Cyber Security Breaches Survey 2026: What the Numbers Say About UK Small Businesses
The government published this year's Cyber Security Breaches Survey on 30 April 2026. It is the one piece of UK cyber security research we trust without much argument, because Ipsos interviewed a random sample of 2,112 businesses between August and December 2025 and weighted the answers to match the whole business population. Most other cyber security statistics are published by vendors with a product to sell.
Most of the coverage repeats the same headline: 43% of UK businesses identified an attack or breach in the last year. That number is true, and it is close to useless for a business with twenty staff, because it averages a nine person accountancy practice with a FTSE 100 bank. The survey itself splits nearly every question by size, so we went back to the published data tables and pulled out what they say about micro businesses (1 to 9 staff), small businesses (10 to 49) and medium businesses (50 to 249), which is where nearly all of our clients sit.
A note on the name before we start. The report's official title is the Cyber Security Breaches Survey 2025/2026, because the department changed its labelling this year to show the fieldwork period as well as the publication year. It is the same annual survey everyone calls the 2026 edition, and that is what we call it below.
The numbers that matter if you run a 10 to 50 person business
If you only read one part of this article, read this table. Every figure is for small businesses (10 to 49 staff) unless it says otherwise, and every one is explained further down.
| Figure | What it tells you |
|---|---|
| 46% | Identified at least one attack or breach in the year. For medium businesses it was 65%, and the difference is mostly about who is watching. |
| 40% | Were phished. 17% had someone impersonate the business or its staff. Ransomware reached 2%. |
| 26% | Of those hit were seeing attacks weekly or more often. Half were seeing them at least monthly. |
| £0 | Typical cost of the most disruptive incident. Where something was actually lost, the typical cost was £560 and one in ten cost £10,000 or more. |
| 58% | Require two factor authentication on anything. 39% have a policy to install security updates within 14 days. |
| 36% | Have a formal incident response plan. A third have none of the five incident measures the survey asks about. |
| 64% | Use an outside provider for cyber security, the highest share of any size band apart from medium businesses. |
| 25% | Of the people responsible for cyber security did not know whether the business had any insurance cover for an attack. |
How many UK businesses were attacked, by size
Just under half of small businesses, 46%, identified at least one attack or breach in the twelve months before they were interviewed. For medium businesses the figure jumps to 65%, and for large ones to 69%.
| Business size | Share | Percentage |
|---|---|---|
| Micro (1 to 9 staff) | 42% | |
| Small (10 to 49 staff) | 46% | |
| Medium (50 to 249 staff) | 65% | |
| Large (250 or more staff) | 69% | |
| All businesses | 43% |
Source: Cyber Security Breaches Survey 2025/2026, GOV.UK, Figure 4.1 and data table 28. Base: 2,112 UK businesses.
Read that chart carefully, because the obvious lesson is the wrong one. Smaller businesses are not attacked less often. They notice less. The report says as much: lower prevalence among micro and small businesses "may indicate poorer identification and reporting practices in smaller organisations as they may have less sophisticated cyber security monitoring in place". The data tables support that. 30% of micro businesses and 38% of small ones used any kind of security monitoring tool in the last year. For medium businesses the figure was 56%, and for large ones 71%. Nearly half of micro businesses, 48%, took no steps at all to identify cyber risks. Much of the difference in the chart above is a difference in monitoring.
The headline rate has been flat for two years. It was 50% in the 2024 edition, 43% in 2025 and 43% again this year. One change among small businesses did reach statistical significance: phishing fell from 49% two years ago to 40% now. We would not read much into a single year of that.
Sector matters almost as much as size. Information and communication businesses reported the most attacks (63%), followed by professional, scientific and technical firms (54%). Retail and wholesale (31%) and hospitality (33%) reported the fewest. If you run an accountancy practice, a law firm, a recruitment agency or a software business, you are in the group that reports the most attacks, and also the group most likely to spot them.
