In this guide
Every few weeks there's another headline. A retailer can't take online orders. A car factory goes quiet for over a month. A council's systems go dark overnight. It's easy to tune it out, but if you look at what's actually been published in the last few weeks, the message from the people who track this for a living is pretty blunt: it's going to get busier, not calmer.
Here's what's going on, what the real risks are, and why it matters even if you've never worked in tech.
What the NCSC said this month
On 3 November 2026 the National Cyber Security Centre, the part of GCHQ that deals with cyber attacks, published its Annual Review. It covers the year from September 2025 to August 2026.
The numbers look calm at first glance. The NCSC received 1,831 reports of cyber attacks on UK organisations, stepped in to help with 337 of them, and classed 80 as nationally significant. The year before, that last figure was 204, which worked out at roughly four serious incidents a week.
So it's getting better? Not according to the NCSC. Its chief executive, Richard Horne, used the launch to warn of "a real prospect of an unprecedented rise in the number of cyber incidents" in the coming months. The review itself also cautions against reading one lower number as a trend.
The reason isn't some new super-weapon. It's that the same old weaknesses are still everywhere, and attackers are getting faster at finding them.
How attackers are actually getting in
This is the part most people find surprising. The big breaches you read about rarely start with genius hacking. According to the review, most successful attacks still came down to three things:
- Known holes that were never patched. Software companies release fixes, and organisations don't install them in time. Many of the state-linked incidents used flaws that already had a fix available.
- Stolen passwords. Leaked or reused logins are sold and traded constantly. One valid username and password can be enough.
- Tricking people. Phishing emails, fake calls to help desks, messages pretending to be the boss. It works because people are busy and trusting.
The government's own Cyber Security Breaches Survey, published in April, backs this up. Around 43% of UK businesses, about 612,000 of them, spotted a breach or attack in the previous year. For large businesses it was 69%. Phishing was the most common attack by a distance.
And those are only the attacks businesses noticed and were willing to report.
The AI problem
You've probably heard that AI is changing cyber attacks. The NCSC's view is more specific, and more useful.
AI hasn't invented new ways to break in. What it's doing is making the old ways much faster and cheaper. An attacker who used to spend days scanning for a weak spot can now find it in hours. Phishing emails that used to be full of spelling mistakes now read perfectly, in any language, tailored to you.
The review judges it almost certain that AI will act as a force multiplier for skilled attackers. It also thinks it highly likely that by 2028, AI-powered malware will have been used in a ransomware attack on UK critical national infrastructure. That means things like energy, water, transport and health.
There's a second AI risk that's quieter but just as real: staff pasting company data into unapproved AI tools on their own phones and laptops. The NCSC flags this "shadow AI" as a likely way in for both criminal gangs and state hackers. The breaches survey found that only around a quarter of UK businesses using AI have anything in place to manage the security risk.
Who is behind it
There are two groups doing most of the damage.
Criminal gangs. They want money. Ransomware locks up your systems until you pay; data theft gangs threaten to publish what they've stolen. Most of the attacks on ordinary businesses come from here.
Hostile states. In April, Horne named Russia, China and Iran as the countries behind the most serious attacks on the UK. The NCSC says state-linked attackers often target the suppliers around critical services, not just the services themselves, because the weakest link is usually easier to reach. In August, Iran-linked hackers were reported to have temporarily disrupted a UK power plant, although the government said the wider energy system was never at risk.
What a single attack can actually cost
If you want to understand why boards are suddenly paying attention, look at Jaguar Land Rover.
The attack on JLR began in late August 2025 and stopped its production lines for around five weeks. The knock-on effect hit thousands of suppliers, many of them small UK firms that rely on JLR orders to pay wages. The independent Cyber Monitoring Centre estimated the total cost to the UK economy at around £1.9 billion, making it the most economically damaging cyber incident the UK has seen.
The point isn't that these companies were careless. It's that one break-in, at one company, can travel down a supply chain and land on people who never had anything to do with it.
What the government is doing about it
A few things are moving.
The Cyber Security and Resilience Bill is making its way through Parliament. It brings more organisations under the rules, including data centres, managed IT providers and key suppliers, and tightens the rules on reporting incidents. The government has also confirmed plans to ban public bodies and operators of critical national infrastructure from paying ransoms, so that the UK stops being a profitable target.
Rules help. But rules don't patch servers, check alerts at 3am, or spot a fake invoice. People do.
The real danger: not enough people to defend
This is the part that doesn't make the headlines.
The government's skills report, published at the end of September, found that 57% of UK businesses have a basic cyber security skills gap. A year earlier it was 49%. Almost half of the people responsible for cyber security in UK businesses said they didn't feel confident dealing with a breach.
Meanwhile the UK cyber sector keeps growing. Government analysis put its revenue at £14.7 billion this year, with nearly 70,000 people working in it full time.
Put those together and you get a simple picture. Attacks are getting faster. The basics are still being missed. And there aren't enough trained people to cover the gap.
What this means if you're thinking about a career in cyber
If you've been wondering whether cyber security is worth getting into, the market is giving you a fairly clear answer.
The jobs that matter most right now aren't the glamorous ones. They're the people who watch the alerts, patch the systems, check the logins, investigate the suspicious email and write up what happened. SOC analysts, security analysts, IT support with a security focus. That's where most careers start.
The catch is the same one you've probably already hit: employers want certifications and proof you've done the work before. Certificates on their own aren't enough. You need real, hands-on experience you can talk about in an interview.
That's exactly the gap our cyber security programme is built for: industry certifications plus a guaranteed placement on a live project with a UK business, so you have real experience on your CV. If you want to see whether it fits you, book a free call and we'll talk it through.
The short version
- The NCSC is warning of a possible unprecedented rise in cyber incidents in the coming months.
- Most attacks still start with unpatched systems, stolen passwords and phishing.
- AI is making attackers faster, and staff using unapproved AI tools is a growing risk.
- Russia, China and Iran are behind the most serious state attacks; criminal gangs do most of the damage to businesses.
- One attack can cost billions and spread down a whole supply chain.
- There aren't enough trained people to defend against all of it, which is why cyber security skills are in such demand.
Frequently asked questions
Are cyber attacks in the UK getting worse in 2026?
The picture is mixed but worrying. The NCSC's Annual Review 2026 recorded 80 nationally significant incidents, down from 204 the year before, but it received more reports overall (1,831) and its chief executive warned of a real prospect of an unprecedented rise in incidents in the coming months.
How many UK businesses were hit by a cyber attack last year?
The government's Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses, roughly 612,000, identified a breach or attack in the previous 12 months. For large businesses the figure was 69%. Phishing remains the most common type of attack.
Who is behind the biggest cyber attacks on the UK?
The NCSC has named Russia, China and Iran as the states behind the most serious attacks on the UK. Criminal ransomware and data-theft gangs cause most of the day-to-day damage to businesses, often getting in through stolen passwords, phishing or systems that were never patched.
Is cyber security a good career to get into in 2026?
Demand is strong. A government report published in September 2026 found that 57% of UK businesses have a basic cyber security skills gap, up from 49% a year earlier, and the UK cyber sector now employs almost 70,000 people full time. Entry-level routes usually mean certifications plus proof of hands-on experience.
Sources
Figures are taken from the sources below. Salary ranges are indicative and individual offers vary. Last checked 9 November 2026.