The UK’s National Cyber Security Centre delivered its starkest warning yet on 3 November 2026: British businesses face a “real prospect of an unprecedented rise” in cyber incidents in the coming months, yet many organisations remain what NCSC chief Richard Horne described as “willfully blind” to the threat.
Speaking at the launch of the NCSC annual review, Horne warned that the country was at a “sliding doors” moment as threats from Russia, Iran and China escalate, with businesses facing scenarios where “food isn’t on the shelves, when lights aren’t on, businesses have gone under.”
For Kent SMEs, this warning arrives alongside significant identity security improvements from Microsoft Entra in November 2026, offering a practical pathway to strengthen defences precisely when the threat landscape demands it most. Here’s what local businesses must do immediately to close critical identity and access control gaps before the predicted surge in attacks materialises.
Why the NCSC Chief Issued the “Willfully Blind” Warning Now
The NCSC annual report revealed that its incident management team received 1,831 reports of cyber attacks this year, of which 337 required support and 80 were nationally significant.
The warning came just days after
hackers remotely took control of refrigeration systems in supermarkets across Europe overnight from 1 to 2 November 2026, raising temperatures and spoiling tonnes of food, with at least 11 countries affected including the UK.
In the UK, the attacks reached small meat processing firms that were affected simply because they used the same software as European supermarkets.
The cyber attack on French supermarket fridges involved legacy technology connected to internet with default passwords.
This pattern—automated attacks exploiting basic security weaknesses rather than targeting specific businesses—is precisely why SMEs cannot assume they’re too small to be noticed.
Horne said that the UK is at risk because it has done “tech on the cheap” for decades,
a criticism that resonates particularly with resource-constrained SMEs that have deferred identity security investments. The refrigeration attacks demonstrated how businesses become collateral damage when foundational security controls—such as changing default passwords and securing remote access—are absent.
Microsoft Entra November 2026 Updates: New Identity Security Tools for SMEs
Against this backdrop,
Microsoft announced several new features for Microsoft Entra in November 2026, focusing on identity security, multifactor authentication (MFA), access management, and AI agent governance.
For Kent SMEs running Microsoft 365 or Azure services, these updates offer immediate opportunities to strengthen identity defences without significant capital investment.
New MFA and Passkey Improvements
Microsoft is continuing its push to move Entra ID users away from SMS authentication toward passkeys,
addressing a long-standing vulnerability in two-factor authentication. SMS-based codes can be intercepted through SIM-swapping attacks, whereas passkeys use cryptographic authentication tied to specific devices, making them significantly more resistant to phishing and man-in-the-middle attacks.
For Kent SMEs, this means reviewing current MFA configurations across all Microsoft 365 accounts and prioritising migration to passkey-based authentication for privileged accounts—including administrators, finance staff with payment authority, and anyone with access to customer data.
Continuous Access Evaluation with Device and Risk Signals
Continuous Access Evaluation (CAE) now incorporates device and risk signals, helping organisations respond to changes in security conditions.
This enhancement means that access decisions are no longer made once at sign-in and then trusted for the session duration. Instead, Microsoft Entra continuously evaluates the security posture of the device, user location, and behavioural risk throughout the session, revoking access immediately if conditions change—for instance, if a user’s device becomes compromised mid-session or if unusual activity patterns are detected.
Kent SMEs with hybrid working arrangements benefit particularly from CAE, as it addresses the challenge of users accessing company resources from home networks, coffee shops, and client sites where network security cannot be guaranteed.
AI Agent Governance and Identity Controls
The November 2026 update also focuses on AI agent governance,
building on Microsoft’s Execution Containers launch on 5 November 2026 which addressed the challenge of 89% of UK enterprises deploying AI agents without proper identity security. The new Entra features allow organisations to manage AI agent identities with the same rigour applied to human users, including scoped permissions, conditional access policies, and activity monitoring.
