Why Internet Exposed Systems Are Becoming a Major Cyber Risk for UK Organisations
The National Cyber Security Centre (NCSC) has issued a new alert warning that cyber attackers are increasingly targeting systems that are reachable from the public internet — including devices organisations didn’t realise were exposed. This activity has already caused “limited real-world disruption” in some sectors (NCSC, 2026).
Although the advisory focuses heavily on Operational Technology (OT), the message applies to every organisation. If a device can be reached online, it can be attacked — even if you didn’t intend for it to be.
Additional updates from the NCSC reinforce this trend. They note that attackers are increasingly exploiting “unpatched services, misconfigured interfaces, and insecure remote access points” on internet‑exposed systems and edge devices (NCSC, 2026). This activity is not limited to large industrial operators — any organisation with publicly accessible systems can be affected. The NCSC stresses that firms should verify what is exposed, reduce unnecessary internet access, and strengthen basic cyber hygiene to prevent attackers gaining footholds and pivoting deeper into networks.
1. Know What’s Connected to the Internet — Even Accidentally
Many organisations assume their systems are offline, but the NCSC warns that “unintended exposure can arise through misconfigurations, legacy connections, or unmanaged assets” (NCSC, 2026).
Example:
A small manufacturing firm believed its production equipment was isolated. During a Cyber Essentials pre‑assessment, we discovered an old remote access tool installed during COVID that was still active. It wasn’t documented, wasn’t monitored, and provided direct access to the network.
This is exactly the type of exposure attackers now look for.
Further guidance from industry practitioners reinforces this point. Christopher Lomax notes that organisations often forget about older connections, temporary port‑forwarding rules, or remote access accounts left behind by previous suppliers (Lomax, 2026). These oversights mean devices such as CCTV recorders, door‑access systems, NAS drives, VPN appliances, and even heating or building‑management equipment can end up exposed to the internet without anyone realising. The NCSC specifically advises organisations not to assume systems are inaccessible without checking — unintended exposure frequently comes from configuration mistakes, legacy connections, and unmanaged devices.
Additional analysis from the National Preparedness Commission reinforces this point, noting that attackers increasingly exploit unpatched services, misconfigured interfaces and insecure remote access points to gain footholds in UK organisations (NPC, 2026a). These exposures often arise from legacy connections or unmanaged assets that teams have forgotten about.
Further reporting from Secarma highlights that many compromises begin with unpatched or misconfigured devices that are directly accessible from the internet (Secarma, 2026a). These exposures often arise because edge systems are managed separately from core IT, meaning outdated firmware and forgotten remote access tools remain online without anyone realising.
Additional international analysis from the Royal Australian Air Force highlights that misconfigurations, legacy connections and unmanaged assets can unintentionally expose systems to hostile access (RAAF, 2026a). Their guidance emphasises the importance of maintaining accurate asset inventories to identify devices that may be reachable from the public internet without anyone realising.
A regulatory update from UKGI reinforces this point, noting that misconfigurations, legacy connections and unmanaged assets can all lead to unintended internet exposure (UKGI, 2026a). The guidance stresses that organisations should build a definitive view of their OT and edge assets to verify what is reachable from the public internet.
Recent analysis from V4One highlights that cyber incidents can disrupt organisations even when they are not directly targeted, particularly where supply chain systems or connected technologies are exposed to the internet (V4One, 2026a). This reinforces the need for organisations to understand exactly which devices, applications and interfaces are reachable online.
Government data from the Cyber Security Breaches Survey shows that misconfigurations, legacy connections and unmanaged assets remain common exposure pathways across UK organisations (CSBS, 2026a). With 43% of businesses reporting a cyber breach or attack in the last 12 months, unintended internet exposure continues to be a significant operational risk.
Additional NCSC guidance highlights that attackers frequently target forgotten or unknown systems that organisations are not monitoring (NCSC‑REA, 2026a). The advice recommends using attack surface management tools to discover unmanaged assets and reduce shadow IT, ensuring that no device is unintentionally exposed to the internet.
