AI didn’t create the holes. It found them.

What the NCSC’s 2026 Annual Review means for North East businesses

Last week the National Cyber Security Centre (NCSC) published its tenth annual review. I’ve read it so you don’t have to.

The headline isn’t some exotic new threat. It’s that most attacks still get in through the same old gaps. Unpatched systems. Stolen passwords. A convincing email landing in a busy inbox.

Richard Horne, the NCSC’s CEO, puts it plainly in his foreword: “The UK’s cyber resilience is not yet where it should be.” He adds that too many organisations are left “vulnerable to attacks that could – and should – be prevented.”

Could and should be prevented. That’s the bit I want every business owner in the North East to hear, because it’s actually good news.

What the NCSC found

In the year to the end of August 2026, the NCSC received 1,831 reports of cyber attacks. 337 incidents needed its support, and 80 of those were nationally significant. Its Early Warning service alerted 8,500 organisations to a suspected compromise.

According to the NCSC, “Most successful compromises still rely on familiar methods.” Attackers routinely exploited known weaknesses in internet-facing systems, used stolen login details and tricked people with social engineering.

Of the seven lessons the NCSC drew from those incidents, the first is “Attackers exploit the basics”. Its key takeaway is blunt: “Most successful attacks continue to exploit familiar weaknesses.”

NCSC Annual Review 2026

There’s encouraging news too. The NCSC’s Suspicious Email Reporting Service received over 13.4 million reports in 12 months, the highest since it started. People are spotting the bait.

Why AI makes the basics more urgent, not less

You’ll have read plenty about AI and cyber attacks. Some of it is hype. Some of it isn’t.

The NCSC describes AI-powered attacks as “a force multiplier which makes it easier, faster and cheaper for an attacker to ruthlessly expose those organisations that don’t have ‘the basics’ in place.”

In other words, AI hasn’t invented a new way in. It’s just quicker at finding the doors that were already open. Attackers have started using AI tools, but the NCSC is clear: “None of the observed uses of AI enabled a novel class of attack.”

Here’s the reassuring part. According to the NCSC, “the tools, standards and frameworks that can protect the UK from conventional and AI-powered cyber attacks already exist.” The challenge is putting them in place, quickly.

You don’t need a crystal ball. You need the basics done properly, every single day.

Five things every business should be doing now

1. Patch internet-facing systems quickly. The NCSC found many incidents involved vulnerabilities “for which patches are available but have not been deployed in a sufficiently timely fashion”. If a fix exists, get it on fast, starting with anything facing the internet.
2. Move to phishing-resistant sign-in. According to the NCSC, traditional multi-factor authentication, including text codes, app codes and push approvals, is “inherently phishable”. It recommends passkeys wherever a service supports them, with two-step verification as the fallback.
3. Monitor your systems and test your response plan. One of the NCSC’s lessons is simply “Preparation determines outcomes”. Good monitoring spots trouble early. A tested plan means everyone knows their job when the pressure’s on.
4. Look after your people. “People remain the target,” says the NCSC. Regular, practical training and a culture where staff feel safe reporting a dodgy email are worth their weight in gold.
5. Check your supply chain, and get Cyber Essentials. The NCSC warns that weaknesses in a supply chain can expose you to risks beyond your control. The government’s Cyber Resilience Pledge includes a commitment to roll out Cyber Essentials across supply chains, so your customers may soon ask whether you have it.

How we do this at HTG

This is exactly why we built Overwatch, our proactive managed IT and security service.

I often compare what we do to brain surgery. You hope you never need a brain surgeon, but if you do, you want the best expert to hand. Overwatch gives you that expertise, and that reassurance, every day.

Prevention comes first. An ounce of prevention is worth a tonne of the cure. So we patch, monitor and strengthen your systems before attackers come looking, rather than waiting for something to break.

When you do need us, you get a fast first-time fix. No long waits. No stopping the clock to dodge an SLA breach. No ticket ping-pong, and no offshore hold music. Just canny local folk who care, here in the North East.

We also keep you a step ahead, sharing the latest insights and helping you use AI safely to gain an edge.

Overwatch is built around NCSC guidance and the Cyber Assessment Framework (CAF), and aligned with the CIS Controls. We hold ourselves to the same standards. HTG is Cyber Essentials Plus, ISO 9001 and ISO/IEC 27001 certified, and a Microsoft Solutions Partner. We’ve been keeping North East businesses up and running since 2005.

Let’s talk

The NCSC says boards should manage cyber security “as a business risk rather than solely a technical issue”. I couldn’t agree more. You don’t need to become a technical expert. You just need one you can trust.

So here’s my offer. Let’s have a no-obligation chat about how your business measures up against the NCSC basics. We’ll tell you plainly what’s working, what isn’t and what to fix first.

Call us on 0191 481 3446 or book a discovery session.