Cyber resilience can't be measured once a year: 3 learnings for business leaders from NCSC's 2026 Annual Review

The latest NCSC Annual Review 2026 makes one thing clear: the cyber threat facing UK organisations is growing, and the consequences of getting security wrong are becoming increasingly difficult to ignore.

With malicious cyber activity costing UK organisations an estimated £14.7 billion annually, the commercial implications extend far beyond IT departments.

AI is accelerating the threat landscape, introducing new vulnerabilities and giving attackers more sophisticated capabilities. But while the threats are evolving, the foundations of good cyber security remain the same.

For me, the bigger challenge isn't necessarily knowing what good security looks like. It's ensuring those measures are consistently applied, maintained and, importantly, proven to be effective.

And that's where our approach to compliance needs to evolve. For me, there are three key principles that will shape how organisations build and maintain cyber resilience moving forward.

1. Compliance must move beyond the point of certification

There's a big difference between achieving a certification and building a security programme that continues to protect the business long after the audit.

Certifications such as ISO 27001 and Cyber Essentials provide important foundations. They demonstrate a commitment to recognised standards and help build confidence with customers, partners and stakeholders.

But achieving certification doesn't mean an organisation's risks suddenly stand still.

People change roles. New suppliers are onboarded. Systems evolve. New vulnerabilities emerge. And the controls that were once effective during an assessment may not remain that way without ongoing oversight.

One particularly interesting development in the NCSC's review is its discussion of Principles Based Assurance. While this approach specifically concerns the assurance of technology products and systems, its emphasis on demonstrating security outcomes reflects a wider principle that I believe organisations should embrace.

It's no longer enough to show that the right controls exist. Businesses need confidence that they're working.

That requires a shift away from treating compliance as a periodic exercise towards something embedded in everyday operations, supported by readily accessible evidence, clear accountability and a commitment to continuous improvement.

2. Cyber is a board-level responsibility. Evidence must be too

Cyber security has become a business-critical responsibility, with direct impact on financial performance, operational continuity, customer confidence and long-term growth.

It's no longer something boards can afford to delegate entirely to IT.

The NCSC's emphasis on cyber governance reinforces the importance of leadership taking an active role in understanding and managing organisational risk.

But there's a difference between making cyber security a board-level responsibility and giving boards the visibility they need to act on it.

A policy document or annual compliance report might provide reassurance. What it doesn't necessarily demonstrate is if and how the organisation is becoming more resilient.

Boards should be able to ask straightforward questions:

Where are our biggest risks?
Who owns them?
Are our control working?
What progress have we made, and where are we still exposed?

And they should be able to get clear, evidence-backed answers.

For me, that's where meaningful cyber governance begins.

Not with another report produced ahead of an audit, but with ongoing visibility into the organisation's security posture, supported by measurable progress and accountability across the business.

If cyber resilience is a board-level responsibility, providing boards with reliable evidence must be a priority.

3. Resilience needs to extend across the whole business

Another important theme running through the NCSC's review is the increasingly interconnected nature of cyber risk.

From supply chain vulnerabilities to the growing use of AI, organisations are managing a wider range of threats across more areas of their operations.

And AI is a particularly interesting example.

Recent industry research shows that 4 in 5 organisations now face customer enquiries around AI risk management, while 47% expect to be impacted by the EU AI Act.

AI adoption is accelerating, but so are the expectations around how businesses govern its use, protect sensitive information and manage emerging risks.

I'll be exploring this further next week alongside Boxphish in BGF's upcoming webinar, Tackling Phishing & Cyber Fraud in the Age of AI, where we'll discuss what these evolving threats mean for businesses and how organisations can better prepare.

But whether we're talking about AI, phishing or supply chain vulnerabilities, the underlying principle remains the same:

Cyber resilience has never been solely about technology.

People, processes, suppliers and organisational decision-making all play a role in determining how effectively a business manages risk.

For me, the answer isn't to create a separate compliance programme for every emerging threat. It's to build a connected approach to governance, where risks, controls, responsibilities and evidence are managed as part of one wider programme.

Not simply to satisfy multiple frameworks, but to create a stronger, more consistent foundation for business resilience.