Reporting from Computing.co.uk highlights that recent shutdowns of a UK power plant and US water treatment facilities were linked to vulnerabilities in operational technology systems that were assumed to be isolated (Computing, 2026a). The NCSC warns that exposure can occur through misconfigurations, unmanaged assets or previous connections that were never revoked.
Commercial sector reporting shows that small businesses are increasingly being targeted, with 43% of cyberattacks in 2024 aimed at SMBs (Elmdale, 2026a). Many of these incidents stem from misconfigurations, unmanaged devices or remote access tools left active during hybrid working.
Intelligencia Training highlights that IoT devices — from smart home equipment to industrial systems — often lack robust security controls, creating unintended exposure pathways for attackers (Intelligencia, 2026a). Segregating IoT from critical networks and keeping device firmware updated significantly reduces this risk.
The House of Commons Library notes that 43% of UK businesses experienced a cyber-attack in the previous 12 months, with many incidents beginning through vulnerabilities or human error (UK Parliament, 2025a). This reinforces the need to identify unmanaged assets and legacy connections that may be unintentionally exposed.
2. Replace Default Passwords and Strengthen Access Controls
The NCSC highlights that default credentials and shared passwords remain a major weakness (NCSC, 2026).
Example:
A microbusiness had a cloud‑managed router still using the default admin password. Attackers routinely scan the internet for these devices. Changing the password and enabling MFA reduced the risk instantly.
Small changes make a big difference.
Parliamentary research highlights that an estimated 95% of cyber-attacks succeed because of human error, including weak passwords and credential reuse (UK Parliament, 2025b). Strengthening access controls and enforcing MFA significantly reduces this risk.
Elmdale notes that credential‑stuffing attacks remain a common entry point for cybercriminals, particularly where small businesses reuse passwords or fail to implement MFA (Elmdale, 2026b). Strengthening access controls significantly reduces this risk.
UKGI highlights that replacing default credentials and strengthening access controls remains a core requirement for reducing the risk of compromise, particularly where OT or boundary devices are Internet‑accessible (UKGI, 2026b).
The Cyber Security Breaches Survey highlights that adoption of advanced controls such as multi‑factor authentication remains relatively low, with only 47% of businesses implementing MFA (CSBS, 2026b). This reinforces the need to replace default credentials and strengthen access controls on Internet‑exposed systems.
The NCSC notes that stolen credentials remain one of the most common entry points for attackers, and recommends enforcing strong password policies, implementing MFA and offering passkeys where possible (NCSC‑REA, 2026b). These measures significantly reduce the likelihood of compromise on Internet‑exposed systems.
Intelligencia notes that phishing remains one of the most prevalent cyber threats in the UK, and MFA is one of the most effective ways to prevent credential theft from leading to compromise (Intelligencia, 2026b).
3. Keep Boundary Devices Updated and Supported
Routers, firewalls, and remote access appliances are often the first systems attackers' probe. The NCSC advises replacing end‑of‑life equipment and ensuring updates are applied routinely (NCSC, 2026).
Example:
A sole trader was still using a 2014 router provided by their ISP. It had no security updates available. Replacing it with a modern, supported device removed multiple known vulnerabilities.
If your router is older than your laptop, it’s time to review it.
Further reporting highlights that many serious incidents begin with unpatched or misconfigured edge devices such as VPNs, firewalls, routers and remote access appliances (Secarma, 2026). These devices often sit at the boundary of the network, are managed separately from core IT systems, and may run outdated firmware that organisations do not realise is vulnerable. Attackers routinely scan the internet for exposed management interfaces, default credentials and remote‑access tools left accessible when they no longer need to be. Once compromised, an edge device provides a foothold into the internal network — often with privileged access — which is why the NCSC urges organisations to review their external attack surface and ensure edge devices are patched promptly and included in routine security assessments.
Secarma also notes that attackers routinely scan the internet for exposed management interfaces, unpatched VPN appliances and misconfigured remote access tools (Secarma, 2026b). During incident response, organisations frequently discover that edge infrastructure was not included in patch management processes, that default credentials were never changed, or that devices were left internet‑accessible when they did not need to be.
UKGI notes that organisations should maintain secure, supported boundary devices and ensure they are not directly accessible from the public internet (UKGI, 2026c). This includes reviewing who is responsible for patching OT and edge systems and ensuring they are included in routine update processes.
The National Preparedness Commission warns that adversaries continue to target weaknesses in publicly accessible edge devices, using outdated firmware, exposed management interfaces and insecure remote‑access tools to disrupt operations or pivot deeper into networks (NPC, 2026b).
V4One’s September review showed that critical vulnerabilities are now being exploited within hours of patches being released, underscoring the importance of rapid patch management for internet‑facing systems (V4One, 2026b). With hundreds of vulnerabilities disclosed monthly, organisations must prioritise updates for boundary devices that present the greatest risk.
Survey data indicates that many organisations patch edge devices less frequently than core IT systems, often leaving outdated firmware and vulnerable interfaces exposed to the internet (CSBS, 2026c). This gap in patch management increases the likelihood of attackers exploiting perimeter infrastructure.
NCSC guidance emphasises that attackers routinely exploit vulnerabilities or insecurely configured services exposed to the internet, and advises organisations to establish a robust vulnerability management process to keep boundary devices protected throughout their lifecycle (NCSC‑REA, 2026c). This includes disabling unnecessary services and ensuring all applications are kept up to date.
The Computing.co.uk analysis reinforces that attackers are increasingly exploiting vulnerabilities in firewalls, gateways and remote‑access appliances, particularly where outdated firmware or insecure configurations remain in place (Computing, 2026b). Hardening and updating these devices is essential to prevent attackers gaining a foothold.
Elmdale highlights that many SMBs lack the resources to maintain regular patching, leaving routers, firewalls and remote‑access appliances outdated and vulnerable (Elmdale, 2026c). These weaknesses make small organisations attractive targets for attackers scanning the internet.
The UK Parliament briefing explains that attackers commonly deliver malware by exploiting technical vulnerabilities in internet‑facing systems (UK Parliament, 2025c). Ensuring boundary devices are securely configured and routinely updated is essential for preventing initial compromise.
4. Remove Insecure Protocols and Use Modern Alternatives
Older protocols like Telnet, SNMP v1/v2 and insecure industrial protocols are still widely used. The NCSC recommends migrating to secure versions wherever possible (NCSC, 2026).
Example:
A small engineering firm had a device using Telnet for management access. Telnet sends credentials in plain text. Switching to SSH removed the risk immediately.
If a protocol is older than your business, it probably needs replacing.
The RAAF notes that secure industrial and management protocols are essential for preventing hostile access, particularly where legacy technologies remain in use (RAAF, 2026b). Migrating away from outdated protocols significantly reduces the risk of credential interception or unauthorised remote access.
UKGI guidance recommends adopting secure industrial and management protocols wherever possible, replacing legacy technologies that expose credentials or allow unauthorised remote programming (UKGI, 2026d).
The NCSC recommends adopting secure industrial and management protocols as part of baseline cyber security practices, replacing legacy technologies that expose credentials or allow unauthorised access (NCSC‑REA, 2026d). This aligns with the need to migrate away from outdated protocols such as Telnet and older SNMP versions.
The NCSC’s recommendations, reported by Computing.co.uk, include retiring insecure protocols such as Telnet and older SNMP versions, which continue to expose OT and edge devices to unauthorised access (Computing, 2026c).
Intelligencia’s analysis shows that insecure IoT protocols and poorly configured devices continue to expose UK organisations to attack, reinforcing the need to retire outdated technologies and adopt secure alternatives (Intelligencia, 2026c).
5. Log and Monitor Network Activity
OT environments are predictable, which makes unusual activity easy to spot. The NCSC advises logging and monitoring all connectivity (NCSC, 2026).
Example:
A business noticed its router making outbound connections at 3am. This turned out to be an unauthorised remote‑access tool installed by a former contractor. Basic monitoring caught it early.
