Five things from the past working week that a UK board should know about, in the order I would raise them with a chair over coffee on Monday morning. The NCSC published its annual review and a forecast that deserves a place in your risk register, the Cyber Security and Resilience Bill finished in the Lords, a school estate got a lesson in what trust relationships cost, and a WordPress flaw turned up in the middle of the upgrade process itself. I have left out the noise. What survives has a decision attached.

1. The NCSC says AI-powered ransomware will probably reach critical infrastructure by 2028

On 3 November the NCSC published its 2026 Annual Review. The Register reports that the agency considers it "highly likely" that AI-powered malware will feature in a ransomware attack on UK critical national infrastructure by 2028. The headline numbers, as summarised by Intelligent CISO, are 1,831 reports received, 337 incidents needing NCSC support and 80 judged nationally significant. The more useful reading is the NCSC's own page on what it learned from those 337 incidents: attackers still get in through known vulnerabilities, exposed internet-facing systems and stolen credentials, and sophisticated actors do not need sophisticated initial access. The forecast is about the future. The causes are about last Tuesday.

For boards. Ask your security lead which of the NCSC's seven lessons describes your organisation least well, and what it would cost to close that gap this year rather than in 2028.

2. The Cyber Security and Resilience Bill has cleared the Lords with two government defeats

The Lords completed its examination of the Bill at Third Reading on 2 November. One tracker of the Bill's progress records that the government lost two votes at Report on 26 October: an amendment requiring a review of the NIS regime passed 202 to 155, and one creating a register of hostile foreign powers passed 194 to 155. The Commons must now accept, amend or reject them, and no sitting date has been announced. On 3 November DSIT also updated its Bill factsheets, adding material on agentic AI resilience and vendor risk. These describe proposed duties, not law in force. Royal Assent is expected between late 2026 and spring 2027, with most operational duties not expected until around 2028.

For boards. If you are a managed service provider, a data centre operator or a regulated essential service, ask whether anyone owns the question of whether you will be in scope, and whether your supplier contracts could carry new incident-reporting duties.

3. A school estate shows what a two-way domain trust is worth to an attacker

On 3 November Bitdefender published its reconstruction of a 3AM ransomware intrusion at a UK school estate. Infosecurity Magazine's account puts the activity between 10 and 19 September: the attacker decrypted credentials held in the backup infrastructure, ran Mimikatz, created two backdoor domain administrator accounts, and on 19 September used two-way trusts between three Active Directory domains to reach 50 machines and encrypt 37 in about three hours. Bitdefender could not establish how the attacker got in. Its suggestion that an AI agent handled the repetitive work is an inference from command timing, not direct evidence, and BleepingComputer treats it as suspected. The techniques were ordinary. Backups holding usable credentials and trusts that let one compromise travel were the real failures.

For boards. Ask whether your backup system's credentials are stored and protected as carefully as your domain administrator accounts, and whether anyone has recently reviewed which of your domains and subsidiaries trust each other.

4. A WordPress flaw is exploited while you are upgrading

CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalogue on 3 November. The Hacker News reports that it is a race condition rated CVSS 8.1 which lets an unauthenticated attacker run code on the server during a full-package core upgrade, through predictable, web-accessible staging paths. Security Affairs lists affected versions as WordPress 4.7 through 7.1.3, fixed in 7.1.4. Wordfence recorded more than 18,500 requests against the staging installer paths in the first 21 hours; those are attempts, not confirmed compromises. A honeypot saw three attempts from a UK-geolocated address on 30 October. The awkward part is that the exposure sits inside the act of patching.

For boards. Ask whether your marketing and brand sites, often run by agencies, are on 7.1.4, who confirmed it, and whether anyone knows which of them are managed by a third party you have never audited.

5. The Budget money has a list of things to spend it on

The funding behind the NCSC announcement is worth a separate look. The Register lists £60 million for Cyber Shield, £70 million for a National Exposure and Real-Time Vulnerability Centre, £40 million for a National Agentic Security Unit, £24 million for public sector defences, and a 75 per cent discount on Cyber Essentials for micro, small and medium-sized firms applying for a first certificate. The NCSC admits automated defence often sits outside organisations' risk tolerance, so trust has to be earned first. Cyber Shield is planned in stages over five years. None of it will defend you this winter.

For boards. Treat the discount as a prompt to ask your smaller suppliers whether they hold Cyber Essentials, and to decide whether you will require it.

The thread that ties this together

The NCSC's forecast is about AI, but its evidence is about basics: exposed systems, stolen credentials, known flaws. The school estate fell to backup credentials and domain trusts. WordPress fell to a predictable directory. The Bill and the Budget describe what the state will do over years. The attackers in this week's stories were working from this year's mistakes.

Which of your organisation's basics would you be embarrassed to see described in next year's NCSC review?