Cyber resilience in 2026: meet the baseline, then prove you can bounce back

The central message from the NCSC’s 2026 Annual Review, The State of the Cyber Nation, is clear: AI is accelerating the threat landscape, while familiar weaknesses such as technical debt, inconsistent security controls and untested recovery arrangements continue to leave organisations exposed. The response needed is not simply to add more security controls, but to establish a clear and consistent baseline for cyber resilience. The NCSC positions the Cyber Assessment Framework (CAF) as a way for organisations to understand what good looks like, strengthen resilience and, crucially, give board’s confidence that when incidents happen, the organisation can respond effectively and recover quickly.

Five key takeaways from the report stand out for technology leaders.

1. The CAF is the baseline to meet for cyber resilience for essential services and other organisations that are critical to the UK’s security and prosperity

The report puts 88% of incidents in large organisations down to four routes in: exploited public-facing applications, phishing, misused valid accounts and exploited external remote services.

So, attackers don't need clever ways in. Exposed applications, stolen credentials and weak remote access are still the heart of the problem. That’s why the Cyber Assessment Framework (CAF) matters. It provides a common framework for understanding what good cyber security and resilience look like, giving boards, technology teams and suppliers a clearer and more consistent standard to work towards.

Cyber Essentials remains an important foundation, covering controls such as firewalls, secure configuration, security updates, user access control and malware protection. But the CAF provides the broader framework for building organisational cyber resilience. Before investing in another security product, understand where you are against that baseline. Are your existing controls working consistently across the whole estate? Where are the exceptions? Who owns them, and is there a clear plan to close the gaps? (psst! Our CAF maturity assessment shows you where you are today. Our implementation work then closes the gaps, so everyone is working to the same standard.)

2. AI is shrinking the time you have to react

The report outlines that AI will almost certainly multiply the output of skilled attackers, mainly by speeding up techniques they already use. None of the AI use seen by the NCSC's incident management team created a new type of attack.

That matters. Don't assume brand new, autonomous attacks are the main threat today. The nearer problem is that familiar attacks are getting faster and easier to scale.

Defences therefore need to keep pace. Patching, vulnerability management, detection and incident response cannot depend on slow or heavily manual processes where opportunities exist to automate safely.

At the same time, adopting AI creates its own security questions. What organisational data can a model access? What systems and tools can an AI agent interact with? What actions can it take autonomously? And where does human approval remain essential?

AI governance and cyber security need to develop together, not as separate programmes.

3. Boards want to see how fast you can bounce back

Boards increasingly understand that no organisation can prevent every cyber incident. The more important question is becoming: if something significant happens, how quickly and safely can we recover?

Speed matters, but recovery is not simply about getting systems switched back on. Organisations also need confidence that they are returning to a secure and stable state, rather than restoring compromised systems, reintroducing vulnerabilities or making rushed changes that create further disruption.

The report treats this as a job for business leaders. Boards need evidence that critical services can survive disruption and recover. 

The 2025 attack on Jaguar Land Rover reports about £196 million in direct cyber related costs, plus knock on disruption to production, retail and suppliers. The lesson applies well beyond one company,  a cyber incident can quickly become an operational and commercial crisis.

So, map your critical services and supplier dependencies, test your recovery plans and agree who makes which decisions. Run exercises that ask how the business would keep going during an outage, not just how IT would restore systems.

4. Automated defence has real potential, but it needs guardrails

The NCSC is also exploring how AI can strengthen cyber defence, including through Cyber Shield and the development of more agentic capabilities that can perform actions rather than simply provide recommendations.

There is clear potential. AI-assisted tools can help organisations analyse large volumes of information, identify potential vulnerabilities and improve the speed of detection, prioritisation and response.

But finding a potential security issue is not the same as verifying, prioritising and fixing it.

For your organisation, the practical gain is using automation to sharpen detection, prioritisation and response, with people still in charge. You'll first need reliable telemetry (the data your systems log), playbooks you've rehearsed and clear authority.

Aim for faster, more dependable decisions, not autonomy for its own sake.

5. Quantum readiness belongs on today's roadmap

Post-quantum cryptography (encryption built to withstand quantum computers) may feel like tomorrow's problem, but preparing for it needs to start much sooner. The review sets firm milestones: discovery and migration planning by 2028, priority migration by 2031 and completion by 2035.

That makes finding where you use cryptography, talking to suppliers and naming an owner for migration jobs for now. Build the requirements into your technology refresh programmes and you avoid a rushed scramble later.

The bottom line

For technology leaders, the priorities are clear: understand your current position, close the gaps that matter, reduce manual bottlenecks and test your ability to recover.

As the threat landscape accelerates, confidence will increasingly come from evidence, not assurance on paper.

 Read the full NCSC report here: The state of the cyber nation 2026