What does the NCSC Annual Review 2026 mean for MSPs?

In his foreword, Horne says the UK's cyber resilience "is not yet where it should be" and that the threat "has increased faster than our defensive capabilities". On AI, he writes that it "did not create these cyber security weaknesses; it revealed them".

• Incident volumes: the NCSC Incident Management team received 1,831 reports of cyber attacks. After triage, 337 incidents required its support, of which 80 were nationally significant. Through the Early Warning service, it notified 8,500 organisations of events that suggested a compromise. The NCSC stresses that incident reporting does not follow a simple year-on-year trend, so these figures should not be read as a rise or fall on their own.
• Familiar routes in: threat actors routinely exploited known vulnerabilities in internet-facing systems, used stolen credentials and relied on social engineering. Many incidents involved vulnerabilities for which patches were available but had not been deployed quickly enough.
• AI as an accelerator: the NCSC judges that AI will speed up and scale existing attack techniques rather than create new ones. Its incident team saw attackers start to use AI tools, but none of the uses it observed enabled a novel class of attack.
• Weak foundations: Horne listed the causes: end-of-life systems kept running "for just one more year", upgrades pushed back, access "granted where it was convenient rather than where it was necessary", services bought on price alone, and a failure to put monitoring in place.
• Vulnerability volume: Horne said the Linux Kernel Project alone patched more than a thousand vulnerabilities last month, and that the NCSC issued over 110,000 proactive notifications and Early Warning alerts to UK organisations in response to the PHP vulnerability.
• Supply chains: the review notes that organisations increasingly rely on suppliers and service providers, and that weaknesses in a supply chain can expose them to risks beyond their control.

• Cyber Shield: a programme jointly delivered by the NCSC and DCMS to build a national-scale agentic cyber defence ecosystem over the next five years, starting with detection and blocking.
• Cyber Security and Resilience Bill: described in the review as the biggest update to UK cyber regulation in years. It is still going through Parliament. Government factsheets say it is expected to bring medium and large managed service providers into the scope of the NIS Regulations, with duties to manage risk and report significant incidents.
• National Cyber Action Plan: due to be announced soon, according to the speech.
• Post-quantum cryptography: the NCSC recommends completing discovery and migration planning by 2028, priority migration by 2031 and full migration by 2035.

The review also changes the conversation with clients. Boards now have a government report saying that the tools and standards to defend themselves already exist and that the challenge is putting them in place at scale. Clients will expect their provider to show that the basics are done, with evidence. If the Bill passes in its current form, medium and large MSPs should also expect regulatory duties of their own, and their clients may ask how they meet them.