You don’t need enterprise tools — even simple alerts help.
The briefing emphasises that human error remains a major factor in successful cyber attacks, making monitoring and early detection critical for identifying suspicious behaviour before it escalates (UK Parliament, 2025d).
Intelligencia highlights that insider threats — both accidental and malicious — remain a significant risk, and monitoring user activity is essential for detecting suspicious behaviour early (Intelligencia, 2026d).
Elmdale reports that remote and hybrid working has increased the need for monitoring, as employees often use personal devices or insecure home networks that can expose business systems to attack (Elmdale, 2026d).
The NPC stresses that rigorous monitoring is essential, as attackers frequently use exposed interfaces to establish persistent access. Even basic logging can reveal unusual outbound connections or remote‑access attempts that indicate compromise (NPC, 2026c).
Secarma’s analysis shows that compromised edge devices often provide attackers with privileged access, allowing them to pivot deeper into networks and disrupt operations (Secarma, 2026c). Effective logging helps detect these behaviours early, especially when attackers exploit exposed interfaces or remote‑access tools.
The RAAF emphasises that monitored connectivity is critical for detecting unusual or unauthorised activity before it leads to real‑world disruption (RAAF, 2026c). Even simple monitoring can reveal unexpected outbound connections or remote‑access attempts.
UKGI emphasises that all connectivity to and within OT networks should be logged and monitored to detect suspicious activity early (UKGI, 2026e). This aligns with broader guidance that attackers frequently exploit exposed interfaces to establish footholds.
The Cyber Security Breaches Survey notes that user monitoring and logging remain less widely adopted than other controls, despite their importance for detecting suspicious activity on internet‑exposed systems (CSBS, 2026d).
The NCSC stresses the importance of early reporting and detection, noting that people across the organisation are often the first to notice suspicious activity (NCSC‑REA, 2026e). Clear reporting mechanisms and a culture that encourages staff to raise concerns can help identify attacks before they escalate.
6. Segment Your Networks
Segmentation prevents attackers from moving freely across systems. The NCSC emphasises separating OT, management, and business networks (NCSC, 2026).
Example:
A café had its card payment machine, CCTV, and guest Wi‑Fi all on the same network. Segmenting them meant a compromise in one area wouldn’t affect the others.
Flat networks = high risk.
Intelligencia recommends segregating IoT networks from critical systems to prevent attackers from using insecure devices as a bridge into sensitive environments (Intelligencia, 2026e).
The RAAF guidance stresses that network separation is essential for limiting the impact of incidents, particularly where operational, management and business systems coexist (RAAF, 2026d). Segmentation prevents attackers from moving freely across environments if one device becomes compromised.
UKGI also advises separating OT, management and business networks to limit the impact of incidents and prevent attackers from moving laterally across environments (UKGI, 2026f). Operating OT devices in a state that prevents remote programming further reduces the risk of unauthorised access.
The Computing.co.uk article notes that the NCSC advises segmenting OT, management and business networks to limit the impact of compromise and prevent attackers moving laterally across environments (Computing, 2026d).
7. Maintain Tested, Ransomware‑Resistant Backups
Backups must be isolated, tested, and ready to restore essential operations (NCSC, 2026).
Example:
A small charity backed up files to an external hard drive — but never tested restoring them. When the drive failed, they lost everything. Testing backups quarterly prevents this.
A backup you haven’t tested is just a theory.
Intelligencia emphasises that regular backups remain one of the most effective defences against ransomware, which continues to disrupt UK organisations across healthcare, education and private sectors (Intelligencia, 2026f).
UKGI stresses the importance of maintaining tested backups and recovery procedures for critical OT systems, ensuring organisations can restore operations quickly following disruption (UKGI, 2026g).
The NCSC guidance reported by Computing.co.uk also stresses the importance of maintaining tested and ransomware‑resistant backups for OT systems, ensuring organisations can restore operations quickly following disruption (Computing, 2026e).
