The NCSC’s Tenth Annual Review Counts 80 Nationally Significant Incidents. Privacy Teams Should Read Past the Headline

The UK’s National Cyber Security Centre published its tenth Annual Review on November 3, 2026, covering the twelve months from 1 September 2025 to 31 August 2026. The headline figure looks like good news. The NCSC classed 80 incidents as nationally significant, down from 204 a year earlier. Read the rest of the review, though, and the agency is not celebrating. Its chief executive, Richard Horne, writes that “the UK’s cyber resilience is not yet where it should be” and that the threat “has increased faster than our defensive capabilities.”

For privacy, legal and data protection teams, the useful part of the review is not the total. It is the pattern behind it: attackers still get in through unpatched internet-facing systems, stolen credentials and social engineering, while AI shortens the time between a flaw being found and a flaw being used. Each of those routes ends, sooner or later, in a personal data question. This piece walks through what the NCSC actually reported, what it forecast, and where the numbers should change how a privacy program prepares for its next incident.

What the NCSC counted this year

The NCSC’s Incident Management team is the part of the agency that triages reports from UK organisations and coordinates the government response to serious attacks. According to the review’s incident management chapter, the year looked like this:

• 1,831 reports of cyber attacks affecting UK organisations across a range of sectors.
• 337 incidents that, after triage, needed direct support from the team.
• 80 of those classed as nationally significant.
• 8,500 organisations notified through the NCSC’s Early Warning service of events that pointed to a suspected compromise of their systems.

For comparison, the previous review (1 September 2024 to 31 August 2025) recorded 1,727 reports, 429 incidents handled and 204 nationally significant incidents, which the NCSC described at the time as roughly four a week. So reports went up by about 6 percent while the number of incidents needing hands-on help fell by about a fifth and the nationally significant count fell by more than half.

The NCSC warns against reading this as a trend. The review says incident reporting “does not follow a simple year-on-year trend,” that past peaks were often driven by a small number of particularly severe events, and that the Early Warning notifications probably stopped some intrusions before they grew into incidents needing national support. It also notes that the figures “do not tell the whole story,” because individual responses vary enormously in size and complexity. A year with fewer, larger incidents can do more damage than a year with many small ones.

There is a second reason for caution. These are incidents that reached the NCSC. Many UK organisations report a personal data breach to the Information Commissioner’s Office, a sector regulator or their insurer without ever contacting the NCSC. The review measures national security workload, not the total number of breaches in the country.

The review’s AI findings, stated carefully

Coverage of the review has focused on AI, and with reason. But the NCSC separates what it observed in incidents from what it expects to happen. That distinction matters for anyone writing a risk register or briefing a board.

What the NCSC observed

The incident team says it has “begun to see threat actors incorporating AI tools into their attacks,” and adds that none of the observed uses of AI “enabled a novel class of attack.” In other words, AI made familiar techniques faster and cheaper. It did not, in the cases the NCSC handled, create a new way in. The agency’s conclusion is that established controls still work, if organisations actually apply them.

What the NCSC assesses and forecasts

In its assessment of AI’s impact on the cyber threat, the NCSC uses formal probability language. Among its judgments:

• It is “almost certain” AI will act as a force multiplier, letting skilled attackers work at greater scale, speed and efficiency. The latest models are “transforming cyber operations” across reconnaissance, social engineering, vulnerability discovery and exploit coding.
• It is “highly likely” AI will keep speeding up existing attack methods rather than running complete attacks on its own. Human operators remain essential, and the more skilled the operator, the bigger the gain.
• It is “highly likely” AI-assisted vulnerability discovery will give attackers more chances to hit systems before they are patched, setting off a race to shorten patch timelines.
• It is “almost certain” a digital divide will widen between organisations able to use AI for defence and those stuck with legacy technology and thin resources.
• It is “highly likely” that shadow AI, meaning staff moving company data onto personal devices or unapproved tools, will expose organisations to both state-linked groups and criminals.
• It is “highly likely” AI malware will be used in a ransomware attack on UK critical national infrastructure. The threat chapter puts this inside a window running to 2028.

That last point has been summarised in some places as ransomware gangs already using AI against critical infrastructure during the review year. The review does not say that. It says ransomware “remains highly disruptive,” that criminal use of AI will “highly likely” increase the scale and efficiency of ransomware operations, and that an AI-malware ransomware attack on UK critical infrastructure is highly likely by 2028. It is a forecast, and a serious one, not a description of a confirmed incident.

Why a cyber review is a privacy document

Privacy teams sometimes treat national cyber reports as somebody else’s reading. This one maps closely onto their work. Look at the NCSC’s list of the seven things its 337 incidents revealed: attackers exploit the basics, people remain the target, state and criminal actors share the same weaknesses, ransomware remains highly disruptive, preparation determines outcomes, early action reduces impact, and sophisticated actors “don’t have to be sophisticated to gain access.”

Almost every one of those has a data protection consequence. Ransomware today usually means data theft followed by extortion, which turns an outage into a reportable personal data breach. Credential theft is how attackers reach mailboxes, HR systems and customer databases. Supply chain compromise is how a vendor’s mistake becomes your notification. The NCSC’s own case study on Jaguar Land Rover, which the review says reported about £196 million in direct cyber-related costs and contributed to UK growth of just 0.1 percent in the third quarter of 2025, is a reminder that one incident can spread across hundreds of suppliers and their data.

Shadow AI deserves particular attention. The NCSC frames it as a security risk: once staff paste sensitive material into personal or unapproved tools, the organisation loses sight of “how the information is handled and who can access it.” Under UK GDPR, that same act can be a disclosure to a processor or third party with no contract, no transfer assessment and no entry in the record of processing. The security team and the privacy team are looking at the same event from two ends.

Our earlier analysis of how ransomware crews shifted toward data theft and vulnerability exploitation reached a similar conclusion from the vendor side. The NCSC’s figures now add a national view.

Seven things to change before the next incident

The review is written for security professionals and the public sector, but its lessons translate into concrete work for privacy and compliance leads. These are the changes we would prioritise, roughly in order of effort.

1. Treat patch speed as a data protection control. If AI shortens the time from disclosure to exploit, the window in which a known flaw sits open is the window in which personal data is exposed. Ask for the median time to fix critical, internet-facing vulnerabilities and track it. The review cites one government example where vulnerability management cut the median time to fix domain-related flaws from 50 days to 8.
2. Move high-risk accounts off passwords. The NCSC recommends passkeys as the preferred authentication method for individuals and spent the year pushing adoption, including in the government’s One Login service. Start with accounts that can reach large stores of personal data: admin consoles, HR and payroll, CRM exports and cloud storage.
3. Put shadow AI into the record of processing. Survey which AI tools staff actually use, decide which are approved, and record what personal data may go into each one. A policy that bans unapproved tools is not evidence that data stopped flowing into them; usage logs and network controls are.
4. Rehearse the 72-hour clock with the security team. UK GDPR Article 33 requires notification to the ICO within 72 hours of becoming aware of a reportable breach. Operators covered by the NIS Regulations have their own incident reporting duties, and the Cyber Security and Resilience Bill now before Parliament would expand them. Run one tabletop where the decision on “is this a personal data breach?” has to be made with incomplete facts.
5. Map which suppliers hold which data. The review points to the government’s Cyber Resilience Pledge and the push to roll out Cyber Essentials across supply chains. A supplier’s certificate tells you about its baseline controls. It does not tell you which of your data sets it holds, where, or for how long. Keep that mapping yourself.
6. Sign up for early warnings and decide who reads them. The Early Warning service sent 8,500 notifications this year. An alert that lands in an unmonitored mailbox prevents nothing. Name an owner and a response time.
7. Write down how incidents become notification decisions. The review says preparation determines outcomes, meaning logging, monitoring and incident response plans. Make sure your plan records who decides whether data was accessed, what evidence they rely on, and when legal and privacy are brought in.

None of this is new advice, and that is the NCSC’s point. Its minister of state, Dan Jarvis, writes in the review’s foreword that the core components of good cyber security “remain exactly the same today as they did in 2016.”

What the UK is building in response

The review also describes the state’s own plans. Several will affect private organisations in the next few years.

