Insights & Analysis · 3 November 2026
The State of the Cyber Nation 2026: Why the Real Challenge Is Executive Leadership, Not Technology
By Dr John McCarthy, PhD, ChCSP
Chartered Cyber Security Professional | Cyber Strategy Translator | Oxford Systems
The National Cyber Security Centre's 2026 Annual Review, The State of the Cyber Nation, provides an important assessment of the United Kingdom's cyber security position. As the NCSC marks its first decade, the report describes a country facing increasingly capable adversaries, rapid developments in artificial intelligence and growing dependence on interconnected digital infrastructure. It acknowledges that, despite progress, the UK's overall resilience remains below the level required.
Having examined the report, I believe its most significant message concerns something more fundamental than the sophistication of cyber attacks. It concerns the persistent difficulty organisations experience in converting an understanding of cyber risk into effective business decisions, sustained investment and demonstrable resilience. We have developed technical standards, frameworks and professional expertise, yet organisations still experience disruption through weaknesses that are already understood and frequently preventable.
The persistence of familiar weaknesses
The NCSC reports that 88% of incidents affecting large organisations originated through four established routes: exploitation of public-facing applications, phishing, misuse of valid accounts and exploitation of external remote services. During the reporting period it received 1,831 reports, supported 337 incidents and classified 80 as nationally significant. These figures demonstrate that well-understood weaknesses remain consequential despite years of investment in cyber security.
The governance question is not simply whether technical teams can identify vulnerabilities. It is whether executives understand which business activities are exposed, why remediation has been delayed and what decisions are necessary to reduce the risk. A technical finding without an accountable decision can leave an organisation exposed indefinitely.
AI is accelerating an existing problem
Artificial intelligence is improving the speed and scale of reconnaissance, vulnerability discovery, social engineering and exploit development. The NCSC is careful to distinguish AI-assisted attacks already being observed from possible future autonomous operations. For now, the most immediate concern is the acceleration of familiar methods rather than the wholesale replacement of them.
Organisations must therefore reconsider whether their vulnerability management, investment approvals and operational change processes can keep pace. The review also warns of a widening gap between organisations able to adopt AI-enabled defence and those constrained by ageing infrastructure, limited resources and technical debt.
Cyber security is an economic security issue
The review cites government research estimating the annual cost of malicious cyber activity to UK organisations at £14.7 billion. The 2025 attack on Jaguar Land Rover illustrates how the consequences extend beyond the organisation initially affected. JLR reported approximately £196 million in direct cyber-related costs, while disruption affected production, retail activity, suppliers and the wider economy.
For critical national infrastructure, such interdependence makes business consequence analysis essential. Airports, energy providers, hospitals and transport networks depend on combinations of technology and external services. Boards must understand not only which systems could fail, but how failure would affect continuity, contractual obligations, customers and public safety.
From technical reporting to executive decisions
The review argues that the challenge is no longer merely identifying risks but acting on them. Security dashboards, penetration tests and risk registers can contain accurate technical findings without explaining the strategic consequences or the decisions required. Information is necessary, but information alone is not governance.
This is the concern addressed by my Cyber Strategy Translation Framework. Its five layers are Strategic Outcomes and Risk Appetite, Business Exposure Mapping, Business Consequence Translation, Capability and Response Options, and Executive Decision Pathway. The framework connects technical evidence to organisational exposure, meaningful choices and accountable action without replacing established security standards.
Compliance is not the same as resilience
Cyber Essentials, secure configuration, access control, security updates and malware protection remain important because attackers continue to exploit preventable weaknesses. The NCSC's development of the Cyber Assessment Framework and its Core Profile reflects increasing attention to outcomes rather than documentation alone.
A certificate or policy does not establish that critical services can withstand and recover from disruption. Boards need evidence from exercises, recovery testing, independent assurance and the management of dependencies. A compliant organisation is not necessarily a resilient organisation.
The future of AI-assisted cyber defence
The National Detect Strategy, Cyber Shield and Project DROMOS illustrate a shift towards continuous, coordinated and machine-assisted defence. DROMOS used frontier AI models to examine government code and identified hundreds of potential security issues in selected environments, including critical vulnerabilities, while retaining expert review and procedures for handling false positives.
Autonomous defensive action creates new governance questions. Who may authorise changes to production systems? What safeguards prevent a remediation from interrupting an essential service? How is responsibility assigned when a machine executes the action? These questions concern organisational authority and risk appetite as much as technical engineering.
Supply chains and critical infrastructure
An organisation may have strong internal controls yet depend upon a vulnerable supplier for a critical service. This is particularly relevant in aviation, where airports depend on airlines, ground handlers, telecommunications providers, specialist contractors and interconnected operational systems.
Supplier assurance, including Cyber Essentials certification, is useful but insufficient on its own. Leaders need to identify critical third-party dependencies, assess the consequences of their failure and test alternatives and recovery arrangements. The strategic question is whether the organisation can continue operating when a supplier cannot.
Preparing for post-quantum cryptography
The NCSC recommends completing discovery and migration planning by 2028, priority migration by 2031 and migration to post-quantum cryptography by 2035. For organisations with complex legacy environments, this is a substantial technology and supplier-management challenge.
Cryptographic dependencies may be embedded across applications, infrastructure, connected devices and external services. Boards should establish ownership and integrate the transition into procurement, investment and technology refresh programmes before deadlines make change more expensive and disruptive.
What boards should do now
Boards should ask whether they understand their most significant business exposures, whether known weaknesses are being addressed at an acceptable pace, whether recovery capabilities have been demonstrated and whether AI and supplier dependencies are governed appropriately.
Executive reporting should present clear business consequences, credible response options, investment implications and accountable owners. Where material exposure is accepted, the decision should be explicit and reviewed. Where action is approved, its effectiveness should be verified.
Conclusion: resilience is an executive outcome
The NCSC's 2026 review describes an increasingly demanding environment shaped by geopolitical competition, AI and interconnected digital services. Yet many successful attacks still exploit familiar weaknesses. Technical innovation and stronger national coordination offer opportunities, but they cannot substitute for investment, governance and effective execution.
The next decade will reward organisations that connect cyber security intelligence with business strategy and make decisions quickly enough to reduce material exposure. Cyber resilience is not simply a technical condition. It is the outcome of informed strategic decisions, effective governance and accountable executive action.
About the author
Dr John McCarthy, PhD, ChCSP, is a Chartered Cyber Security Professional and CEO of Oxford Systems. His work focuses on cyber strategy translation, executive governance and connecting technical cyber risk with business consequences and strategic decisions.
Independent commentary based on the NCSC Annual Review 2026. Not affiliated with or endorsed by the NCSC.