8. Non‑OT Organisations Are Still at Risk
The NCSC notes a “broader pattern of disruptive cyber activity targeting internet‑exposed systems and edge devices affecting all sectors” (NCSC, 2026).
Example:
A poorly configured router with remote management enabled is enough to give attackers a foothold — even if you don’t use OT at all.
If it’s online, it’s a target.
Additional context from the National Preparedness Commission reinforces this trend. They highlight that attackers increasingly exploit “unpatched services, misconfigured interfaces, and insecure remote‑access points” to gain footholds and pivot deeper into networks (NPC, 2026). This aligns directly with the NCSC’s warning that internet‑facing systems and edge devices remain a prime target across all sectors — not just OT environments. For SMEs, this means even everyday equipment like routers, cloud dashboards, and remote‑access tools can become entry points if left exposed or unpatched.
Additional reporting from Security Matters reinforces the wider threat picture. The NCSC notes that disruptive cyber activity is now being carried out by both state and non‑state actors, affecting organisations in Critical National Infrastructure (CNI) and non‑CNI sectors alike (Security Matters, 2026). Set against increased geopolitical instability and rapid growth in offensive cyber capability, the NCSC assesses that the threat from state‑driven cyber activity “has almost certainly increased”. As a result, it states that it is now “essential” for all organisations to take action immediately — not only those operating OT environments. This broader context highlights why visibility of internet‑exposed systems, secure configuration, and timely patching are critical for every organisation, regardless of size or sector.
The National Preparedness Commission highlights that disruptive cyber activity is affecting organisations across all sectors, not just those operating OT environments. Internet‑exposed systems and edge devices remain prime targets because misconfigurations and unpatched services provide easy access points for attackers (NPC, 2026d).
Secarma reports that perimeter devices such as routers, VPN appliances and firewalls remain some of the most common initial access vectors in serious incidents (Secarma, 2026d). These systems are frequently overlooked during routine security reviews, despite being directly reachable from the internet.
V4One reports that attackers increasingly use third‑party integrations and cloud‑connected applications as routes into organisations, even when core systems are not directly exposed (V4One, 2026c). This demonstrates that internet‑facing risk extends beyond OT and perimeter devices to include connected platforms and supplier ecosystems.
Phishing remains the most prevalent attack type, affecting 38% of UK businesses, demonstrating that internet‑exposed systems and cloud‑connected platforms continue to be targeted across all sectors (CSBS, 2026e).
Computing.co.uk highlights that the NCSC has observed a broader pattern of disruptive cyber activity targeting internet‑exposed systems and edge devices across all sectors, not just industrial environments (Computing, 2026f). The risk is increasing due to geopolitical tensions and the rising willingness of states to use cyber capabilities offensively.
Elmdale’s analysis shows that SMBs are frequently used as stepping stones in supply‑chain attacks, where cybercriminals compromise a smaller provider to reach larger organisations (Elmdale, 2026e). This demonstrates that internet‑exposed systems pose a risk even for businesses without OT environments.
The House of Commons Library notes that cyber threats come from a wide range of actors — including state‑sponsored groups, criminal organisations and hacktivists — and increasingly target organisations across all sectors (UK Parliament, 2025e). This aligns with the NCSC’s assessment that internet‑exposed systems remain a prime target regardless of industry.
9. Senior Management Responsibility Is Increasing
Richard’s correction is important: cyber security has always been a senior management responsibility. The upcoming Cyber Security and Resilience Bill (2026) will make this explicit, placing accountability firmly on leadership.
This aligns with the Cyber Resilience Pledge and the NCSC’s wider push for governance‑level responsibility.
Cyber Essentials supports this by giving organisations a structured, government‑backed baseline to demonstrate control.
V4One notes that UK cyber regulation is evolving, with the Cyber Security and Resilience Bill proposing expanded oversight across essential services and technology providers (V4One, 2026d). This reinforces the need for senior leadership to take ownership of cyber resilience, governance and incident reporting obligations.
