The NCSC's annual review, published on 3 November, has a line that will be quoted for months. Its chief executive, Dr Richard Horne, says the UK has for decades "got away with doing tech on the cheap". The numbers behind it are plain enough, and they say more about the organisations we work with than about critical national infrastructure.
What the numbers say
Over the year to 31 August 2026, the NCSC received 1,831 reports of cyber attacks. Its incident management team supported 337 incidents, and 80 needed a nationally significant response. Its early warning service notified around 8,500 organisations of suspected compromises. Government research puts the cost of malicious cyber activity to UK organisations at about £14.7 billion a year.
The forecast is the part that made the headlines. The NCSC judges it "highly likely" that AI-powered malware will be used in a ransomware attack on UK critical national infrastructure by 2028, and that hostile actors' use of AI will increase the scale and efficiency of ransomware, social engineering and vulnerability exploitation within two years.
The important line isn't about AI
Read past the 2028 forecast and the NCSC's point is more uncomfortable. It says the threat is not new attack methods. It's that weaknesses organisations have tolerated for years can now be found and exploited at far greater scale.
That matches what we see. The incidents we investigate rarely start with anything clever. They start with an edge device patched months late, a service account nobody owns, an app secret that never expires, or an alert that fired at 3am and was looked at on Monday. AI doesn't create those gaps. It shortens the time between a gap existing and someone using it.
Microsoft's own data, which we covered earlier this week, makes the same point from the other side: exploitation of this year's known-exploited flaws typically starts within days, while network appliances can take more than a year to patch.
What "tech on the cheap" looks like in the mid-market
For a mid-sized organisation running Microsoft 365 and Azure, "on the cheap" rarely means no security tools. Most of our customers already hold licences for capable products. It usually means some combination of:
- Tools switched on but not tuned. Default analytics rules, alerts nobody has baselined, and connectors that were never finished.
- Nobody watching out of hours. An internal team of two or three people can't cover nights, weekends and holidays, and attackers know when the office is empty.
- Logs that would answer the question, if they were collected. Service principal sign-ins, Graph activity and audit logs are often missing until the day an investigation needs them.
- Identity that grew without an owner. Old apps with broad permissions, partner access that was never reviewed, accounts for people and systems long gone. We wrote about dormant accounts and abandoned tenants for the same reason.
- Internet-facing kit that is someone else's problem. VPNs, firewalls and remote access tools that sit outside the normal patch cycle.
None of these is exotic, and none is fixed by a new product. They need time, attention and someone accountable for them.
Where to put the money
The NCSC asks organisations to invest urgently, to avoid putting technology on the internet unnecessarily, and to build resilience in proportion to their size, complexity and risk. For a mid-market security budget, we'd translate that into four priorities:
- Know what faces the internet and who patches it. Keep a short register of every edge device and exposed service, with an owner and a patch target measured in days.
- Get the right logs into one place. Identity, endpoint, email and cloud activity, kept long enough to investigate an incident you discover weeks later.
- Make sure every alert reaches a decision, at any hour. Whether that's your own team, a partner or both, an alert that waits until Monday is the gap AI-assisted attackers will use most.
- Clean up identity. Owners for every privileged account, app and partner relationship, and removal of what nobody can explain.
Using tools you already own well beats buying another one. That's the cheapest response to "tech on the cheap" there is.
How we help
We've run Microsoft Sentinel for customers since 2019. Our SOCs are staffed 24/7, and CYBERSHIELD AI's Investigation Agent takes every incident to a verdict, typically in 3m 30s, with senior analyst sign-off by default on the managed service. Our vCISO service can help you turn the NCSC's advice into a prioritised plan sized to your organisation.
If you want to see how your out-of-hours coverage would hold up, book a demo or talk to our team.