Cyber threats against UK organisations are increasing in both volume and sophistication. Attackers are faster, more opportunistic, and increasingly leveraging emerging technologies such as AI to identify and exploit vulnerabilities.
It’s a stark message, but it’s the conclusion of the National Cyber Security Centre (NCSC)’s 2025 Annual Review.
Published each year, the report provides a comprehensive overview of the key cyber threats facing UK organisations, the national response to these risks, and the technologies and trends shaping the future of digital.
From the Co-op Group data breach to the rapid growth of ransomware and AI-driven attack methods, the Review underlines that no organisation — large or small — is immune. The findings are not only a national barometer of threat activity, but also a practical guide for organisations seeking to strengthen their own resilience.
2025 Sees A Surge In Significant Incidents
The NCSC reports that the number of “nationally significant” cyber incidents has more than doubled in the past year. This increase reflects both the growing complexity of attacks and the expanding digital footprint of organisations across all sectors.
While the headlines often focus on major government departments or critical national infrastructure, the same attack techniques are increasingly targeting SMEs.
Criminal groups see smaller organisations as gateways into larger supply chains — and as potential victims less equipped to detect or respond effectively.
What’s most striking is how democratised cybercrime has become. Attackers no longer need to be experts. Ransomware-as-a-service, phishing kits, and generative AI tools are lowering the barrier to entry, meaning anyone with malicious intent can now mount convincing and damaging attacks.
For SME cyber security, this makes proactive defence and resilience more essential than ever.
The Evolving Threat Landscape: A Contest For Cyberspace
The NCSC describes the UK’s cyber environment as a “contest for cyberspace”. Threat actors — from organised crime groups to nation-state entities — are adapting faster than ever before. They exploit vulnerabilities within hours of disclosure, use automation to scan for weaknesses, and leverage stolen credentials to move laterally through networks undetected.
In this context, cyber resilience becomes more than a technical challenge. It’s a strategic leadership issue. The question for senior teams is no longer “could it happen to us?” but “how quickly could we detect, respond, and recover when it does?”
What SMEs should focus on: Key themes from the NCSC Review
- Ransomware and extortion remain front and centre
Ransomware continues to be one of the UK’s most prevalent and damaging threats. The NCSC highlights a significant rise in both the scale and sophistication of attacks, often involving double or triple extortion — where attackers steal data before encrypting it, then threaten to publish it or launch DDoS attacks if payment is refused.
For SME cyber security, the implications are serious. Even a short period of downtime can have lasting operational and financial consequences. And while high-profile cases dominate headlines, many smaller organisations face the same tactics — often without the resources to recover quickly.
What SMEs should do:
- Strengthen backup and recovery: Maintain offline, immutable backups and test them regularly. A backup that can’t be restored isn’t a backup.
- Deploy MFA everywhere: Multi-factor authentication remains one of the most effective ways to stop credential-based attacks.
- Patch rapidly: Reduce the window between vulnerability disclosure and patch deployment.
- Develop and rehearse an incident response plan: Clarity in a crisis shortens downtime and limits damage.
The NCSC’s message is clear: don’t wait for the breach. Organisations that test their recovery capabilities in advance suffer significantly less disruption when attacks occur.
- Supply chain and third-party risk
The Review places strong emphasis on the growing risk within supply chains. Many cyber incidents in the past year originated not from direct attacks, but from vulnerabilities in connected partners, suppliers, or software vendors.
SMEs often serve as vital links in larger supply networks, particularly within public sector contracts, construction, and manufacturing. Attackers exploit this interconnectivity — breaching smaller partners to gain access to larger targets.
To improve cyber security SMEs should:
- Map your dependencies: Understand which partners have access to your systems, networks, or data.
- Build contractual safeguards: Require minimum cyber security standards and notification obligations for incidents.
- Control access: Limit and monitor third-party connections. Segregate networks to contain potential breaches.
- Review supplier posture: Request evidence of controls such as Cyber Essentials or ISO 27001 certification.
Being part of a supply chain means inheriting both opportunity and risk. Demonstrating strong cyber assurance can now be a commercial differentiator — not just a compliance exercise.
- The Rise Of AI-Enabled Threats (And Defences)
Artificial intelligence has rapidly become a defining theme of cyber security — both as a weapon and a shield. The NCSC’s 2025 Review highlights the dual nature of AI in today’s threat landscape.
Attackers are increasingly using AI to generate convincing phishing content, identify exploitable vulnerabilities faster, and automate reconnaissance at scale. This shortens the time between system exposure and exploitation.
However, AI also offers significant defensive potential — enabling faster anomaly detection, automated incident triage, and predictive threat modelling.
What SMEs should do:
- Train staff to spot AI-generated phishing: Awareness training is vital. AI-driven attacks are more believable and less error-prone than traditional scams.
- Integrate AI-driven defence tools carefully: Many managed security providers now leverage AI to detect patterns that humans might miss.
- Evaluate AI projects through a security lens: When implementing new AI or automation tools, assess data privacy, access control, and supplier trust.
The NCSC’s position is balanced: AI will not replace the fundamentals of cyber hygiene. It should enhance — not distract from — established best practices.
- Building Resilience: “Don’t Wait For The Breach”
A key section of the Review, Resilience at Scale, reinforces a message every business leader should heed: resilience is now the defining measure of cyber maturity.