The Cyber Security Breaches Survey reports that while cyber security is considered a high priority for senior management in 72% of businesses, only 31% have formal board‑level responsibility assigned (CSBS, 2026f). This gap highlights why governance reforms are placing greater accountability on leadership.
Parliamentary analysis highlights that the UK’s National Cyber Strategy aims to shift the burden of cybersecurity from individuals to organisations “best placed” to manage cyber risks (UK Parliament, 2025f). The Cyber Security and Resilience Bill will expand statutory responsibilities, strengthen incident reporting requirements and increase regulatory oversight for essential services and digital providers.
10. Build Long‑Term Cyber Resilience
The NCSC encourages organisations to prepare before incidents occur and register for the Early Warning service (NCSC, 2026).
For SMEs, long‑term resilience means:
Knowing what you have
Keeping it updated
Monitoring it
Segmenting it
Backing it up
Responding quickly
Cyber Essentials remains “an excellent first step” for organisations that don’t need the full Cyber Assessment Framework (NCSC, 2026).
Additional international analysis reinforces the importance of tested recovery arrangements as part of long‑term resilience. The Royal Australian Air Force summarises the NCSC’s guidance by noting that misconfigurations, legacy connections and unmanaged assets can unintentionally expose systems to hostile access — and that resilience depends on having asset inventories, network separation, secure protocols, monitored connectivity and tested recovery procedures in place before real‑world disruption occurs (RAAF Runway, 2026). This perspective aligns with the NCSC’s emphasis on preparation: organisations must be able not only to prevent incidents, but also to restore operations quickly and safely when they happen.
The RAAF further highlights that tested recovery arrangements are vital for long‑term resilience, ensuring organisations can restore operations quickly and safely following disruption (RAAF, 2026e). Their analysis aligns with the NCSC’s emphasis on preparation: resilience depends not only on preventing incidents, but on being able to recover from them effectively.
UKGI reiterates the NCSC’s recommendation that organisations register for the Early Warning service to identify publicly exposed vulnerabilities and other issues affecting internet‑facing systems (UKGI, 2026h). This forms part of a broader resilience strategy that includes asset inventories, secure configuration and tested recovery arrangements.
The NPC update reinforces that long‑term resilience depends on reducing unnecessary internet exposure, hardening edge infrastructure and maintaining disciplined patching and monitoring routines. These measures significantly reduce the likelihood of attackers gaining footholds through exposed systems (NPC, 2026e).
Secarma’s findings reinforce the need for disciplined patching, secure configuration and regular attack‑surface reviews. When edge devices are excluded from patch management or left internet‑accessible unnecessarily, they become reliable footholds for attackers (Secarma, 2026e).
V4One emphasises that patching alone is not always enough, particularly where zero‑day vulnerabilities may have already been exploited before fixes are available (V4One, 2026e). A proactive resilience strategy requires organisations to investigate for signs of compromise, review supplier dependencies and test incident response plans regularly.
The NCSC advises organisations to establish baseline cyber security practices — including secure configuration, access management and keeping systems up to date — as part of reducing exposure to highly disruptive cyber attacks (NCSC‑REA, 2026f). These measures form the foundation of long‑term resilience and reduce the likelihood of attackers gaining an initial foothold.
Elmdale notes that modern threats are becoming more sophisticated, with AI‑generated phishing emails and deepfake voice scams making detection harder for small businesses (Elmdale, 2026f). A proactive resilience strategy — including training, patching, monitoring and tested backups — is essential for reducing exposure.
Final Thoughts
The NCSC’s message is clear: internet‑exposed systems are being targeted more aggressively, and organisations of all sizes need to act now. The good news is that most of the recommended actions are straightforward and affordable.
Defence‑sector analysis from the RAAF underscores that misconfigurations, legacy connections and unmanaged assets remain persistent exposure pathways. Addressing these issues through asset inventories, secure protocols, monitored connectivity and tested recovery arrangements is essential for every organisation — not just those operating OT environments (RAAF, 2026f).
