NCSC's 'Tech on the Cheap' Warning: Retiring Old IT Equipment Safely

On 3 November 2026 the National Cyber Security Centre published its State of the Cyber Nation report, and its chief executive, Dr Richard Horne, said in prepared remarks that "for decades, we have collectively got away with doing tech on the cheap". The report is about AI-powered attacks. It does not mention disposal or decommissioning, so this piece looks at the question it leaves open: what should happen to the old equipment once you replace it?

It sets out what the NCSC said, what it said about out-of-date technology, what it did not say, and a short list for the retirement step that follows a replacement decision.

What the NCSC said on 3 November

The announcement says the UK's critical national infrastructure "should be braced for a ransomware attack involving AI-powered malware by 2028". It adds that hostile actors' use of AI is "highly likely" to increase the scale and efficiency of their operations over the next two years. That is a forecast, not an event.

The speech remarks published with the announcement put the cause somewhere less dramatic. The risk is not that AI has invented new attacks, but that "vulnerabilities that have been tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable". Dr Horne is set to urge organisations to make different choices, including addressing the failure to invest in their technology, not having technology unnecessarily connected to the internet, and treating Cyber Essentials as the starting point rather than the end goal.

What the report says about old technology

The report says AI "did not create these cyber security weaknesses; it revealed them", and points to years of technical debt. It says organisations with "weaker security postures, legacy technology and limited resources" may struggle to keep pace with AI-assisted attacks. Most successful compromises, it says, still rely on familiar methods: threat actors "routinely exploited known vulnerabilities in internet-facing systems". Of the incidents linked to state or state-aligned actors, it says many involved vulnerabilities for which patches were available but had not been deployed in a sufficiently timely fashion.

It also gives a direction. As organisations invest in technology to adopt AI, the report says, they have the opportunity to "refresh their technology and build proper full-life maintenance regimes".

The sharper statement is in an earlier blog by the NCSC's Chief Technology Officer, published on 1 May 2026, about an expected "patch wave". It says patching will not always be enough, because some technical debt "may be present in 'end of life' or legacy technology that is out of support, and so can't receive updates". In those cases organisations "will need to replace technologies, or bring them back within support, especially where it presents an external attack surface".

What the NCSC did not say

We searched the full text of the report. It does not mention disposal, decommissioning or data erasure. It does not link any named incident to forgotten or discarded equipment. The 2028 date is a forecast, and the NCSC's wording is probabilistic. Everything in the next section is our reading, and the NCSC has not endorsed it.

Where retirement fits

The NCSC's answer for kit that cannot be patched is to replace it. In our reading, replacing something creates a retirement event, and two things can go wrong there.

• The old device stays connected. It is crossed off the asset list but never unplugged, so it sits on the network unpatched, perhaps reachable from outside. That is the exposure Dr Horne's second choice describes.
• The old device leaves with data still on it. A router keeps its configuration and credentials, a laptop keeps its drive, and many copiers hold a hard disk.

Five steps follow from that. They are our suggestions, not NCSC advice.

1. List what is connected. You cannot retire what you have not counted. Our piece on GCHQ's unaccounted removable media covers why a register matters.
2. Record the end-of-support date for each item. Our articles on Windows 10 and Windows Server 2016 end of support cover two common examples.
3. Decide whether to replace or bring it back into support. That is the NCSC's own either/or. Do it before the date, not after.
4. Take retired kit off the network the day it is replaced. Reset or remove its credentials. Our article on retiring routers, firewalls and switches sets out the order, and the one on leased copiers covers the device people forget.
5. Erase the data and keep a record per device before it leaves. A bulk statement is weak evidence, as our piece on spotting a fake certificate of destruction explains.

For disclosure, we are an IT disposal company, so weigh the list above accordingly. Every NCSC quotation here can be checked against the pages linked in the text.

The honest summary

The NCSC says that unsupported technology cannot be patched, and that it should be replaced or brought back into support. It is silent on what happens next. If you are about to act on the first half of that advice, plan the second half too: take the old device off the network, then make sure its data goes before it does.