Summary
- The NCSC directly supported 337 incidents between September 2025 and August 2026.
- Eighty incidents were classified as nationally significant, while 8,500 organisations received Early Warning notifications.
- Known vulnerabilities, stolen credentials, social engineering, and inadequate monitoring remained recurring factors.
The UK’s National Cyber Security Centre directly supported 337 cyber incidents during its latest reporting year, including 80 cases classified as nationally significant.
The figures, published in the agency’s Annual Review 2026, cover the period from 1 September 2025 to 31 August 2026 and provide an account of the incidents requiring involvement from its Incident Management Team.
During that period, the National Cyber Security Centre received 1,831 reports of cyberattacks affecting organisations across different sectors.
After assessment and triage, 337 incidents required direct support. The remaining reports did not require the same level of intervention, although the NCSC’s wider activities include notifications, technical guidance, and coordination with other organisations.
The figures describe incidents reported to and handled by the national authority rather than the total number of cyberattacks experienced across the UK.
Familiar weaknesses dominate serious intrusions
The annual review identifies the exploitation of known vulnerabilities, stolen credentials, social engineering, and poorly secured internet-facing systems among the recurring methods used by attackers.
These weaknesses appeared across incidents involving financially motivated criminals and actors assessed as having links to nation states.
Although the objectives of those groups can differ considerably, many rely on similar opportunities to establish initial access.
An unpatched externally accessible system may provide an entry point, while compromised credentials can allow an attacker to use legitimate administrative capabilities.
Once inside a network, more complex activity may follow. Attackers can attempt to expand permissions, access sensitive information, move between systems, or interfere with recovery arrangements.
The NCSC’s findings indicate that the sophistication of an eventual intrusion does not necessarily reflect the complexity of the initial weakness.
Organisations operating large technology estates face particular challenges in maintaining an accurate picture of exposed services and software versions. Equipment may remain in use after its original purpose changes, while responsibility for systems can become divided between internal teams and external suppliers.
Those conditions can leave known vulnerabilities unaddressed despite the availability of security updates.
Early intervention limits escalation
Alongside its direct incident response work, the NCSC used its Early Warning service to notify approximately 8,500 organisations about events indicating possible compromise.
The service is intended to identify suspicious activity before it develops into a more disruptive incident.
Notifications can prompt organisations to investigate exposed services, unexpected network activity, or other indications that an attacker may have established access.
The agency notes that some incidents may have been contained before reaching the level that would require direct NCSC support.
However, the annual review does not provide a definitive count of attacks prevented by the service, and the notification total should not be interpreted as the number of confirmed compromises.
The distinction between suspected activity, reported incidents, and cases requiring intervention remains important when interpreting the agency’s operational figures.
Recovery depends on preparation
The NCSC identifies monitoring, logging, incident response planning, and supply chain resilience as recurring factors influencing the outcome of serious cyber incidents.
Reliable records allow investigators to reconstruct suspicious activity and determine which systems may have been affected. When logs are unavailable or incomplete, organisations can face considerable uncertainty about the extent of an intrusion.
Recovery arrangements also need to account for the possibility that ordinary management systems and communications will be unavailable during an attack.
Where organisations depend on outsourced technology providers, disruption can require coordination across several businesses with different operational responsibilities.
The NCSC’s reporting year included incidents affecting critical national infrastructure and its supporting ecosystem, including activity believed to be linked to state actors.
It also observed attackers beginning to use AI tools during intrusions. The agency states that the examples encountered did not create an entirely new class of attack.
That finding concerns observed incidents, distinguishing the annual review from the NCSC’s separate assessment of how AI-enabled threats may develop by 2028.
The 337 cases requiring direct support represent only part of the agency’s wider work, which includes identifying suspicious activity, supporting organisations, and coordinating responses where incidents carry national consequences.
The annual review records those activities across the NCSC’s tenth year, while acknowledging that incident reporting and severity do not necessarily follow a consistent year-on-year trend.
