Penetration Testing
The National Cyber Security Centre (NCSC) published the NCSC Annual Review 2026 on 3 November 2026, and its incident data shows attackers still getting in through a small number of familiar routes. The review’s assessment of artificial intelligence (AI), published the same day, judges that AI is helping attackers find weaknesses on those routes faster rather than opening new ones, which shortens the time an organisation has to find and fix them first.
The NCSC Annual Review 2026 records 1,831 reports of cyber attacks received by the NCSC’s Incident Management team between 1 September 2025 and 31 August 2026. After triage, 337 incidents needed the team’s support and 80 of those were classed as nationally significant, compared with 204 nationally significant incidents reported in the NCSC Annual Review 2025, published on 14 October 2025. The 2026 review notes that incident reporting does not follow a simple year-on-year trend, and it does not say whether the way incidents are categorised has changed. These figures count what reached the NCSC and needed its help; they do not show whether UK organisations as a whole were attacked more or less often, so the fall from 204 to 80 is not evidence that the risk has gone down.
The figure most useful to a small security team comes from the chapter of the NCSC Annual Review 2026 on a decade of cyber threat. In the incidents the NCSC handled, 88% of those at large organisations began with one of four initial access routes: exploiting public-facing applications, phishing, misuse of valid accounts, and exploiting external remote services, meaning the routes staff use to connect from outside, such as a virtual private network (VPN). The NCSC states the 88% figure for large organisations only, so it does not establish that smaller organisations are compromised in the same proportions. The review’s incident management chapter describes the same routes across all the incidents it handled, naming known vulnerabilities in internet-facing systems, stolen credentials and social engineering as the usual ways in.
The NCSC Annual Review 2026 judges that AI’s greatest impact will be to speed up and scale attackers’ existing techniques rather than to create new attack vectors. The NCSC’s Incident Management team saw attackers using AI tools during the year, and none of the uses it observed enabled a new class of attack. The change the review does expect is in vulnerability discovery: it judges it highly likely that AI-assisted discovery will give attackers a better chance of reaching systems before their owners patch them, leaving defenders in a race to shorten the time it takes to deploy fixes.
My view is that this is the more useful reading for a smaller organisation: the four routes are the ones it has been advised to close for years, and what AI changes is how long a weakness on one of them can sit unnoticed before somebody else finds it.
Testing exposure on the four entry points starts with a written list of everything that can be reached from the internet, because the checks on three of the four routes depend on it. A first version can come from your public domain name system (DNS) records, your firewall’s inbound rules and your supplier contracts, and it should record who looks after each system.
Public-facing applications are anything an outsider can reach directly, such as the website, a client portal, webmail or a booking system. Check the software version behind each one against the vendor’s published security advisories, starting with anything that handles logins or client data. An external vulnerability scan automates that version check, while a penetration test goes further by trying to exploit what it finds, including flaws in how the application works that a scanner is not designed to recognise. Our guide to the difference between penetration testing and vulnerability scanning explains which suits which job.
Phishing exposure, in my view, is better measured by what a stolen password would open than by how many staff click a simulated email. Try signing in to email and file storage from an unfamiliar device with a test account, and confirm that multi-factor authentication is enforced for every account, including shared mailboxes and old service accounts that are easy to miss. The NCSC Annual Review 2026 also promotes passkeys as more resistant to phishing than passwords, which I would consider first for accounts with administrator rights.
Misuse of valid accounts means an attacker signing in with real credentials, whether bought, guessed or phished. Export the list of enabled accounts from your directory and compare it with your current staff list and with everyone who has left in the past 12 months. Accounts with no sign-in for 90 days, administrator rights held by people who no longer need them, and accounts nobody can name an owner for are the ones to disable or review.
External remote services are the routes staff and suppliers use to connect from outside, such as a VPN or a remote desktop gateway. List every one, including any a supplier set up to provide support, and confirm that each requires multi-factor authentication and runs a supported, patched version. I would close a remote desktop port that is open directly to the internet rather than spend time testing it.
An external penetration test brings the four routes together, because it shows whether a weakness on one leads on to data or systems that matter.
The NCSC Annual Review 2026 asks every organisation to prepare for a vulnerability patch wave, which it describes as a rush of software updates that will need applying across the technology stack as new vulnerabilities are disclosed. The NCSC expects updates across all severities, with a number of them critical, and advises planning to deploy security updates quickly, more frequently and at scale, including across supply chains. It suggests its updated Vulnerability Management guidance as the place to start.
For a team of one or two people, most of the preparation is deciding in advance what gets patched first and who can approve it. That means the internet-facing list above with a supplier named against each system, a person authorised to approve an urgent update outside working hours, and a tested way to roll a change back. Where a managed service provider runs your systems, ask it how it will handle a surge of critical updates and how quickly it commits to applying them.
Security update management is already one of the five technical controls in Cyber Essentials, so a certified organisation has a patching routine in place; the patch wave tests whether that routine can run faster and more often. The NCSC’s free Early Warning service, which alerts registered UK organisations to potential intrusions and vulnerabilities detected on their networks, is worth adding while that routine is under test.
The NCSC’s incident data gives no sign that the four routes are changing, while its AI assessment expects weaknesses on them to be found faster. The list of internet-facing systems is the place to start, and it will show whether a scan or an external test is the better next step.
The National Cyber Security Centre’s Annual Review 2026, published on 3 November 2026, reports that 88% of incidents at large organisations in its incident data began with one of four routes: exploiting public-facing applications, phishing, misuse of valid accounts, and exploiting external remote services such as a virtual private network. The figure is stated for large organisations only, so it does not show that smaller organisations are compromised in the same proportions, although the review describes the same familiar routes across all the incidents it handled.
A vulnerability patch wave is the term the National Cyber Security Centre uses in its Annual Review 2026, published on 3 November 2026, for a rush of software updates that organisations will need to apply across their technology as new vulnerabilities are disclosed, with artificial intelligence speeding up how quickly weaknesses are found. It expects updates across all severities, some of them critical, and advises planning to deploy security updates quickly, more frequently and at scale, including across supply chains.
A vulnerability scan checks systems automatically against known weaknesses and suits frequent, routine checking of what faces the internet. A penetration test is carried out by a tester who tries to exploit what is found and to link weaknesses together, so it shows what an attacker could actually reach. For a smaller organisation, regular scanning with a penetration test after significant changes to internet-facing systems is a sensible pattern.
The National Cyber Security Centre’s Early Warning service is free to UK organisations and, once you register, sends alerts about potential intrusions and vulnerabilities it detects on your network. Continuous external vulnerability scanning from a commercial provider does a similar job. Either works best alongside an up-to-date list of what you expose, since an alert is only useful if someone knows which system it refers to and who looks after it.
A useful penetration test report names each affected system, shows the evidence that each weakness was confirmed, explains the risk rating in terms of what an attacker could reach, and gives remediation steps specific enough for the person who maintains the system to act on. It should also state what was out of scope and when a retest is due, so that nobody reads it as covering more than was tested.
Ask for a test scoped to the systems the customer cares about, usually your internet-facing services and any application that handles their data, carried out by a provider independent of whoever runs those systems. Ask for a report you can share with the customer, or a summary letter covering findings and remediation, and agree a retest so you can show that issues were fixed.
Safeguard your business with our expert cyber security solutions. Whether you require digital forensics, penetration testing or proactive security assessments, our team is ready to assist. Contact us today to discuss your security needs and take the first step towards a more secure future.
