NCSC: four routes behind 88% of large-firm incidents it handled
The NCSC's 2026 Annual Review says 80 of the 337 incidents its team supported were nationally significant, and forecasts AI-powered ransomware against UK critical infrastructure by 2028.
For large organisations, 88% of the incidents handled by the National Cyber Security Centre came through four initial access routes, the NCSC said in its Annual Review, published on 3 November. The four routes are exploiting public-facing applications, phishing, misuse of valid accounts and exploiting external remote services. They line up closely with the patching, MFA and remote-access questions on cyber proposal forms.
The NCSC said its incident management team received 1,831 reports of cyber attacks during the year. Of these, 337 incidents needed its support and 80 were classed as nationally significant. Its Early Warning service notified 8,500 organisations of a suspected compromise. The NCSC cautioned that incident reporting "does not follow a simple year-on-year trend".
Looking ahead, the NCSC assessed that it is "highly likely" that by 2028 AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure. This is a forecast, not a reported incident.
Related coverage: Government funds 75% off Cyber Essentials for SMEs; Insurers warn fridge hack spoilage may fall outside cover.
Sources
CoverWire is a news and information service. Nothing here is investment advice.
Free briefing
The CoverWire briefing
Get the day's UK insurance news by email at 08:30 every weekday. It's free, and you can unsubscribe at any time.