The NCSC Annual Review 2026, the patch wave and Gartner’s WISE

Secure by design starts at the endpoint. Gartner®’s WISE model shows how a smaller, immutable footprint can reduce attack surface, configuration drift, and the growing patching burden.

The National Cyber Security Centre (NCSC)’s Annual Review 2026 repeatedly returns to two themes:

1. Prevention as a security strategy: security must be designed into technology and architecture from the outset, preventing whole classes of weakness rather than managing their consequences later.
2. Patching remains essential: but an approach based solely on discovering and patching every flaw cannot keep pace with machine-speed vulnerability discovery.

Gartner’s WISE model: prevention at the endpoint

In February 2026, Gartner published a paper which may have passed you by. Titled ‘Use Immutable Endpoints to Defeat Ransomware, Stop Configuration Drift, and Guarantee Rapid Recovery’, it describes endpoints as “an organization’s most fragmented, porous surface” and recommends the Workspace Immutable Secure Endpoint (WISE) model as a way to reduce attack vectors by moving away from persistent, mutable endpoints.

If you haven’t read this paper, and if you’ve put in the time to read the NCSC Annual Review, it’s certainly worth a few more minutes. It lays out challenges which will be entirely familiar to any desktop administrator.

• Mutable desktops drift out of compliance, as many as one in five at any given point in time.
• The more software installed locally, the larger the attack surface. How big is your endpoint image? What’s in it that isn’t being utilized?
• The larger the attack surface, the more there is to patch.
• Security becomes overly dependent on complex on-device agents, which bring their own management, patching, compliance drift, etc.

The Gartner paper discusses and proposes solutions for exactly the key challenges being pointed out in the NCSC Annual Review. Now admittedly, this paper is only proposing a solution for one element in the overall architecture stack: the endpoint. But when the endpoint is cited as the organization’s “most fragmented, porous surface”, it’s something that we need to rethink.

Reducing the attack surface by design

Without giving it all away, the theme of the paper is that a minimal, immutable, rather than mutable, endpoint footprint reduces the attack surface of the endpoint device, its ‘porosity’.

Immutability also adds a complementary control: protecting the operating-system foundation against unauthorised change and configuration drift. In other words, it applies prevention as a critical element of defence rather than relying entirely on complex agents. Together, they can reduce exposure, restrict persistence, and simplify restoration to a known-good state.

Patching, of course, remains essential. As I discussed in my response to the NCSC’s patch-wave warning, reducing local software reduces what needs maintaining. With modular delivery, that can mean smaller targeted updates, faster deployment, and less device downtime. Of course, those outcomes depend on the implementation.

Read the earlier article.

What NHS customers are seeing

In conversations with NHS customers, the dramatic increase in patch size that has happened since NCSC CTO Ollie Whitehouse’s May 2026 article is already driving change. In conversation, one NHS Trust described to me a clear difference between its clinical and non-clinical estates. Clinical devices using immutable endpoints were receiving the benefits of the WISE architecture, while conventional mutable endpoints used by non-clinical teams were being taken offline for updates for an unacceptable length of time.

This led the Trust to reassess which users genuinely needed a conventional desktop. Those accessing primarily browser-based workloads, including Microsoft 365 and other digital workspace services, could instead be moved to immutable endpoints.

Make persistent mutability the exception

The NCSC’s review calls for secure-by-design foundations that prevent avoidable weakness and limit the impact of what remains. Gartner’s WISE research gives that principle a practical endpoint application: make persistent mutability the justified exception, not the default.

Apply least privilege to endpoint functionality: provide the capabilities required to do the work, and no more. A smaller, more modular local footprint means less software to expose, configure, patch, and restore. It can reduce the scope of endpoint change, help organisations deploy updates with less disruption, and extend the useful life of existing hardware.

Patching remains essential. But reducing the patching burden starts with reducing what needs to be patched.

Download the Gartner report from IGEL

Read the NCSC Annual Review 2026