The NCSC published its tenth annual review this morning, The State of the Cyber Nation. Most of the coverage will lead on AI, and there’s plenty of AI in it. I read it as a penetration tester, and the most useful thing in the report for anyone buying a test is a single sentence about how attackers get in.
From the NCSC’s incident data: “For large organisations, 88% of incidents came from four initial access vectors”. Those four are:
That’s close to a scoping checklist. A web application test covers the first. An external infrastructure test covers the fourth and a good part of the third (password spraying, logins without MFA, accounts that should have been switched off). A phishing simulation covers the second. If you can’t say when each of those was last tested on your estate, start there.
None of it is new. NCSC says the bulk of what it saw from state-backed attackers was “a much simpler exploitation of common vulnerabilities”, and that many of the incidents it handled involved bugs “for which patches are available but have not been deployed in a sufficiently timely fashion”. The fix existed. It just hadn’t gone on.
Of the seven lessons NCSC draws from 337 incidents, this is the one I’d put on the wall: “Sophisticated actors don’t have to be sophisticated to gain access”. The skill shows in what they do once they’re in.
That has a direct bearing on how a pen test should be run. A test that finds an exposed login page, notes it and moves on has told you something you probably knew. The useful question is what happens next: does that account reach the file server, does the file server hold the domain admin’s password in a script, does that get someone to payroll. That’s what penetration testing is for, and it’s the part an automated scan doesn’t do.
NCSC’s incident team saw attackers using AI tools during the year, and says “none of the observed uses of AI enabled a novel class of attack”. Its assessment of AI says the main effect is speed and scale on attacks we already know.
Speed is the problem, though. NCSC expects AI to find vulnerabilities in old code faster than people can fix them, and it’s telling organisations to prepare for a “patch wave”: a rush of updates across every severity, some of them critical. Government’s own work cut the median time to fix domain-related vulnerabilities from 50 days to 8.
Do you know how long the high-risk findings from your last pen test took to fix? If the answer is “not really”, that’s the gap. It’s also why I keep telling people to book the retest. It’s the part that shows the fixes actually worked.
I sell pen tests, so take this with that in mind. NCSC’s view is balanced. It says pen testing “can also become continuous and more accessible”, but still needs “direction and well-engineered safeguards to avoid unintended impact”. It also says human operators remain “essential for directing, validating and adapting AI-generated outputs”, and that the more skilled the operator, the more they get out of the model.
I agree with that. Tools are good at breadth: lots of hosts and known issues, checked often. People are still needed to follow a foothold through a network and to spot the business logic flaw nobody wrote a signature for. Use both, and be clear which one you’re paying for.
One line I didn’t expect in a national threat report: if entry-level tasks get automated “without redesigning training pathways, the profession may inadvertently weaken the pathways through which people acquire deep expertise”. We’re hiring two junior testers at the moment, and that’s the thinking behind it. Somebody has to learn to do this by hand before they can tell when a tool has got it wrong.
If you hold Cyber Essentials Plus, that’s good, and NCSC wants every organisation to get Cyber Essentials. But CE+ isn’t a pen test: it doesn’t test your web applications or try your logins the way an attacker would.
Send us a list of what you’ve got facing the internet, even a rough one. We’ll tell you which of the four routes we’d test first, and what it would cost.