The NCSC Annual Review 2026, published by the National Cyber Security Centre on 3 November, has a clear message for every UK organisation: most successful cyber attacks still get in through familiar, fixable weaknesses. For small and medium-sized businesses, that’s good news. You don’t need a huge security budget to act on it. You need the basics done well, and done consistently.
Key takeaways
- The NCSC handled 337 incidents in the year to August 2026, 80 of them nationally significant.
- Most successful attacks still exploit familiar weaknesses: unpatched systems, stolen passwords and poor access control.
- Patching, passkeys or multi-factor authentication, and retiring old systems are quick wins for SMEs.
- A written, tested incident plan and reliable backups decide how quickly you recover.
What the NCSC Annual Review 2026 found
The review covers 1 September 2025 to 31 August 2026. According to the NCSC’s incident management figures, during that period:
- the NCSC received 1,831 reports of cyber attacks affecting organisations
- 337 of those needed NCSC support after triage
- 80 were classed as nationally significant
- around 8,500 organisations were sent Early Warning notifications about signs of a suspected compromise
Those headline incidents mostly involve larger organisations, but the routes in are exactly the same ones attackers use against SMEs every day.
Seven lessons from the NCSC Annual Review 2026
The NCSC summarised what it learned from those incidents in seven key points. In plain English:
- Attackers exploit the basics. Known flaws, weakly secured systems and internet-facing devices are still a main way in.
- People remain the target. Phishing, social engineering and stolen passwords are central to many attacks.
- Criminals and state actors use the same weaknesses. Poor basic hygiene helps every kind of attacker.
- Ransomware is still highly disruptive. Data theft, extortion and long recovery times are common.
- Preparation determines outcomes. Logging, monitoring and an incident response plan shape how bad things get.
- Early action reduces impact. Spotting and containing a problem quickly stops it escalating.
- Getting in is often simple. The clever part usually comes after the attacker is inside.
What the NCSC Annual Review 2026 means for your business
Speaking at the launch, NCSC CEO Richard Horne pointed to habits such as “end-of-life systems kept running for just one more year” and access “granted where it was convenient rather than where it was necessary”. You can read the full speech on the NCSC website. Here’s how those lessons translate for a typical SME.
Patch anything that faces the internet
Firewalls, VPNs, remote access tools and email systems are the front door. Make sure updates are applied promptly, and that someone is actually checking they’ve worked.
Move towards passkeys and stronger sign-in
Stolen passwords remain one of the easiest ways in. The NCSC now recommends passkeys wherever they’re available, because they’re tied to the real service and far harder to phish. At the very least, every business account should have multi-factor authentication switched on. Our recent guide to passkeys for business explains how to get started.
Retire old systems on purpose
Keep a simple list of devices and software, with their support end dates. Plan replacements in advance rather than running unsupported systems “for just one more year”.
Give people the access they need, not more
Review who has admin rights, shared logins and access to sensitive data, and remove leavers promptly. It’s quick to do and makes a real difference.
Ask your suppliers about security
The NCSC encourages organisations to understand their supplier dependencies, including through Cyber Essentials. Ask key suppliers whether they’re certified, and consider certification yourself, as it’s the clearest way to show customers you take the basics seriously.
Plan for a bad day
Know who to contact, how you’d keep working and how you’d restore your data. Write it down and test it. Monitoring and reliable, tested backups are what turn a crisis into an inconvenience.
A practical first step
The NCSC Annual Review 2026 is a useful reminder that the fundamentals matter most. If you’re not sure where your business stands, start with our free SME Cyber Security Checklist. It walks you through the same fundamentals the NCSC highlights, in plain English.
At LevelUp Networks, we’re Cyber Essentials, ISO 9001 and ISO 27001 certified, and we help UK SMEs put these basics in place and keep them there. Our cyber security services cover areas such as security reviews, Cyber Essentials readiness and staff awareness, and our managed IT support keeps devices patched and accounts properly managed. Extras such as email security and backup can be added to suit your business.
Want to talk it through? Email us at [email protected] or get in touch through our contact page. Existing clients can simply email our service desk.