Each autumn the UK’s National Cyber Security Centre publishes its annual review, and each year one number draws most of the attention. This year it is 80: the incidents the NCSC classed as nationally significant between September 2025 and August 2026. The year before, the figure was 204.
It would be easy to read that as progress. The NCSC asks readers not to. Its incident management chapter says that incident reporting “does not follow a simple year-on-year trend”, and the count depends on what gets reported, how incidents are triaged and how complex each response turns out to be. A fall of that size might mean fewer serious attacks. It might also reflect changes in who reported what, and when. The review does not say which, and anyone quoting it should be just as careful.
The more durable part of the review is quieter. After working through the incidents that needed its support, the NCSC set out seven things it learned. The first is that attackers exploit the basics, with internet-facing assets still a primary route to compromise. The last is that initial access does not have to be sophisticated. Taken together, those two lessons describe something every IT team will recognise: the way in is usually a weakness the organisation already knew it should fix.
The same picture from the EU
ENISA, the EU’s cyber security agency, published its Threat Landscape 2026 in September. It analyses 8,257 incidents recorded across the EU in 2025. It is a different dataset, counted a different way, so its figures should not be added to the NCSC’s or compared with them line by line. Even so, it points in the same direction.
Where ENISA could identify how an attacker gained unauthorised access, 60% of cases involved exploiting a vulnerability. Social engineering, mostly phishing, remained a common way to abuse trust. And 73% of the events it recorded affected organisations that NIS2 classes as essential or important entities. NIS2 is the EU directive now applied through national law in Germany, Austria, the Netherlands, Belgium and Luxembourg, among others.
That last figure matters. The organisations now carrying the heaviest legal duties for cyber security are the ones attackers reach most often. NIS2 recognised an exposure that already existed.
Switzerland sits outside ENISA’s scope and outside NIS2. Since April 2025 its critical infrastructure operators have had to report cyberattacks to the Federal Office for Cybersecurity, known by its German initials BACS, within 24 hours. Over time that will give Switzerland a picture of its own.
Why the basics keep slipping
None of the seven lessons will surprise anyone who has read earlier reviews. Known vulnerabilities on internet-facing systems, stolen credentials, phishing and weak remote access have been on lists like this for a long time. The more useful question is why organisations that know the basics still leave them undone.
My view, from years on the buying side of technology decisions, is that the basics slip where nobody owns them in a way that survives a busy month. Patching an internet-facing system within days needs someone who knows the asset exists, has the access to change it and has the authority to schedule the downtime. Enforcing multi-factor authentication on remote access needs someone willing to handle the complaints from senior people who find it inconvenient. Testing a restore needs someone with an afternoon nobody else has claimed.
Those are questions of skills and ownership as much as technology. In the UK, the government’s cyber skills survey published in September found that 57% of businesses had a basic technical skills gap, and it defines basic technical skills largely by the areas Cyber Essentials covers. I have not found an equivalent measure for the EU markets that uses the same definition, so I would not carry that figure across to them.
Two fair objections
The first is that “do the basics” can sound like advice from someone who has never faced a capable attacker. The NCSC’s seventh lesson answers it. Initial access does not have to be sophisticated, and in the NCSC’s words, “onward activity by the actor is where sophistication becomes evident”. The basics take away the cheap way in. A determined state actor may still get through, but it has to spend more, make more noise and give defenders more chances to notice.
The second is that a single list ignores context. A hospital, a software supplier and a municipal authority face different threats. ENISA found public administration to be the most targeted sector, at 32% of recorded cases, with much of that activity ideology-driven denial of service. That is a fair point about priorities. It does not change the starting point, because each of those organisations still runs internet-facing systems, still has staff who receive phishing emails and still needs a backup it can restore.
Early action
The sixth lesson deserves a paragraph of its own. The NCSC says early action reduces impact, and points to its Early Warning service, which notified 8,500 organisations of events indicating a suspected compromise during the year. Early Warning is free for any organisation based in the UK. Registration needs a MyNCSC account, the organisation’s public IP addresses and domain names, and a named contact, and the NCSC puts it at about five minutes. The NCSC is clear that the service does not scan your network and should sit alongside your existing controls.
Organisations in Germany, Austria, Switzerland, the Netherlands, Belgium and Luxembourg should check what their national cyber security authority or CSIRT offers them, because the arrangements differ by country and by sector.
Seven checks
For each lesson I would ask one question and give it a named owner.
- Attackers exploit the basics: can someone produce a current list of every internet-facing system, with the date each was last patched?
- People remain the target: is multi-factor authentication on every account that offers it, and is there a reporting route for suspicious messages that someone monitors?
- State and criminal actors share weaknesses: when did someone last remove unused accounts and default credentials?
- Ransomware remains highly disruptive: when was a backup last restored as a test, and how long did the restore take?
- Preparation determines outcomes: does the incident plan name people, and when was it last exercised?
- Early action reduces impact: is the organisation registered with its national alerting service, and does a monitored mailbox receive the alerts?
- Initial access does not have to be sophisticated: is every remote access route behind multi-factor authentication, with no administration interface exposed to the internet?
These questions are mine, not the NCSC’s or ENISA’s, and they are deliberately plain. If the honest answer to any of them is “I’d need to check”, that is the finding.
The headline numbers in next year’s review will move again, up or down, for reasons the NCSC will once more ask readers to treat with care. The lessons are far less likely to change, and that is the case for spending this month’s effort on them.
Sources, checked on 4 November 2026:
- National Cyber Security Centre, Annual Review 2026, published 3 November 2026: incident management chapter (1,831 reports, 80 nationally significant incidents, 8,500 Early Warning notifications, reporting period 1 September 2025 to 31 August 2026, the year-on-year caveat) and “7 things we learned”. https://www.ncsc.gov.uk/collection/annual-review-2026
- National Cyber Security Centre, Annual Review 2025 (204 nationally significant incidents, 48% of 429 incidents). https://www.ncsc.gov.uk/files/ncsc-annual-review-2025.pdf
- ENISA, Threat Landscape 2026, September 2026, covering 1 January to 31 December 2025 (8,257 incidents; 60.4% vulnerability exploitation where the intrusion vector of unauthorised access was identified; 73% of recorded events affecting essential and important entities; public administration 31.8%). https://www.enisa.europa.eu/topics/cyber-threats/threat-landscape
- NCSC, Early Warning. https://www.ncsc.gov.uk/section/active-cyber-defence/early-warning
- DSIT, Cyber Security Skills in the UK Labour Market 2026, 29 September 2026. https://www.gov.uk/government/publications/cyber-security-skills-in-the-uk-labour-market-2026
- Swiss Federal Council, reporting obligation for cyberattacks on critical infrastructure from 1 April 2025; BACS reporting guidance. https://www.bacs.admin.ch/en/faq-reporting-obligation