• Cyber Security and Resilience Bill. The NCSC describes it as bringing new sectors into scope, adding national security powers to respond to crises, and giving government the flexibility to update the framework as threats change. It was still progressing through Parliament when the review was published, so its final requirements are not settled.
• CAF Core Profile. The NCSC has published a minimum benchmark under its Cyber Assessment Framework for essential services and other organisations critical to UK security and prosperity, designed to resist “moderately sophisticated attackers.”
• Cyber Shield. A five-year programme, run jointly by the NCSC and the Department for Digital, Culture, Media and Sport, to build a national ecosystem of AI agents for detection and response. The government’s October 2026 AI package for the Budget committed £60 million to a National Cyber Shield.
• Cyber Essentials growth. The review reports 47,661 Cyber Essentials certificates and 15,646 Cyber Essentials Plus certificates awarded between September 2025 and August 2026, increases of 19.6 percent and 21.5 percent.

Government is also looking at who pays when software is insecure. We covered the Treasury’s plan to consult on liability for cyber breaches in 2027, which would shift some of the cost of poor security toward vendors. If that consultation leads to legislation, procurement teams will want evidence of a supplier’s security practices that goes beyond a certificate.

Where software fits, and where it does not

A national cyber review is mostly about patching, authentication, monitoring and architecture. Privacy software does not replace any of that. Where it helps is on the data side of the same problem: knowing what personal data you hold and where, which vendors receive it, and what you have told people about it.

Captain Compliance’s platform covers consent management, cookie and tracker scanning, privacy notices, data subject request workflows and privacy assessments, including data risk assessments for third parties. Those records are what a privacy team reaches for in the first hours of an incident, when someone asks which systems held customer data and which suppliers had access. They also matter for supplier oversight, which we discussed in our guide to managing vendor privacy risk. They do not prevent intrusions and they are not a substitute for the NCSC’s controls. A completed assessment is not proof the controls it describes are working.

The ICO has shown it will look at the basics when it investigates. Its fine against LastPass, which we analysed in the LastPass ICO £1.2M privacy fine, turned on the security of systems holding personal data. It is also worth remembering that not every reportable breach starts with a hacker. Our piece on why privacy incidents aren’t always cyber incidents covers the human disclosures that never reach a security dashboard at all.

Frequently asked questions

What period does the NCSC Annual Review 2026 cover?

It covers 1 September 2025 to 31 August 2026 and was published on 3 November 2026. It is the NCSC’s tenth annual review, marking ten years since the centre was set up in 2016 as part of GCHQ.

Did the number of serious cyber incidents in the UK fall?

The count of nationally significant incidents handled by the NCSC fell from 204 to 80, and incidents needing NCSC support fell from 429 to 337. Reports to the NCSC rose from 1,727 to 1,831. The NCSC says these figures are not a simple trend line and that a small number of severe incidents can drive a year’s totals, so the drop should not be read as lower risk.

Did the NCSC find AI-powered attacks that existing controls cannot stop?

No. The incident team saw attackers starting to use AI tools, but none of the uses it observed enabled a new class of attack. The agency’s assessment is that AI will mainly make existing techniques faster and cheaper, which raises the cost of slow patching and weak authentication.

Does a cyber incident reported to the NCSC also have to be reported to the ICO?

They are separate duties. If an incident involves a personal data breach likely to result in a risk to people’s rights and freedoms, UK GDPR requires notification to the ICO within 72 hours of becoming aware of it, whether or not the NCSC is involved. Sector regulators may have their own rules too. Legal advice on the specific facts is the safest route.

What is shadow AI and why does the NCSC care about it?

Shadow AI is the use of AI tools that the organisation has not approved, often on personal devices. The NCSC’s concern is that sensitive data moved into those tools leaves the organisation’s visibility and control, which helps attackers. For privacy teams, the same activity can be an undocumented disclosure of personal data.

Is the Cyber Security and Resilience Bill law yet?

Not as of the review’s publication. The NCSC and the Minister of State describe it as still progressing through Parliament. Its final scope and reporting deadlines should be checked against the text that is eventually passed.

The divide the review is really about

The most consequential line in the review may be the one about a widening gap between organisations that can use AI for defence and those that cannot. The NCSC expects attackers to pick on the second group because they are easier. Eighty nationally significant incidents is a smaller number than last year. The question for every organisation reading it is simple and a little uncomfortable: if the attackers are getting faster at finding the open door, which side of that gap will your systems, and your customers’ data, be on next year?