“This collection brings together 3 pieces of guidance to help organisations recover from, prepare for and reduce the risk of highly disruptive cyber attacks”

“They use tactics like cyber attacks, sabotage and disinformation to take organisations offline, disrupt activity, and weaken trust.”

“Passkeys are being rolled out across GOV.UK One Login, giving more than 23 million users a faster and more secure way to access government services.”

“New research analyses 253,912 CVEs and 3,769 confirmed exploited vulnerabilities, finding adversaries continue to target a small fraction of the vulnerability population”

“higher volume of vulnerabilities/faster pace of patching, recognising that these dynamics could create operational/resilience challenges if change, testing and recovery processes are unable to adapt”

“Targeting of operational technology reinforces the need for organisations to understand what is exposed to the internet, address avoidable vulnerabilities, and build long-term cyber resilience.”

“Use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting the unintended activity.”

Use safeguards, sandboxing and active oversight to realise the benefits of autonomous systems while limiting the unintended activity.

The NCSC has published a new fictional worked example demonstrating how organisations can apply the Secure Connectivity Principles for Operational Technology (OT)..

“North Korea relies upon a network of skilled Information Technology (IT) workers, deployed within and outside of North Korea, to obtain false identities and remotely earn income"

A highly disruptive incident can feel overwhelming. New guidance provides a framework for response and recovery...

Russian state-supported cyber actors have targeted Western organisations with a malicious campaign which uses a zero-click exploit coined “beehive”

Russian state-supported cyber actors have targeted Western organisations with a malicious campaign which uses a zero-click exploit coined “beehive”

"A national public awareness campaign will be launched to help the public prepare for emergencies like extreme weather and cyber attacks"

"Danger no longer comes only from the battlefield – cyber and hybrid threats now reach us in new and unpredictable ways.”

An update on the NCSC's trials to test the real-world efficacy of cyber deception solutions.

"Danger no longer comes only from the battlefield – cyber and hybrid threats now reach us in new and unpredictable ways.”

"Data from Report Fraud reveals that 323 organisations reported a ransomware attack between April 2025 and March 2026. Of the reports received, more than 50% were from Small Medium Enterprises"

"Cyber risk can no longer be treated as a purely technical issue. This is a core business risk and leadership responsibility."

"In any contest, the only benchmark that matters is how your capability and performance compares to that of your opponent."

Different code deserves different levels of oversight, so calibrate your approach to ‘vibe coding’ accordingly.

"In any contest, the only benchmark that matters is how your capability and performance compares to that of your opponent."

"A partnership between the NCSC and the Department for Science, Innovation and Technology - is leading this work, exploring how frontier AI can be applied safely to cyber defence across government."

"Attackers are compromising open source packages to spread malware. Cyber defenders are asked to review dependencies to reduce risks"

“Organisations need to be ready to counter the enhanced capabilities of AI-powered attacks. Act now and learn more about frontier AI.”

YouTube video by OffensiveCon

Organisations need to be ready to counter the enhanced capabilities of AI-powered attacks.

New guidance explains how to design Zero Trust Network Access architectures aligned with zero trust principles and not built on old trust assumptions.

“In line with our operational resilience rules and expectations, regulated firms and financial market infrastructures, need to take action to plan for and mitigate cybersecurity risks posed by [AI]"

“In line with our operational resilience rules and expectations, regulated firms and financial market infrastructures, need to take action to plan for and mitigate cybersecurity risks posed by [AI]"

YouTube video by Risky Business Media

My Ministers will also introduce legislation to improve the country’s defences against cyber-security threats [Cyber Security and Resilience Bill].

My Ministers will also introduce legislation to improve the country’s defences against cyber-security threats [Cyber Security and Resilience Bill].

YouTube video by CHERI Alliance

Leave passwords in the past. Passkeys are a faster, more secure alternative to using passwords..

Britain’s cyber agency warned that organizations should prepare for a surge of urgent software updates as artificial intelligence accelerates the discovery of security flaws, raising the risk of wides...

Organisations must act now to prepare for a wave of patches that will address decades of technical debt.

Introducing a common language to improve awareness, threat modelling, and collaboration on AI security

Leave passwords in the past - passkeys are the future ...

As AI accelerates vulnerability discovery, organisations must raise their security baselines to safeguard their cyber security.

Technical and operational debt now the talk of the town..

UK registered organisations can apply for a share of up to £5 million for collaborative projects that enable adoption of the Government's Software Security Code of Practice

Alongside international partners, the NCSC has issued actions for individuals at risk of targeted attacks against messaging apps

UK organisations encouraged to take immediate action to mitigate two recently disclosed vulnerabilities, CVE-2026-3055 and CVE-2026-4368, that affect Citrix NetScaler ADC and Citrix NetScaler Gateway.

UK registered organisations can apply for a share of up to £5 million for collaborative projects that enable adoption of the Government's Software Security Code of Practice