By Lisa Ventura MBE FCIIS, Chief Executive and Founder, AI and Cyber Security Association (AICSA)
On 3 October 2026, the National Cyber Security Centre (NCSC) marked 10 years since it opened its doors. The milestone gave me a chance to reflect on what has changed for UK cyber security, what the NCSC has added and where we still have work to do together.
Looking Back
I came into cyber security from journalism and broadcasting over 17 years ago, when I joined my ex-wife’s company, Titania Ltd. Back then, getting a single view from government on cyber security was hard work. You’d find yourself chasing CESG, CERT-UK, CPNI and individual departments, and you’d often get a different answer from each one. Organisations faced the same problem. When something went wrong, nobody knew who to contact for help.
The NCSC changed this. For the first time, industry, the public and the media had one place to turn. I don’t think we give enough credit for how much difference a single front door has made.
What I’ve Loved Seeing
The NCSC started speaking to people in plain English. Guidance such as the 10 Steps to Cyber Security and the Small Business Guide is written for real people, not security specialists. When the NCSC told organisations to stop forcing regular password changes, I cheered. A government body admitting old advice no longer worked was a brilliant step forward.
I had many conversations with Ciaran Martin, the NCSC’s first CEO, after I founded the UK Cyber Security Association in 2015. He supported my work back then, and he still supports what I do in the industry today.
The shift I value most as a security awareness practitioner is how the NCSC stopped blaming people for incidents. For years, our industry called users the weakest link. The NCSC’s work on the human side of security showed people become part of the defence when you design systems and training around how they work. This approach has shaped how I run awareness programmes. I see the difference in how people respond when you treat them with kindness and respect, and when your organisation adopts a no-blame culture after something goes wrong.
I’ve also loved watching CyberFirst bring young people, and so many girls, into the field. Free services such as the Suspicious Email Reporting Service, Exercise in a Box and Early Warning have given smaller organisations help they’d never have afforded otherwise.
Where There’s Still Work to Do
I want to be honest here, because I hope the NCSC would want me to be. Its mission has always been to make the UK the safest place to live and work online, and I don’t think we’re there yet. This isn’t the NCSC’s fault. Attackers keep growing more sophisticated, and all of us struggle to keep pace, especially now AI has entered the mix. This is why I founded the AI and Cyber Security Association, to promote and champion the safe, secure, responsible and ethical use of AI.
Small businesses worry me most. The guidance is there, but it isn’t reaching them. Where it does, many owners still bury their heads in the sand about the growing cyber risk to their livelihoods. I still meet small business owners who have never heard of the NCSC or Cyber Essentials, and they’re the ones least able to recover from an attack.
The NCSC advises, but it has no power to make anyone act. Ten years of excellent guidance hasn’t led to consistent action in the boardroom, and legislation has been slow to catch up with the threat.
Diversity in our industry has moved forward, but too slowly. Women, neurodivergent people and those from under-represented backgrounds remain a small part of our workforce. Through Neuro Unity, which I founded to champion neuroinclusion, I see how much neurodivergent talent our industry misses out on. We won’t close the skills gap until we close the diversity gap.
Looking Ahead
AI will shape the next 10 years. Attackers already use it to find weaknesses faster than ever before. Through the AICSA, I see organisations rushing to adopt AI without stopping to think about how to secure it. The NCSC has shown real leadership on secure AI guidance. My hope for the next decade is for its guidance to reach the sole trader as easily as it reaches the FTSE 100.
“When I started out, nobody knew who to call when a cyber attack hit. The NCSC changed that, and I’m grateful for everything the team has built over 10 years. The next chapter needs to be about reaching sole traders, small businesses and the people who need help the most, and reaching them before a cyber attack happens rather than after one.”
Happy 10th birthday to everyone at the NCSC. Here’s to the next decade.
To find out more about the AICSA and our work on the safe, secure, responsible and ethical use of AI, visit www.aisec.org.uk.
