NCSC State of the Nation 2026 Report

The State of the Cyber Nation 2026: protecting your mission starts with making security work

If your organisation lost access to its case-management system tomorrow, who would still receive support?

Who might be left waiting? And what would happen if confidential information was exposed as well?

For civil society leaders, those are the questions I would put ahead of the AI headlines following today’s launch of the NCSC’s Annual Review 2026, The State of the Cyber Nation.

One message from the launch particularly stayed with me: AI did not create our cybersecurity weaknesses. It revealed them.

My takeaway is that AI is accelerating the pressure to act, but our immediate task is to make security work in everyday operations. Protect accounts. Maintain technology. Understand dependencies. Rehearse how to keep delivering when systems fail.

For charities, community organisations and campaigning groups, this is about protecting the mission, the people who depend on it and the relationships that make it possible. For SMEs, it also means protecting revenue, cash flow and the ability to trade.

Start with the consequences, not the threat headlines

Before you follow the loudest instrument, make sure you know which melody you need to protect: your mission and the people who depend on it.

“We’re too small to be a target” is not a useful basis for deciding what to protect.

Neither is assuming that every charity faces a sophisticated, targeted attack.

A better starting point is:

If this service stopped, this account were taken over or this information became public, who could be harmed?

A small organisation may hold deeply sensitive case notes. A campaigning group may depend on confidential relationships. A community service may have very little room for disruption before people lose essential support.

The review describes account and messaging-app compromise affecting high-risk individuals, alongside activity involving information disclosure and transnational oppression. That does not mean every civil society organisation faces those threats. It does mean that size alone cannot tell you what is at stake.

Your priorities should follow your mission, relationships and information, not simply your headcount.

Foundations need maintenance, not just installation

You would not buy a piano and expect it to stay in tune forever; the technology supporting your mission needs ongoing care too.

At the launch, NCSC CEO Richard Horne used the Leaning Tower of Pisa to illustrate the consequences of flawed foundations.

My translation for leadership teams: buying technology is not the same as maintaining a dependable service.

The review’s incident lessons repeatedly point to familiar weaknesses, including known vulnerabilities, poorly secured internet-facing systems and compromised accounts. Its emphasis is on implementation, technology renewal and demonstrable preparedness, not simply more awareness.

That changes the conversation from “Do we have a policy?” to:

Can we demonstrate that important accounts are protected?
Who makes sure urgent security updates actually happen?
Which unsupported systems are we still relying on?
What are we monitoring, and who responds when something looks wrong?
When did we last recover something we genuinely depend on?

Cyber Essentials offers a useful technical starting point. It should support, not replace, continuity planning, safeguarding and incident rehearsal.

A patching policy without the capacity to deliver updates is an intention, not protection.

“Our IT provider handles security” needs a follow-up question

An ensemble needs to know who is playing which part; leaving a critical passage unassigned does not make it someone else’s responsibility.

The follow-up question is: “Which parts, and how do we know?”

The review highlights both supplier dependencies and the complexity organisations can face when relying on managed IT services.

I would ask providers to explain:

Which security responsibilities their service covers.
What is excluded or requires an additional purchase.
Who fixes identified gaps.
How they demonstrate that agreed protections operate.
What support we can expect during disruption.

This is not about catching suppliers out. It is about avoiding gaps between what one party assumes and the other has agreed to deliver.

Look beyond IT, too. What happens if a funder cannot process payments, a delivery partner loses its systems or a platform essential to your service becomes unavailable?

You can experience serious disruption without being the organisation that was breached.

Prepare: know your critical dependencies

Map out which suppliers are genuinely “single points of failure” – CRMs, banks, payment gateways, case management systems, email platforms. Understand what data they hold, what integrations they run, and what your options are if they go offline or get breached.

Participate: practise supplier‑led incident response

Don’t wait for the next incident to find out who does what. Run tabletop exercises based on scenarios like “Our CRM provider suffers a breach” or “Our bank portal goes down for a week”. Use these to test decision‑making, communications, and coordination with suppliers and regulators.

