UK Cyber Chief Warns Against ‘Tech on the Cheap’

Today’s UK cyber warning is a prompt for businesses to check the technology they depend on. The National Cyber Security Centre says years of underinvestment have left organisations exposed as AI accelerates attacks. For a small business, the practical response is to identify unsupported systems, protect important accounts, test recovery and agree how work would continue during an outage.

What has the NCSC warned about?

In its announcement on 3 November 2026, the NCSC warns that AI-powered malware is highly likely to feature in a ransomware attack on UK critical national infrastructure by 2028. It also calls for organisations of every size to address longstanding weaknesses.

“For decades, we have collectively got away with doing tech on the cheap.”

Those are the words attributed to NCSC chief executive Dr Richard Horne in the agency’s published speech extracts. The message is that AI can help attackers find and exploit existing gaps faster and at greater scale.

This is a warning about preparedness and investment. It is not an announcement that a nationwide cyberattack is currently taking place. The NCSC also describes Cyber Essentials as a starting point, with further resilience measures suited to each organisation’s risks.

Does “tech on the cheap” mean you need expensive IT?

A sensible budget is not the same as neglecting maintenance. The question for a business owner is whether the saving leaves an important job undone: applying updates, replacing unsupported software, protecting accounts or checking that data can be recovered. Spending more without knowing what needs fixing is not a useful plan either.

A computer can still turn on and run its usual applications after its software stops receiving security fixes. Equally, equipment should not be replaced just because it looks old. Check support status, reliability and the consequences of failure. Our guide to when to replace business computers explains how to weigh those decisions.

Which checks should your business make first?

Start with the systems that would stop you serving customers, paying staff or accessing essential records. Ask your IT provider for evidence of their condition and protection, rather than a general assurance that everything is covered. Give each unresolved issue an owner and a realistic date for action.

• Check support and updates. Identify computers, servers, routers and applications that no longer receive security updates. The NCSC’s device guidance recommends moving away from unsupported apps and keeping software updated.
• Check important accounts. Confirm that email, administration, finance and backup accounts have appropriate protection, including multi-factor authentication where available. Remove access that former staff or suppliers no longer need. See the NCSC’s account-security guidance.
• Check responsibility. Who maintains your website, remote-access tools and network equipment? Ask whether each service still needs to be enabled and who responds to an urgent security update.
• Record what is outstanding. A short list of known gaps, owners and deadlines is more useful than assuming the IT contract covers every system.

Could you actually recover your files and systems?

Ask when a restore was last tested, what was recovered and how long it took. A successful backup notification is useful, but it does not by itself show that all the information you need is included or that your team knows how to recover it.

The NCSC’s backup guidance says organisations should know how to restore their backups and check that important data is present. It also recommends protecting online backups with two-step verification.

Include customer records, accounting data and essential documents in the discussion. Agree who can access the backups if the usual administrator is unavailable. A recovery test should answer a business question: can we get the information we need back in a usable form?

What would staff do if normal systems were unavailable?

Agree how people would communicate, who would make decisions and which work could continue if email or shared files went offline. Keep a copy of essential contact details accessible without those same systems. Include your IT provider and key suppliers, and decide who would update customers.

A useful exercise is to walk through an ordinary working morning without your main systems. Which orders, appointments or payments would be affected first? What could wait? What would staff need to record and reconcile later? KES’s guide to keeping your business running when Microsoft 365 goes down can help start that conversation.

How can you turn the warning into a practical plan?

Bring the findings together with your IT provider and prioritise them by business impact. Separate urgent security work from planned replacement, then budget for ongoing maintenance and recovery testing. Our small-business IT budget guide covers the costs that are easy to overlook.

KES can help you review your current setup, identify gaps and plan improvements around how your business works. The aim is to know what needs attention and why, with a clear route to getting it done.

Frequently asked questions

Is this warning only for large organisations?

No. The NCSC’s announcement addresses organisations of every size. A small business should scale its preparations to the systems it depends on and the disruption it could tolerate.

Do we need to buy an AI security product?

The announcement does not prescribe a particular product. Start by checking your existing protection, maintenance and recovery arrangements before deciding what additional tools you need.

Does outsourcing IT remove our responsibility?

You still need to understand what is included and who owns each task. The NCSC’s guidance on choosing an IT provider recommends checking arrangements such as patching, backups and access to your data.