Prevention alone is no longer enough. The most secure organisations assume compromise is inevitable and invest in detection, containment, and recovery.
For SME cyber security, resilience starts with clarity — knowing which systems, data, and operations are critical to business continuity, and how quickly they can be restored.
How Does SME Cyber Security Need To Evolve:
- Embed cyber risk into governance: Treat it as a board-level issue alongside financial and operational risk.
- Test recovery regularly: Conduct realistic simulations to validate your response capabilities.
- Implement continuous monitoring: Even lightweight alerting or outsourced threat detection helps catch incidents early.
- Invest in people as much as technology: Trained staff are the strongest defence against evolving threats.
The NCSC also highlights the value of its own tools and frameworks — from the Cyber Assessment Framework to Cyber Essentials — which help organisations benchmark and improve resilience.
The Co-Op Breach: Lessons In Visibility And Accountability
One of the most striking case studies mentioned in the Review and subsequent commentary is the Co-op Group data breach, which compromised the personal details of millions of members.
While this incident targeted a large organisation, the lessons are universal. Attackers exploited weaknesses in a third-party supplier’s systems, underscoring the interdependence of modern digital ecosystems.
For SMEs, this highlights two key takeaways:
- Accountability cannot be outsourced. Even if a partner causes the breach, the reputational and regulatory consequences often fall on the organisation that owns the data.
- Visibility is critical. You must know where your data resides, who has access, and how it is protected.
The Co-op incident demonstrates that reputational damage and loss of trust can far exceed the immediate financial impact of a breach. For smaller organisations, such a hit can be existential.
Strategic Security Priorities For SME Leaders
- Make Cyber Risk A Board-Level Priority
The NCSC emphasises that cyber risk must be discussed at the same level as financial and operational risk. This requires visible leadership — not just delegation to IT.
Questions for senior leaders to consider:
- When was our last cyber risk assessment?
- Do we understand our most critical systems and dependencies?
- How would we communicate with customers and suppliers after a breach?
- Is our investment in resilience proportionate to our exposure?
- Build The Business Case For Resilience
Cyber investment should be seen through the lens of business continuity and reputation protection, not purely as a technical expense. The cost of downtime, lost data, or regulatory fines far outweighs the investment needed for prevention and recovery.
Frame cyber security improvements as risk mitigation that protects revenue, ensures compliance, and builds customer confidence.
- Focus On Fundamentals
While emerging threats such as AI and quantum computing make headlines, the NCSC stresses that most breaches still occur due to poor basics — unpatched systems, weak passwords, or misconfigured cloud environments.
For SMEs, mastering the fundamentals delivers the best return on investment. Ensure patching, MFA, least-privilege access, and regular backups are non-negotiable.
- Test, Don’t Assume
Many SMEs assume their backups will work or their response plan is sufficient — until they’re tested in a real incident. Tabletop exercises, red-team simulations, and backup recovery tests are low-cost, high-impact ways to validate resilience.
- Secure The Supply Chain
As public and private sector organisations strengthen assurance requirements, your cyber posture directly impacts your commercial credibility. Demonstrating certification or audited controls can be a differentiator in bids and partnerships.
Looking Ahead: Emerging Technologies And New Frontiers
The NCSC’s forward-looking analysis explores how digital identity, passkeys, and post-quantum cryptography will shape the next phase of cyber security.
While some of these technologies may feel distant for SMEs, they represent trends worth tracking:
- Digital identity and passkeys: Passwordless authentication methods are becoming mainstream, offering stronger protection against credential theft.
- Post-quantum cryptography: Though still developing, organisations should aim for “crypto agility” — ensuring systems can adapt to new encryption standards when needed.
- AI and automation: Continue to monitor how these technologies can improve defence while maintaining ethical and data governance standards.
These developments reinforce a broader truth: cyber security is not static. Continuous improvement and adaptability are vital to long-term resilience.
Summary: What The NCSC Review Means For SME Cyber Security
The 2025 NCSC Annual Review delivers a clear message: the UK’s cyber threat landscape is growing in both scale and complexity. For SME cyber security, that means resilience is now a business imperative, not a luxury.
Key takeaways:
- Cyber incidents are increasing — and SMEs are frequent targets.
- Ransomware, AI-driven attacks, and supply-chain breaches dominate the threat landscape.
- Resilience and rapid recovery matter as much as prevention.
- Board-level ownership of cyber risk is critical.
- Fundamentals like MFA, patching, and backups remain the most effective defences.
- Cyber Essentials and similar frameworks provide a strong foundation.
Immediate next steps for SMEs:
- Schedule a cyber risk review with your leadership team.
- Audit and strengthen supplier and vendor security controls.
- Test your backup and recovery procedures.
- Implement MFA across all systems.
- Run an incident response simulation.
- Invest in awareness training for all staff.
- Consider achieving Cyber Essentials or ISO 27001 certification.
- Embed cyber resilience into your broader business strategy.
The NCSC’s 2025 Annual Review is not just a snapshot of the UK’s cyber security challenges — it’s a roadmap for improvement.
For SMEs, the message is both urgent and empowering: while threats are growing, so are the tools, frameworks, and partnerships available to manage them.
With the right focus on resilience, leadership accountability, and proactive improvement, organisations can not only protect themselves but also gain a competitive edge in a landscape where trust, continuity, and security are more valuable than ever.
Akita’s consultants deliver advanced cyber security solutions. For assistance in improving resilience, please get in touch:
