flaw cannot keep pace with machine-speed vulnerability discovery. Automated remediation will help, but it cannot fix insecure foundations (the digital equivalent of the Leaning Tower of Pisa), so the goal must be technology that prevents whole classes of vulnerability and limits the impact of those that remain. That requires investment across the technology stack: secure development practices that make vulnerability prevention part of normal engineering, plus hardware-backed security, strong identity and trustworthy update mechanisms as dependable control points.
The NCSC expects technology companies to be part of the solution. It anticipates that they will use AI throughout the development lifecycle to find flaws before release and to generate and test fixes. It also stresses that AI systems themselves must be secured across their whole lifecycle, from design and development through deployment, operation and maintenance.
For now though, the NCSC’s Principles Based Assurance will help to shift assurance away from one-off compliance checks towards evidence-backed confidence in security outcomes that works as threats change. Furthermore, all technology companies are being encouraged to use the new Cyber Resilience Test Facilities so that buyers have meaningful evidence of product resilience.
(** Watch this space for more on product liability – as announced in the recent Budget documentation, the Government will consult next year on ‘how to tackle insecure technology at source and consider where liability for cyber breaches should sit’. This work will build on an ongoing review of product liability law by the Law Commission of England and Wales. You can find out more about the Law Commission’s consultation and how to get involved in techUK’s response by contacting techUK’s Policy Manager for Digital Commerce & Consumer Policy – Connie Winn-Taylor **)
6. The CS&R Bill, and why regulation alone is not enough. The report presents the Cyber Security and Resilience Bill as creating a more comprehensive, flexible and enforceable framework. It brings new sectors into scope, adds national security powers for crises, and lets government adapt the regime as threats change. But it also cautions that while regulation is a powerful lever, it won’t deliver outcomes on its own, and that boards should seek evidence of measurable improvement rather than just the existence of policies.
7. Cyber Shield is a direct invitation to industry. Under this joint NCSC and Department for Culture, Media and Sport (DCMS) programme, the NCSC provides the platform and intelligence, while the defensive agents themselves are to be built and run by the cyber security market and the open-source community. DCMS will consult on and co-design the protocols, standards and data models. The NCSC explicitly asks the wider community to integrate agents, share insights and help shape the emerging standards and techUK’s members will have much to contribute here.
And so back to Sliding Doors… For those unfamiliar with the 90s film, the premise is built upon the idea that the train we get on determines the path our future will take – and Horne argued that this was relevant for cyber security today. Here is a moment of choice for leaders of organisations of all sizes and types to play their part in helping the UK to be cyber resilient. The consequences of cyber-attacks are now being understood thanks to recent high-profile events (including the recent attacks on supermarket fridges connected to the internet.) but those leaders must act now to treat security and resilience as a fundamental requirement, investing with urgency and replacing end-of-life technology without delay because, echoing AI Minister Kanishka Narayan’s recent words, Horne underscored that ‘the consequences of this moment we find ourselves in could be felt for generations’.
One final thought … it’s clear that there is still a gap to address between understanding the risk and executing what’s required to mitigate it, and this is where we can lean in to help organisations across the economy and sectors (with the ‘how’) to deploy the national technical authority’s guidance and advice (the ‘what’).
Read our summary of the NCSC Annual Review and the full The State of the Cyber Nation report.