What Kent SMEs Must Do This Week
The convergence of the NCSC’s urgent warning and Microsoft’s identity security enhancements creates a clear action plan for Kent businesses:
1. Audit Current Identity Security Posture
- List all accounts with administrative privileges across Microsoft 365, line-of-business applications, network infrastructure, and cloud services
- Identify which accounts still use SMS-based MFA rather than passkeys or authenticator apps
- Review default passwords on all internet-connected systems, including IoT devices, network equipment, and industrial control systems (the refrigeration attacks prove these are now active targets)
- Document all third-party applications and services with access to company Microsoft 365 data
2. Enable Microsoft Entra’s Enhanced Security Features
- Activate Continuous Access Evaluation for all users, prioritising those with remote access requirements
- Migrate privileged accounts from SMS-based MFA to passkey authentication using the Microsoft Authenticator app
- Configure conditional access policies that require compliant devices and approved locations for access to sensitive data
- Enable Azure AD Identity Protection to leverage risk-based access decisions
3. Address the “Tech on the Cheap” Legacy
The NCSC chief’s criticism about doing “tech on the cheap” is a call to address deferred security investments. For Kent SMEs, this doesn’t necessarily mean large capital expenditure—many critical improvements involve configuration changes to existing Microsoft 365 subscriptions rather than purchasing new tools.
Review whether your current Microsoft 365 licensing tier includes the security features you need. Business Premium includes Microsoft Defender for Business, Intune device management, and advanced Entra ID features that many SMEs subscribe to but never fully deploy. Ensuring these existing capabilities are properly configured delivers immediate security improvements without additional cost.
4. Prepare for Supply Chain Security Questions
Following attacks like the refrigeration incidents, larger organisations are intensifying supply chain security requirements. Kent SMEs should expect more detailed security questionnaires in tender processes and contract renewals, particularly regarding identity and access management.
Consider pursuing Cyber Essentials certification, which remains available with a 75% discount under the £2.4 million government funding scheme announced 4 November 2026. Cyber Essentials explicitly addresses identity security controls, including MFA requirements and access control policies, aligning with both the NCSC guidance and Microsoft’s Entra enhancements.
5. Test Incident Response for Identity Compromise
With the NCSC predicting an unprecedented rise in incidents, Kent SMEs should test their response procedures for the most common identity-related attacks:
- Compromised user account: Can you identify unusual sign-in activity, revoke active sessions, reset credentials, and audit what data the attacker accessed?
- Phishing attack reaching multiple users: Can you quickly determine who clicked malicious links, what credentials they entered, and whether MFA prevented account takeover?
- Privileged account compromise: Do you have break-glass procedures for regaining control if an administrator account is compromised?
Microsoft Entra’s audit logs, sign-in reports, and risk detection features provide the visibility needed for effective incident response, but only if someone knows how to access and interpret them before an incident occurs.
The Strategic Context: China, AI, and Critical Infrastructure
The NCSC chief assessed that China “highly likely has the intent and is best positioned to use AI for operations against our critical national infrastructure and other strategic targets,”
representing what Horne called “the most sophisticated and sustained cyber challenge the U.K.” faces.
For Kent SMEs, particularly those in manufacturing, logistics, food supply, or supporting critical infrastructure, this assessment underscores why identity security cannot remain a deferred investment. State-sponsored actors increasingly use compromised SME networks as pivot points to reach larger targets in the supply chain. Strong identity controls—requiring MFA, limiting privileged access, monitoring for unusual activity—make your business a less attractive stepping stone.
Moving Beyond “Willfully Blind”
The NCSC chief’s warning about businesses remaining “willfully blind” is ultimately about the gap between understanding risk intellectually and taking concrete action.
Horne warned that when disruption occurs, “we may have to explain that we saw the warning signs, understood the risks and still didn’t make the right choices. Why we remained willfully blind.”
For Kent SMEs, closing this gap starts with identity security—the foundational control that determines who can access your systems, data, and operations. The Microsoft Entra November 2026 updates provide the tools; the NCSC warning provides the urgency; together, they create a clear mandate for action before the predicted surge in attacks begins.
The refrigeration attacks that reached UK meat processors weren’t sophisticated zero-day exploits—they succeeded through default passwords and unsecured remote access. That’s the encouraging news: the controls that defend against the most likely attacks are well understood, increasingly affordable, and now strengthened by Microsoft’s latest identity security features. What remains is implementation.
Need help auditing your identity security posture, configuring Microsoft Entra’s enhanced features, or preparing for Cyber Essentials certification? Meridian Micro supports Kent SMEs with practical security improvements that address real threats without unnecessary complexity. Call us on 01303 883111 to discuss your specific requirements and close identity security gaps before the predicted attack surge arrives.