The head of the National Cyber Security Centre has warned that the UK faces a real prospect of an unprecedented rise in cyber incidents in the coming months. His warning came on the same day his agency reported a sharp fall in the most serious attacks.
Richard Horne was speaking at today’s launch of the NCSC’s 2026 annual review. He said the problem was not that AI had invented new ways to attack organisations. It was that weaknesses tolerated for years can now be found and exploited at a scale nobody previously thought possible.
“For decades, we have collectively got away with doing tech on the cheap,” he said.
The numbers in the review tell a more mixed story. Between September 2025 and August 2026, the NCSC received 1,831 reports of attacks on UK organisations, up from 1,727 a year earlier. It gave hands-on support in 337 cases, down from 429, and classed 80 as nationally significant. A year ago that figure was 204, or about four a week. This year it is closer to one and a half.
The NCSC does not treat the fall as a trend - the review says incident numbers rarely move in a straight line and that past peaks were often caused by a handful of severe events. Its verdict on the country’s defences does not make cheery reading: “The UK’s cyber resilience is not yet where it should be.”
That message is arriving as cyber rates have been falling for nearly three years. A lower count of major incidents is an easy number to bring to a renewal meeting. Horne’s speech and the review behind it suggest the underlying risk is moving the other way.
Horne said leaders who keep putting off investment, may end up explaining to investors, staff, customers and suppliers why food is not on the shelves, the lights are off and businesses have collapsed.
He also urged organisations to stop connecting technology to the internet when it doesn’t need to be. And he called on them to treat Cyber Essentials as the starting point for their security, building further protection according to their size, complexity and risk.
The NCSC judges it highly likely that by 2028, China, Russia and other states will routinely use AI in cyber operations against the UK. It also judges it highly likely that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure within the same period.
Read next: Inside the cyber gap: Why major UK firms are still underinsured and unprepared
For now, attackers are mostly getting in the way they always have. Among large organisations, 88% of the incidents the NCSC handled began in one of four ways: exploiting a public-facing application, phishing, misusing a legitimate account or exploiting remote access services. The incident team has seen AI tools in use, but none of them enabled a new type of attack.
The biggest concern is how fast this could happen. The NCSC expects AI models to uncover large numbers of previously unknown flaws in widely used software. It has told organisations to prepare for a “vulnerability patch wave”: a rush of urgent updates across the technology they rely on.
A burst of exploitable flaws in common software could hit many policyholders at once, which makes it an aggregation problem as well as a frequency one.
The review also flags “shadow AI”, where staff put company data into unapproved AI tools, often on personal devices. Questions about it are likely to start appearing on proposal forms.
The review calls China the most sophisticated and sustained cyber threat the UK faces, and Russia the most audacious. It points to a December 2025 attack on Poland’s energy grid, which the UK and EU attributed to a unit of Russia’s FSB. Had it succeeded, around 500,000 people could have lost power.
For insurers, this keeps state-backed attacks and the wording of war and state-actor exclusions firmly on the agenda. The more cyber operations become part of ordinary geopolitical pressure, the harder it gets to draw a clean line between a criminal loss and a state-sponsored one.
The NCSC uses the 2025 attack on Jaguar Land Rover as its main example of economic harm. JLR reported about £196m in direct costs. The review links the incident to UK growth of just 0.1% in the third quarter of 2025, below forecasts.
Insurance gets no mention. But JLR had not completed its Lockton-brokered cyber placement when the attack hit. The review’s account of suppliers losing orders and payments while production stopped describes the contingent business interruption risk that insurers have since begun to cover.
The review also repeats a government estimate that cyber attacks cost UK organisations about £14.7bn a year. That is roughly the size of the UK’s entire cyber security sector.
Read next: Did Jaguar Land Rover’s cyber insurance gap help pave the way to 4,000 job losses?
Take-up of basic controls is still rising. In the 12 months to August, 47,661 Cyber Essentials certificates were awarded, up 19.6%. Cyber Essentials Plus certificates rose 21.5% to 15,646. The NCSC’s free Early Warning service, which alerts organisations to suspicious activity on their networks, now has 19,922 organisations signed up, a 52% increase.
The government says certified organisations are 92% less likely to make a claim on their cyber insurance. The figure is based on data from the insurer that provides the free cover bundled with certification.
The harder job is reaching everyone else. Government survey data found that 47% of UK businesses have cyber cover in any form, and standalone policies are far less common. The NCSC warns of a widening gap between organisations that can afford modern, AI-assisted defences and those stuck with old systems. For insurers, that means two quite different groups of risks sitting under the same product line.
Read next: Brit cyber cover now available through Acturis package placements
Horne’s speech gives brokers a ready-made line for client meetings: Cyber Essentials is where security starts, not where it ends. For eligible UK firms with turnover under £20m, whole-organisation certification also lets them opt into included cyber insurance. That can open a conversation about whether the cover is anywhere near enough.
Early Warning is free and is an easy recommendation at renewal. The NCSC’s new guidance on recovering from a highly disruptive cyber attack, written with boards in mind, is worth putting in front of any client who treats their policy as their recovery plan.
According to the NCSC, the Chancellor announced new funding last week for AI-driven cyber defence:
Security minister Dan Jarvis also points to the Cyber Security and Resilience Bill, which is still going through Parliament. It would bring managed service providers and other sectors into regulation and give ministers new powers during national security crises. The Association of British Insurers has backed the bill, citing nearly £200m in cyber claims paid in a single year.
Read next: ABI backs UK Cyber Security Bill as insurers brace for rising demand
The NCSC’s figures show a quieter year for the most serious attacks. Its chief executive is warning that the next one is unlikely to stay that way.
