Our take on the NCSC Annual Review 2026, with Scott Burman, Head of Governance, Risk and Compliance (GRC), and Steve Harrison, Cyber Operations Director
UK organisations are better at reporting cyber risk than reducing it. That is how Scott Burman, Head of GRC at SCC, reads the NCSC Annual Review 2026, published on 3 November.
“Are we getting better at managing cyber risk, or are we just getting better at reporting it?” he asks. “A risk doesn’t get reduced because you’ve captured it in a spreadsheet.”
AI speeds up old attacks
For large organisations, 88% of the incidents the NCSC handled began through four routes: exploited public-facing applications, phishing, misuse of valid accounts and exploited remote services (NCSC Annual Review 2026). None of the AI use the NCSC saw in those incidents produced a new class of attack.
Steve Harrison, Cyber Operations Director at SCC, says AI adds speed and scale to techniques security teams already know. “A phishing email used to give itself away with poor spelling and odd grammar. Now it reads like it came from a colleague. They still want someone to hand over their credentials.”
His advice: know what you’ve got, replace old and unsupported technology, patch quickly and detect attacks early. A security team with a current inventory of its websites, certificates and software components can act on a new vulnerability far faster than one that has to go looking.
Defenders’ own AI tools will lengthen the list of things to fix. “Good AI will put a floodlight on all that tech debt and legacy,” Scott says. “We’re going to see a raft of vulnerabilities and acting on them is what counts.” Steve’s rule for that list is “true risk management versus scaremongering”. Some flaws cannot be exploited and others sit in systems the organisation can run without.
What happens after the assessment
Frameworks and standards such as the NCSC’s Cyber Assessment Framework (CAF), NIST CSF and ISO 27001 give every organisation a list of its gaps. Too often the assessor hands over a report and everyone treats the job as done. Risks have been identified, gaps documented and recommendations made. The assessment is complete but that does not mean anything has changed.
Scott reads an undercurrent of frustration in the messaging of this year’s review and thinks the NCSC shares it with the organisations it writes for. “Everyone knows they need to do more. What’s missing is the how.” Telling organisations to do more isn’t the same as showing them how. And perhaps that’s where we need to challenge ourselves more as a GRC profession.
He sets out four steps that follow any assessment.
- Tie explicitly each finding to business impact. State what the weakness or finding could stop the organisation doing.
- Prioritise by what must keep running. “Resilience really comes from relating cyber strongly to the business,” Scott says. A manufacturer protects the systems that run its plants first, because back-office processes often have workarounds and production lines rarely do.
- Name the owner. Agree who is accountable for the fix and who does the work.
- Show the change. Report evidence that the risk has reduced.
Regulation adds a deadline
The Cyber Security and Resilience Bill is in its final stages in Parliament. The House of Lords passed it on 2 November and it has returned to the Commons to consider the Lords’ amendments. It brings data centres and medium and large managed service providers into regulation and gives regulators the power to designate critical suppliers. In Scott’s view, it will put more weight on resilience as a priority, with governance and assurance as enablers.
He warns against treating compliance as the goal. “Compliance is not security. And neither is assurance a guarantee of resilience. Regulation creates an obligation and compelling reason to act. The real test isn’t simply whether you have complied; it is whether your organisation is demonstrably more secure and resilient as a result.”
A test for your next risk review
Take the five highest-rated risks on your register. Ask what has changed since each was last reviewed. Check that each is still valid. Note where the register has changed and the risk has not. For each one, ask who owns it, who is driving the reduction, and what evidence shows it has reduced since the day it was logged. A risk with no owner and no evidence is always a concern.
To talk through your own cyber risk, governance and compliance challenges, contact SCC’s GRC team.