The NCSC’s latest Annual Review highlights how AI is accelerating familiar attack techniques. For application security teams, the challenge is keeping testing relevant as applications, infrastructure and threats change.
Familiar routes in, less time to respond
The NCSC’s Annual Review 2026 highlights a threat landscape where established attack techniques are becoming faster and more efficient. AI is helping threat actors with reconnaissance, vulnerability discovery and exploit development, increasing the pressure on organisations to identify and address weaknesses before they can be exploited (Source: GLM-5.3 and the spread of advanced cyber capabilities \ Anthropic)
They assess that AI will accelerate and scale existing tactics, techniques and procedures rather than generate entirely new attack vectors. They also suggest that AI will increasingly be integrated into attacks to improve speed, scale and efficiency, rather than autonomously conducting end-to-end attacks.
However, the routes into organisations remain familiar, with the NCSC reporting that 88% of incidents involving large organisations came through four initial access routes collectively:
- Exploitation of external public-facing applications
- Phishing
- Misuse of valid accounts
- Exploitation of external remote services
For Graham Bacon, Technical Director at AppCheck, this reinforces the importance of getting the fundamentals right:
“The NCSC’s Annual Review confirms what we see every day. Attackers rarely need to be sophisticated to get in, they come through the front door. Exploiting public-facing applications tops the list of how large organisations are breached, and AI is making that faster and cheaper.
The answer isn’t new, it’s discipline. Scan your infrastructure regularly, test your applications in depth, understand what those applications trust, from third-party scripts to APIs and integrations, and run regular discovery sweeps so nothing appears on your attack surface without you knowing about it.”
Periodic testing assumes applications stand still
The NCSC describes a move beyond periodic vulnerability scanning towards an interconnected process of discovery, prioritisation, remediation and verification. It also recognises that penetration testing and assurance can become more continuous and accessible, provided appropriate direction and safeguards are in place to prevent unintended impact.
Its Principles Based Assurance approach takes this further, moving away from static compliance demonstrated through a one-off assessment towards confidence in security outcomes, supported by evidence that remains relevant as technology and threats change.
What does this mean for security teams?
For application security teams, this means looking beyond how often testing occurs and examining what it covers. Testing public-facing pages alone may leave authenticated functionality, access controls, APIs and complex user journeys insufficiently assessed.
Organisations should establish clear triggers for reassessment between scheduled tests. Changes to authentication, new API endpoints, major application releases, and infrastructure changes should prompt a review of whether existing security assurance remains valid.
Testing live applications also requires care, as the NCSC specifically highlights the need for direction and well-engineered safeguards when making penetration testing more continuous.
Your attack surface includes what your application trusts
An application’s exposure extends beyond the code and infrastructure an organisation directly manages.
Modern websites frequently rely on third-party JavaScript, externally hosted resources, APIs and integrations. These dependencies can introduce security risks that are not always apparent through conventional application testing.
Third-party JavaScript deserves particular attention. Scripts loaded into a website execute within the browser’s page context and can interact with the page’s content and information available to it. If an external script is compromised or changed unexpectedly, the consequences can extend to the website and its users.
Organisations should maintain an inventory of the external resources their applications depend on, understand why each is required, who controls it and what access it has. Changes to dependencies should be reviewed, unnecessary scripts removed, and appropriate controls applied to limit the consequences of compromise.
This is AppCheck’s application security perspective on a wider supply-chain challenge: knowing what you own is important but understanding what your applications trust is equally necessary.
AI finds candidates, but people decide what matters
AI-assisted vulnerability discovery offers significant potential for security teams, particularly when analysing large codebases and identifying weaknesses that might otherwise remain undetected. However, a potential vulnerability is not automatically an exploitable security issue.
The NCSC’s Project DROMOS provides a useful example of how these capabilities can be applied. Launched across government in 2026, the initiative explored how frontier AI models could accelerate vulnerability discovery. Its work uncovered hundreds of potential security issues, including critical vulnerabilities, in selected government environments.
Importantly, the programme combined AI-assisted analysis with expert human oversight. It also established governance processes and operational safeguards to manage false positives and ensure findings were handled appropriately.
Experienced security professionals provide the judgement needed to establish whether a finding is genuine, understand the conditions required for exploitation and determine what action is appropriate. AI can accelerate analysis, but expertise remains essential to interpreting the results.
Continuous security. AI-enabled capabilities. Human expertise.
The NCSC’s vision for cyber defence rests on human expertise, trusted partnerships and AI-enabled capabilities working together. For application security, this means testing that keeps pace with change, technology that accelerates discovery and analysis, and experienced people who can determine what matters and guide effective remediation.
The challenge is not simply to find more vulnerabilities; it is to maintain confidence in the security of applications as they evolve, and to have the evidence to demonstrate that weaknesses have been addressed.
Read the full NCSC Annual Review 2026 here for more information.
