October marks the 10th anniversary of the UK's cybersecurity agency - the National Cyber Security Centre. Take a look at its past, present and future!
On October 10th, 2026, the United Kingdom’s National Cyber Security Centre (NCSC) shared a letter of congratulations from King Charles III, celebrating the agency’s tenth year of operations, as the NCSC marks its date of origins as October 1st, 2016. The letter praises the UK for the work the agency has done: “You have defended this country against cyber-attacks, safeguarded our democratic institutions and protected the critical infrastructure upon which daily life depends. You have built resilience across our public services, businesses and communities, equipping us all to prosper in our ever-revolving digital world. I know only too well what risks are posed to our economic wellbeing and, indeed, those values and institutions we hold most dear.”
King Charles III concluded the letter by expressly thanking the department: “I am acutely aware that much of what you do cannot be praised publicly and that the quiet dedication with which you protect this nation will perhaps never receive the wider recognition it deserves. When I consider the threats you work so tirelessly to defeat, I am filled with profound gratitude that it is you who protected us. On your tenth anniversary, I can only congratulate each and every one of you on being part of that extraordinary decade of service.”
The NCSC was established by MI5 and GCHQ to act as the nation’s technical authority for cybersecurity. The agency’s mission, “to make the UK the safest place to live and work online so that everyone - whether at work or at home - can navigate the cyber landscape safely and with confidence”, is supported by their work with international allies, law enforcement, and intelligence and security agencies, alongside the tech community and tech researchers. Since its creation, the organization has released guidance and tools for all levels of cybersecurity needs - from individual and family needs to the public sector and cyber security professionals, from establishing basic cybersecurity standards to responding to a cyber attack.
The NCSC has developed many of these tools and advice over the past ten years. The UK Government Communications Headquarters (GCHQ) highlighted the NCSC’s achievements over the past ten years in a LinkedIn post, including publishing their ‘Code of Practice for Consumer Internet of Things Security” in 2018, their Cyber Security Toolkit for Boards in 2019, the Suspicious Email Reporting Service in 2020, rolling out the free early warning service the following year, and other accomplishments each year afterwards. In 2024, the NCSC celebrated a decade of development for Cyber Essentials, the minimum standard of cyber security recommended by the government for all organizations. This year, the NCSC even held their first cybersecurity conference, CYBERUK, for tech professionals and leaders in the field in April. Even after the conference, the NCSC has continued to release advice and recommendations for organizations.
On this anniversary of the NCSC launch, the organization also released new guidance: disruptive cyber attacks - reducing their impact, reducing the risk. The Centre’s guide, split into three parts (recovering from, preparing for, and reducing the risk of, highly disruptive cyber attacks), is aimed at C-Suite executives, CISOs and cyber security teams, and other professionals who address cyber risk. The guide describes highly disruptive attacks as “one that disrupts, disables or damages an organisation’s critical systems or services, preventing it from operating normally. Recovery can take weeks or even months. The consequences can extend well beyond technology, affecting customers, services supply chains, finances and organisational reputation. To recover, organisations may need to rebuild systems, redesign business processes and introduce temporary workarounds while full service is restored.”
The UK has experienced a number of highly disruptive attacks in recent years. A 2022 breach at the Ministry of Defense, only disclosed to the public until 2025, required the department to discreetly relocate 4,500 Afghans to the UK. A series of ransomware attacks on some of the nation’s largest retailers (Marks & Spencer, Co-op, and Harrods) had critical impact in April 2025, with M&S losing 700 million pounds ($930 million) in stock market value, and the Co-op having the private information of 20 million users possibly compromised. By the beginning of 2026, the UK admitted that their critical cyber infrastructure was “not adequately resilient”, leading to the release of a new Government Cyber Action Plan. With new technology advancing, like the autonomous artificial intelligence (AI) hacks that have dominated the headlines, the guidance could not be better timed.
The future of the NCSC will likely be tied up in AI risk. This month, Kanishka Narayan, the UK’s AI minister said it would be “likely, if not inevitable” that the UK cyber defenses would be hacked, when reflecting on the hack on the Australian government website by a rogue Anthropic AI agent. He asked that the leaders behind the AI models really consider the risks of similar attacks: “Listen when your scientists warn of serious dangers. Investigate unexpected behaviour. And if you cannot adequately control the risks, do not release the system.”
Building on their guidance and materials on Frontier AI (referring to the most advanced AI tools) published in May 2026, the NCSC has released an update to their research problem book, which was made to hold “the most significant problems which the NCSC believes are in need of concerted and significant collaborative effort from multiple and diverse disciplines over the next decade.” On October 20th, 2026, the NCSC published the new chapter, “AI in cyber security problems”, posing seven high-level research questions centering human-AI collaboration in cybersecurity. While AI continues to pose a challenge for the Centre, its work over the last ten years suggests they will rise to the occasion with more guidance and tools for the UK.