Would your business still be Cyber Essentials Plus ready if the assessor arrived tomorrow?
In the latest of our thought leadership articles, Julie, Director at KubeNet, reflects on the findings from the National Cyber Security Centre (NCSC)'s Annual Review 2026 and shares her perspective on why strong cyber security starts with getting the fundamentals right.
From Cyber Essentials Plus and governance to staff awareness and cyber resilience, Julie explores why maintaining good security practices every day is far more important than simply achieving certification once.
Would your business still be Cyber Essentials Plus ready if the assessor arrived tomorrow?
That was one of the things I found myself thinking about while reading the latest NCSC Annual Review 2026.
There is, quite rightly, a huge amount of conversation about AI and how it is changing cyber security. But one of the messages I took from the report is actually much simpler.
A lot of successful cyber attacks still come down to weaknesses we already know how to address.
For me, that's important because cyber security can very quickly become a technical conversation and one that many people understandably switch off from.
It doesn't need to be.
Whether we're supporting a smaller business without an internal IT team or a much larger enterprise with dedicated technology and security resources, many of the conversations we have at KubeNet come back to the same fundamentals.
Do you know where your risks are?
Are the basics being done consistently?
Do your people know what to look out for?
And if something does go wrong, do you know what you're going to do?
I'm a big advocate of Cyber Essentials Plus and increasingly believe it should be viewed as a must-have for UK businesses.
But I'd also challenge businesses not to see achieving certification as the end point.
Passing an assessment once and maintaining that standard every day are two very different things.
That's where governance becomes so important.
Cyber shouldn't just belong to the IT department or your technology provider. Boards and leadership teams need to understand the risks, know who is accountable for them and regularly ask whether the organisation is actually becoming more resilient.
And we can't forget people.
We can invest heavily in technology, but educating staff, keeping cyber security visible and giving people the confidence to question something that doesn't look right remain incredibly important.
That thinking is very much behind the way we're developing our cyber audit and planning approach at KubeNet. Assess where you are, identify the priorities, address the gaps, educate people, test what you've put in place and then go back and review it again.
Because cyber security isn't something we can tick off once a year.
I'm also really proud of KubeNet's involvement in the National Incident Response Cadre led by Cyber and Fraud Centre Scotland. It gives us the opportunity to work alongside others across the industry, share expertise and contribute to improving cyber resilience more widely.
And perhaps that's my biggest takeaway.
AI will change the threat landscape. Technology will continue to change. The risks will change.
But good cyber security doesn't have to be unnecessarily complicated.
Get the foundations right.
Maintain them.
Educate your people.
Test your resilience.
And make cyber security part of how you run your business, not simply something you do to achieve a certificate.
Ultimately, effective cyber security is not about implementing every new technology or reacting to every emerging threat. It is about building a culture of resilience, maintaining strong foundations and continually reviewing how risks are managed across the organisation.
The businesses that are best prepared for future cyber threats are often those that consistently get the basics right, educate their people and treat cyber security as an ongoing business priority rather than a one-time project.
Cyber Essentials Plus, governance, staff awareness and regular review all have an important role to play. The challenge for organisations is ensuring those principles remain embedded long after an assessment has been completed.
Comments