The NCSC handled 1,831 incident reports this year. Here is what that means if you have three engineers

The figures, without the adjectives

Between 1 September 2025 and 31 August 2026, the NCSC's incident management team received 1,831 reports of cyber attacks on UK organisations. After triage, 337 of those needed hands-on support from the team. Eighty were classed as nationally significant. Separately, the Early Warning service notified 8,500 organisations of events that pointed to a suspected compromise. The review puts the cost of malicious cyber activity to UK organisations at an estimated 14.7 billion pounds a year.

The review is careful to say that incident reporting does not follow a simple year-on-year trend, so we will not draw one. The sentence that matters is this: the cyber threat to the UK remains significant, with most successful attacks still exploiting familiar weaknesses. It names three. Known vulnerabilities in internet-facing systems. Stolen credentials. Social engineering.

Looking forward, the NCSC says that by 2028 it is highly likely China, Russia and other nation states will routinely use AI in cyber operations, and that AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure. The attackers are getting faster. The ways in have not changed.

Three familiar weaknesses, three decisions nobody made

None of the three is exotic, and in a small engineering team none of them is the result of a bad decision. They are what happens when a reasonable decision is never revisited.

The server that fell off the list

Nobody decides not to patch. What happens is that a service gets built, goes live, and then the person who built it moves on to the next thing. The patch cadence that existed for the main platform never reached the box running the internal tool, the old marketing site or the data science account. It is internet-facing because it had to be at the time. A year later it is the known vulnerability the review is talking about, and it is the first place an automated scanner looks.

The key that is too frightening to rotate

Stolen credentials are rarely stolen from a vault. They are copied from a laptop, a CI log, an environment variable or a shared document, and they keep working because nobody knows what would break if they were rotated. Across the environments we assess, multi-factor authentication not being enforced on the cloud account is one of the most consistent findings, alongside API keys with no recent usage that nobody has retired. The credential does not need to be cracked. It only needs to still be valid.

The person who approves things at 11pm

Social engineering works on small teams because the same person is the developer, the on-call engineer, the one who approves access requests and the one who answers the supplier's email. There is no second pair of eyes because there is no second pair. The control is not training. It is a process that puts a pause between the request and the approval, and a channel that still works when the main one is compromised.

The arithmetic of who is awake

A year has 8,760 hours. One engineer working a standard UK year covers about 1,740 of them, which is roughly 20 per cent of the calendar. Three engineers, sharing an informal rota and also building the product, do not get to 100. They get to tired. The attack described in the review does not arrive during the 20 per cent. The NCSC's Early Warning service exists precisely because most organisations find out from someone else, and 8,500 of them did this year.

This is why "we have a SIEM" is not the same as "we have detection and response". In the estates we review, security detection rules routed to no owner is one of the most consistent findings. The rule fires. It goes to a channel. The channel is read on Monday. The control was on paper.

What to do, in the order that matters

1. Enrol in Early Warning. It is free to UK organisations and it means someone outside your team tells you when your addresses appear in threat feeds. It takes an afternoon.
2. Find everything internet-facing that is not on a patch schedule. Not the main platform, you already patch that. The other things. Put them on the schedule or take them off the internet.
3. Enforce multi-factor authentication on every cloud and code account, and retire every API key that has not been used in 90 days. If a rotation is frightening, that is the finding, and it goes to the top of the backlog.
4. Route every security detection to a named human with a runbook, and decide what that human is allowed to do without asking. A detection with no owner is a log.
5. Write down who declares an incident and on which channel, including the channel you use when the first one is down. Then test it once.

Where we fit

Critical Cloud keeps mission-critical software running, and for a small team that includes being the people who are awake. Critical Response gives you a UK engineering team that answers security and reliability incidents in the hours you choose, including 24x7, with Datadog Cloud SIEM detections routed to a named person rather than a channel. Critical Support adds the proactive half: the patch coverage, the access reviews, the alert tuning that stops the detection that matters drowning in the hundred that do not. We operate the stack. You own the product.

We are not a security consultancy and we will not tell you that you are compliant. We operate and evidence the runtime controls that support your obligations, and when the question comes, the evidence is there.

Sources

• NCSC, Annual Review 2026: incident management, published 3 November 2026.
• NCSC, Annual Review 2026: the cyber threat to the UK, published 3 November 2026.
• NCSC, Early Warning service.
• Coverage arithmetic: 8,760 hours in a year; one engineer at 37.5 hours over 46.4 working weeks covers about 1,740 hours. Our working, set out in the cost of running your own 24x7 rota.