The National Cyber Security Centre's latest annual review carried a stark warning: attackers are now using AI to find and exploit weaknesses faster and at greater scale than ever before.
But it also carried a reassuring message for small businesses. AI isn't inventing new kinds of weaknesses. It's making old ones, such as unpatched systems, weak passwords and convincing scam messages, much easier to find. Get the basics right, and you're far harder to hit.
This article covers what the NCSC found, what it means for your business, the growing risk of “shadow AI”, and five practical steps to take now.
If you'd like to know how well your business covers the basics, Reflective IT's team can help.
TL;DR
- The NCSC handled 1,831 cyber attack reports this year, 80 of them nationally significant.
- Attackers are using AI to find and exploit weaknesses faster, and the NCSC expects AI-powered ransomware to hit UK critical infrastructure by 2028.
- Most successful attacks still exploit the basics: known vulnerabilities, weak credentials and social engineering.
- “Shadow AI”, staff using AI tools the business hasn’t approved, is a growing risk to company and client data.
- Cyber Essentials certifications are up almost 20%, and certification is now available from £80 with 75% government funding.
The State of the Cyber Nation
On 3rd November, the NCSC - part of GCHQ - published its annual review, The State of the Cyber Nation, marking ten years since it was set up. It lands in a busy few weeks for cyber security: attackers have remotely switched off supermarket fridges and freezers across Europe, and reports now suggest UK supermarkets were affected too.
The review’s central message is simple. AI isn’t inventing new kinds of weaknesses - it’s making old ones much easier and quicker to find.
“AI did not create these cyber security weaknesses; it revealed them.”
- NCSC, The State of the Cyber Nation 2026
What the NCSC Found
- 1,831 cyber attack reports were handled by the NCSC’s incident team this year, with 80 nationally significant.
- Attackers are using AI to find and exploit weaknesses faster. The NCSC expects AI-powered malware to be used in a ransomware attack on UK critical national infrastructure, and nation states to use AI in their cyber operations, by 2028.
- Most successful attacks still exploit the basics: known vulnerabilities, weak credentials and social engineering.
- A widening gap is opening up between organisations using AI to strengthen their defences and those with weak security.
- Connected devices are a growing target - the NCSC’s chief executive pointed to the disruption of refrigeration units across Europe as an example.
- Cyber Essentials certifications are up almost 20% on last year, as more businesses get the fundamentals in place.
“Vulnerabilities that have been tolerated for far too long can now be discovered and exploited.”
- Richard Horne, NCSC Chief Executive
What It Means for Your Business
You don’t need to be a power station to be caught up in this. AI makes it cheap for attackers to scan thousands of businesses at once, looking for an unpatched firewall, a forgotten account or a reused password. Small businesses are often the easiest wins.
The good news is that the defences haven’t changed. In the NCSC’s words, the basics “are the foundations of a resilient business” in an AI-enabled world.
Watch Out for “Shadow AI”
The review also highlights shadow AI: staff using AI tools the business hasn’t approved. It usually starts with good intentions - someone pastes a client email, a contract or a spreadsheet into a free chatbot to save time. But that data may then be stored or used outside your control.
- Agree which AI tools are approved, such as Microsoft 365 Copilot, which works within your Microsoft 365 security and data protections.
- Write a short AI policy setting out what can and can’t be shared with AI tools.
- Talk to your team - most people would happily use an approved tool if they knew there was one.
5 Things to Do Now
- Keep everything updated - apply security updates quickly and replace anything that no longer receives them.
- Turn on MFA everywhere, and consider passkeys, which the NCSC is encouraging as a safer replacement for passwords.
- Know what’s connected - laptops, phones, cloud apps, and also CCTV, door entry, printers and other smart devices.
- Get the basics certified with Cyber Essentials, now from £80 with 75% government funding.
- Agree your approved AI tools, so your team doesn’t turn to shadow AI.
Reflective IT tip: Not sure where you stand? Ask your Technical Account Manager to review your Microsoft Secure Score and patching status at your next account review - it’s a quick way to see how well the basics are covered.
Sources: NCSC Annual Review 2026, Richard Horne’s speech at the NCSC Annual Review 2026 launch, techUK: NCSC Annual Review - The State of the Cyber Nation.
Not sure how well your business covers the basics? Reflective IT offers a no-obligation security health check. We’ll review your patching, MFA, connected devices and use of AI tools, and advise on the quickest wins.
Speak to the Reflective IT team about a security health check, or call us on 020 7317 4535.
