What the NCSC’s 2026 review means for your business

The NCSC’s latest annual review is a reminder of how much still comes down to getting the fundamentals right. In incidents it handled, attackers continued to exploit known weaknesses, including software where security updates were available but had not been applied quickly enough.

One example that stood out was the 2025 attack on Jaguar Land Rover. The disruption spread to suppliers that depended on its production schedules, orders and payment processes. For those businesses, an incident at a major customer became a problem for their own operations.

That is worth thinking about in your own business. What would have the greatest impact if a service you depend on became unavailable?

Start with one service and work through a few questions with the people who look after it.

• Who is responsible for keeping it secure, including updates and access?
• Which suppliers or other businesses does it depend on, and what happens if they cannot deliver?
• How would you keep working while it was unavailable, and have you checked that those arrangements work?

Agree what needs to be done, who will do it and when you will check progress. If you use an IT provider, make sure you both understand who is doing what.

The report also asks leaders to look for evidence that their organisation is better prepared and can recover from disruption. That gives you something useful to check as the work progresses.

At Kurosec, I help businesses understand what needs improving, agree practical priorities and keep the work moving. If you need help working out where to start, we can talk through your situation.