Probe: ask harder questions of your suppliers

Challenge assumptions about backups, retention and deletion, integration security, and incident communication. If “deleted” data is still in backups, how long is it retained, who can access it, and how is it protected? If fraud in an integration can take your portal offline, what contingency plans exist, and how are they tested?

Rehearse the organisation, not just the technology

The soundcheck might prove that the microphones work, but it cannot tell you whether everyone knows what to do when the sound cuts out mid-performance.

A successful backup is useful evidence. It is not proof that your organisation can keep delivering.

The review treats recovery as an organisational programme, extending beyond immediate containment and technical restoration.

For civil society, test a practical scenario:

Our case-management system is unavailable, email may be compromised and the supplier cannot yet give us a recovery time. What do we do first?

Bring leadership, service delivery, finance, communications, IT and relevant safeguarding colleagues into the conversation.

At Cybility, our Prepare, Participate, Probe approach provides a simple structure for that practice:

Prepare: agree the critical service, scenario, responsibilities and learning goals.
Participate: work through decisions together, without expecting perfect answers.
Probe: examine assumptions, capture gaps and assign improvements with owners and dates.

A CyberDeck8D™-supported incident response exercise can help structure that conversation. The purpose is not to catch people making mistakes. It is to discover what needs attention while there is still time to improve it.

Respond to AI with oversight, not panic buying

When the tempo increases, buying a faster metronome will not help if nobody knows who is setting the pace.

The review distinguishes between observed AI use, assessments of future capability and an illustrative autonomous-attack scenario. In the incidents discussed, observed AI use did not enable a novel class of attack. NCSC nevertheless expects AI to accelerate existing techniques and increase pressure on defenders.

My leadership response has two parts.

First, shorten the distance between warning and action. Agree who receives urgent advisories, who can authorise maintenance, which suppliers must act and how completion will be verified.

Second, give colleagues a practical, approved route to use AI. Be explicit about case notes, beneficiary information, confidential correspondence and unpublished campaigning material.

Where AI agents can take actions, go further: establish what they can access or change, where human approval is required and how their activity can be monitored and stopped.

The question is not simply “Which AI tools are we using?” It is also “What authority are we giving them?”

Resilience needs funding as well as expectations

You cannot keep asking for a concert-standard performance while leaving the musicians with broken instruments and no rehearsal time.

There is a message here for funders, commissioners and sector bodies.

NCSC anticipates uneven access to AI’s defensive benefits, particularly for organisations with limited resources or legacy technology.

My conclusion: asking organisations for more assurance is not enough. Support needs to include implementation time, technology replacement and access to expertise.

Free resources can help. The review identifies the Cyber Action Toolkit, Cyber Essentials Readiness Tool, a free 30-minute Cyber Advisor consultation and Early Warning as starting points.

But guidance needs an owner. An alert needs a response. An exercise needs follow-through.

For organisations already stretched between immediate need and long-term sustainability, resilience cannot remain an unfunded expectation.

Civil society leaders: put your mission’s resilience on the next agenda

Do not wait for an incident to become your leadership team’s first rehearsal.

Don’t let this report become another document circulated for information. Use it to start a decision.

At your next leadership or trustee meeting, ask:

If our essential systems were unavailable tomorrow, how would we keep supporting people, protect confidential relationships and make the decisions that cannot wait?

Then agree three commitments: a named executive owner, a date for a leadership incident exercise and a prioritised plan to address what it reveals.

You do not need every answer before you begin. You do need someone accountable for moving beyond the questions.

If you lead a charity, community organisation or campaigning group, message me on LinkedIn or use the ‘get in touch’ button bottom-right. Let’s turn “we should practise this” into a leadership rehearsal built around your mission, your people and the decisions you would actually face.

Prepare. Participate. Probe. Find the gaps in rehearsal, then act on them before the real performance.

Reference source:

National Cyber Security Centre (2026) NCSC Annual Review 2026
Available at: https://www.ncsc.gov.uk/collection/annual-review-2026
(Accessed: 3 November 2026).