UKGI’s regulatory update underscores that misconfigurations, legacy connections and unmanaged assets remain persistent exposure pathways across UK organisations. Addressing these issues through secure configuration, segmentation, monitoring and tested recovery procedures is essential for reducing the risk from internet‑exposed systems (UKGI, 2026i).
V4One’s September analysis shows that cyber threats are moving quickly, with supply‑chain disruption, rapid exploitation of vulnerabilities and increased targeting of OT all contributing to operational risk (V4One, 2026f). A proactive approach to understanding technology, controlling access and maintaining resilience is essential for reducing exposure to internet‑facing threats. The high-profile events that have reached the media in October shows that these dangers are very real.
If you’re unsure whether your systems are exposed or how to reduce your risk, Regola can help you take practical steps — without overcomplication.
Reference list
Clark, A. (2024). Cybersecurity in the UK. [online] House of Commons Library. Available at: https://commonslibrary.parliament.uk/research-briefings/cbp-9821/ [Accessed 5 Oct. 2026].
Department for Digital, Culture, Media and Sport (2026). Cyber security breaches survey 2025/2026. [online] GOV.UK. Available at: https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026 [Accessed 5 Oct. 2026].
Elmdale IT Services Ltd. (2025). Why cybersecurity is now critical for UK small and medium businesses - Elmdale IT Services Ltd. [online] Available at: https://www.elmdaleit.co.uk/latestnews/why-cybersecurity-is-now-critical-for-uk-small-and-medium-businesses/ [Accessed 5 Oct. 2026].
Intelligencia Training (2025). UK cyber risks: What you need to know. [online] Intelligencia Training. Available at: https://www.intelligenciatraining.com/uk-cyber-risks-what-you-need-to-know/ [Accessed 5 Oct. 2026].
Leonard, J. (n.d.). NCSC: ‘Disruptive cyber activity’ means all organisations should check for OT vulnerabilities. [online] Computing.co.uk. Available at: https://www.computing.co.uk/news/2026/security/ncsc-disruptive-cyber-activity-means-all-organisations-should-check-for-ot-vulnerabilities [Accessed 5 Oct. 2026].
National Cyber Security Centre. (2026a). 2. Reducing exposure to attack. [online] Available at: https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/reducing/2-reducing-exposure-attack [Accessed 5 Oct. 2026].
National Cyber Security Centre. (2026b). Disruptive cyber activity highlights risk from internet-exposed systems and EDGE devices. [online] Available at: https://www.ncsc.gov.uk/news/disruptive-cyber-activity-highlights-risk-from-internet-exposed-systems-and-edge-devices [Accessed 22 Sept. 2026].
National Prepardeness Commission. (2026). NCSC: Cyber activity on internet-exposed systems and edge devices. [online] Available at: https://nationalpreparednesscommission.uk/news/ncsc-cyber-activity-on-internet-exposed-systems-and-edge-devices/ [Accessed 22 Sept. 2026].
Secarma Ltd. (2026). NCSC warns organisations to review internet-exposed systems after disruptive cyber activity - secarma: Penetration testing and cybersecurity company. [online] Available at: https://secarma.com/28-08-2026-ncsc-edge-devices-internet-exposed-systems [Accessed 22 Sept. 2026].
The Runaway Air Force. (2026). Disruptive cyber activity highlights risk from internet-exposed systems and edge devices. [online] Available at: https://runway.airforce.gov.au/disruptive-cyber-activity-highlights-risk-from-internet-exposed-systems-and-edge-devices.
Ukgigroup.com. (2026). NCSC highlights cyber risk from internet-exposed systems and EDGE devices | UKGI - aviva. [online] Available at: https://abc.ukgigroup.com/ncsc-highlights-cyber-risk-from-internet-exposed-systems-and-edge-devices/ [Accessed 22 Sept. 2026].
V4one.co.uk. (2026). UK cyber security: The key threats and lessons from september 2026. [online] Available at: https://www.v4one.co.uk/blog/UK-Cyber-Security-The-Key-Threats-and-Lessons-from-September-2026 [Accessed 5 Oct. 2026].
