What SMEs should do after the NCSC’s 2026 cyber warning

The NCSC expects an unprecedented rise in cyber-attacks. The cause is AI finding old weaknesses faster, rather than any new kind of attack. Here’s what that means for your business, and where to start.

Most businesses we talk to would describe their IT as ‘fine’. It works, people can log in, and nothing has gone badly wrong. The National Cyber Security Centre’s (NCSC) latest review suggests that ‘fine’ is about to be tested.

On 3 November 2026, at the launch of the NCSC Annual Review 2026, chief executive Richard Horne said the UK faces a real prospect of an unprecedented rise in cyber incidents in the coming months. He was clear about the reason. Attackers aren’t using AI to invent new attacks. They’re using it to find and exploit weaknesses that organisations have tolerated for years, at a speed and scale that wasn’t possible before.

Old weaknesses, found faster

Until now, a forgotten server or an old remote access connection could sit unnoticed for years, simply because nobody went looking. That’s changing. AI lets attackers scan thousands of businesses for known weaknesses at once, so being small or unremarkable no longer offers much protection.

The NCSC was also clear about who this falls to. The warning is aimed at leaders of organisations of every size and type, rather than only large companies or critical infrastructure.

What ‘tech on the cheap’ looks like in practice

Horne described decades of what he called “tech on the cheap”. His list will be familiar to a lot of SMEs:

• End-of-life systems running for one more year
• Upgrades pushed back to save on cost
• Access given out because it was convenient, not because it was needed
• Services bought on price alone
• No monitoring to spot when something goes wrong

In a typical SME, that could be a server running an operating system that no longer gets security updates, a remote access setup put in quickly during lockdown, or staff who all have administrator rights because it saved a few helpdesk calls.

It isn’t only office IT. Horne pointed to heating, refrigeration controls, and manufacturing lines, which are rarely treated as IT at all, and noted that refrigeration units across Europe have already been disrupted by cyber-attacks. Internet-connected CCTV and building management systems fall into the same gap. In manufacturing, logistics, retail, and healthcare, these are often the systems a business can least afford to lose.

The real cost is the day you can’t trade

For most businesses, the biggest risk is the day you can’t take orders, send invoices, or serve your customers, and nobody is quite sure what happens next. A stolen file is bad. A business that grinds to a halt for a week is far worse.

Horne didn’t soften this. He warned that leaders who don’t act now may one day have to explain to their staff, customers, and suppliers why the business failed despite the warning signs. Your supply chain widens the risk too: if a key supplier is hit, your business can stop with it, even when your own systems are fine.

‘We have IT support’ isn’t a recovery plan

When something goes wrong, the first hour matters most. Without a written plan, that hour goes on working out who to call and what to switch off.

A business continuity and disaster recovery plan doesn’t need to be long. It needs to say which systems matter most, the order you’ll bring them back in, how long that should take, and who makes the decisions. The business owner and key people should know it, as well as your IT provider.

It also needs testing. Until you’ve restored from a backup, you don’t know it will work when you need it.

5 key questions your business should be able to answer

These are the questions we’d want any business owner to be able to answer straightaway:

1. Which of our systems can be reached from the internet?
2. How quickly can we install a critical security update on every device?
3. Could we recover from ransomware, and when did we last test it?
4. Do we meet the conditions of our cyber insurance? Policies often require things like multi-factor authentication (MFA), and nobody checks until a claim is made
5. Can our IT provider tell us our risk position today, without needing a week to find out?

Where to start

Most of the fixes are well understood. The NCSC’s advice keeps coming back to the basics: replace end-of-life technology, give people only the access they need, switch on MFA or passkeys, keep systems updated, and monitor for problems. Cyber Essentials covers much of this and is a sensible baseline.

AI is helping on the defensive side too. Horne noted that major technology providers now fix hundreds of vulnerabilities in a single update, and the Linux kernel project alone patched more than 1,000 in a month. Those fixes only protect you once they’re installed, which is why how quickly you patch matters more than ever.

If you can’t answer all 5 questions with confidence, you’re not alone, and it’s fixable. Talk to us about what’s not quite working. One of our engineers will go through the questions with you, with no obligation and no sales pitch.