Most UK business owners believe they are too small, too niche, or simply too unremarkable to be worth a cyber attacker’s time. The data tells a different story.

The UK government’s Cyber Security Breaches Survey 2025, published by DSIT, found that 43% of UK businesses experienced a cyber breach or attack in the past 12 months. That is approximately 612,000 businesses, a figure that has climbed consistently year on year.

If your IT setup is patched together with ageing hardware, a stretched internal team, and security that has not been reviewed recently, these statistics are not abstract. They describe your risk profile.

Here are the cyber security and IT statistics that every UK business owner should understand in 2026, with sources, not guesswork.

UK Businesses Are Being Hit at Scale

The headline from the DSIT 2025 survey is stark: 43% of UK businesses and 30% of charities reported a cyber breach or attack in the past year.

The rate increases sharply with business size. Among large enterprises, 74% experienced a breach. But even at the small business level — the segment most likely to assume they are safe — 42% were affected.

The most common attack type, by a significant margin, is phishing. 85% of businesses reported at least one phishing attack in the past year. Phishing requires almost no technical skill from the attacker. A convincing email, a cloned login page, and an employee who clicks at the wrong moment is all it takes.

These are not sophisticated nation-state operations targeting FTSE 100 companies. They are largely automated, opportunistic attacks that work because so many businesses leave the door open.

Ransomware Is Rising and UK SMBs Are Paying

Ransomware used to be considered a problem for larger organisations. That is no longer the case.

The DSIT 2025 survey found that just over 1% of UK businesses experienced a ransomware attack — more than double the rate recorded in the previous year’s edition. That figure sounds small in isolation. Across the UK business population, it represents tens of thousands of companies.

Research by Censornet, which surveyed 200 UK IT and security leaders in 2024, puts the SMB figure higher still: 1 in 5 UK SMBs (20%) said they had been hit by ransomware.

When ransomware strikes, the financial impact is severe:

  • 34% of UK ransomware victims paid the ransom, at an average cost of £139,368
  • 41% of affected SMBs took systems completely offline to contain the attack
  • 39% lost data as a direct result of the attack

Payment does not guarantee recovery. It funds the next attack and marks your business as one willing to pay.

The Financial Cost of a Cyber Incident

Calculating the cost of a cyber attack depends on how disruptive the incident was and whether any recovery was needed.

DSIT’s 2025 data puts the average cost of the most disruptive breach at £8,260 for businesses where an outcome was recorded. For incidents that were contained without significant impact, the average was £1,600.

Those figures cover direct costs: incident response, recovery, and remediation. They do not capture lost revenue during downtime, reputational damage, or the long-term cost of losing customer data.

On the downtime question, the picture is more alarming. UK businesses lost £3.7 billion to internet outages in 2023, across more than 8.8 million reported failures totalling 50.5 million hours of disruption. Industry estimates put the cost of serious IT downtime at £11,000 per minute for a business of any meaningful size, with 92% of UK businesses taking 24 hours or more to fully recover from a major outage.

Prevention costs a fraction of recovery. That ratio is why managed IT support exists.

Most UK Businesses Are Underprepared

The DSIT 2025 survey does not only show how often businesses are attacked. It shows how little most of them have done to protect themselves.

Consider these figures:

  • Only 40% of UK businesses use multi-factor authentication (MFA) — one of the most effective and lowest-cost defences available
  • Only 19% have a formal cybersecurity training or awareness programme for staff
  • Only 27% have board-level responsibility assigned for cybersecurity, down from a high of 38% in 2021
  • Only 12% of businesses are even aware of Cyber Essentials, the government-backed certification scheme

The controls that most businesses do have in place — firewalls (72%), malware protection (77%), password policies (73%) — are basic hygiene measures that represent a minimum baseline, not a security posture. They stop the least sophisticated attacks. They do not stop phishing, credential theft, or targeted ransomware.

IT Teams Are Stretched to Their Limit

Behind many of these vulnerabilities is a resource problem. UK SMBs do not have large IT departments.

The Censornet 2024 research found that the average UK SMB security team consists of just 2.63 people. Those same teams are receiving an average of 815 cybersecurity alerts every day — a 37% increase since 2023.

At that volume, each analyst has roughly 87 seconds to assess and respond to each alert. The result is predictable: only 60% of alerts are fully investigated.

Even before factoring in security alerts, IT teams are already spending the majority of their time on reactive work. A 2024 Splashtop study of IT professionals found that endpoint maintenance alone accounts for 53% of IT team time on average, leaving less than half available for anything strategic, including security review, disaster planning, or infrastructure improvement.

When your IT team is running to stand still, the gaps widen. Patch delays, missed alerts, and deferred upgrades are not the result of incompetence. They are the result of understaffing.

What These Statistics Mean for Your Business

None of this is intended to alarm you into paralysis. It is intended to give you an accurate picture of where UK businesses stand in 2025, so you can make informed decisions about your IT.

The businesses that avoid serious incidents tend to have a few things in common: up-to-date systems, active monitoring, a tested backup and recovery process, and someone accountable for keeping all of that running.

For most SMBs, maintaining all of that internally — at the level required — is not realistic. The team is too small, the knowledge gaps are too wide, and the volume of threats is too high.

That is the gap a managed service provider fills. Not as a replacement for your internal team, but as the capability layer that makes 87-second alert windows and 2.63-person security teams a manageable reality rather than a structural failure waiting to happen.

If you want to understand where your business stands against the risks outlined above, speak to the Arc Systems team. We work with businesses across Essex and the UK to identify vulnerabilities, close the obvious gaps, and put the right support in place before an incident forces the conversation.

Sources:
DSIT Cyber Security Breaches Survey 2025 | Censornet 2024 UK SMB Cybersecurity Research | Wavenet: The True Cost of Downtime for UK Businesses | Splashtop IT Maintenance Research 2024