What kind of attacks small businesses faced
Phishing is nearly the whole story for a small business. Of the 46% of small businesses that identified anything, 40 points of that was phishing, and 24% of all small businesses saw phishing and nothing else. Among businesses of any size that were hit, 88% had been phished.
| Type of attack or breach | Micro | Small | Medium | Large |
|---|---|---|---|---|
| Phishing emails or fake websites | 37% | 40% | 60% | 63% |
| Someone impersonating the business or its staff | 10% | 17% | 38% | 47% |
| Viruses, spyware or other malware | 7% | 7% | 12% | 23% |
| Hacking or attempted hacking of online bank accounts | 4% | 2% | 3% | 5% |
| Denial of service attacks | 3% | 2% | 5% | 9% |
| Takeover attempts on website, social media or email accounts | 2% | 3% | 5% | 5% |
| Ransomware | 1% | 2% | 3% | 7% |
| Totals | ||||
| Any attack or breach | 42% | 46% | 65% | 69% |
| Phishing and nothing else | 22% | 24% | 18% | 13% |
Source: Cyber Security Breaches Survey 2025/2026, data table 28. Respondents could pick more than one type, so the columns do not add up.
Two things in that table change as a business grows. Impersonation, where someone emails your customers or your staff pretending to be you, goes from 10% of micro businesses to 38% of medium ones. Ransomware stays rare at every size: 1% of all businesses this year, down from 3% in each of the two previous years, and 2% of small businesses. Ransomware can still stop a business for a week, so it should stay on the list, but phishing should come first.
Phishing was also what businesses called their most disruptive incident, by a wide margin. 70% of micro businesses and 68% of small ones named it. Only 53% of large businesses did, because they were more likely to pick impersonation. When the survey asked why, the most common answer was staff time spent investigating (21%), then time taken for training (12%) and downtime while people checked what had happened (12%). Two thirds of businesses said none of the offered reasons fitted, so the survey is still missing part of the picture here, and to its credit it says so.
The attacks are also frequent. Among small businesses that identified anything, a quarter saw an attack weekly or more often.
| Frequency | Share | Percentage |
|---|---|---|
| Once in the year | 23% | |
| More than once, less than monthly | 27% | |
| Roughly once a month | 24% | |
| Weekly or more often | 26% |
Source: Cyber Security Breaches Survey 2025/2026, data table 31. Base: 237 small businesses that identified a breach or attack. "Weekly or more often" combines roughly weekly (14%), roughly daily (5%) and several times a day (7%).
Half of the small businesses that were hit were seeing attacks at least monthly. In practice that means a regular flow of fake invoices, fake Microsoft sign-in pages and fake messages from the managing director, and each one costs somebody ten minutes to check.
What an attack cost a small business
This is the section most write-ups get wrong, so we will explain it in full.
The survey asks each business that was hit to estimate the total cost of its most disruptive incident: money paid out during and after, staff time, and damage or disruption. This year the department stopped publishing the average, because a handful of very large losses were distorting it and risked identifying respondents. Instead it publishes the median and the spread. For micro and small businesses, that gives the table below.
| Point in the range | Everyone who identified an attack | Only those who reported any cost | Only those who lost something |
|---|---|---|---|
| Typical case (median) | £0 | £200 | £560 |
| Middle half of cases | £0 to £190 | £50 to £1,000 | £60 to £3,000 |
| Worst 10% | £1,140 or more | £4,150 or more | £10,000 or more |
| Worst 5% | £4,000 or more | £8,300 or more | £14,440 or more |
| Businesses in the base | 680 | 310 | 122 |
Source: Cyber Security Breaches Survey 2025/2026, tables 4.1a, 4.1b and 4.2a. "Lost something" means the attack had a material outcome such as lost money, data or access. Costs are what respondents estimated, including staff time.
The median is £0. That is the number that matters most and the one that gets quoted least, because "the typical attack cost nothing" does not sell anything. It reflects the fact that most attacks are blocked or ignored. Only 19% of businesses that identified an attack suffered a material outcome such as lost money, lost data or lost access, and 72% said getting back to normal took no time at all.
The right hand column is the one to plan around. Where a small business did lose something, the typical cost was £560, the middle half of cases ran from £60 to £3,000, and one in ten cost £10,000 or more. One in twenty cost £14,440 or more. Those are the incidents that typically lead a business to contact us: a mailbox compromise that went unnoticed for three weeks, or a change of supplier bank details that nobody verified by phone.
There are two costs the headline table does not show. Fraud that followed a cyber attack hit 3% of businesses, around 43,000 across the UK. Among them the median loss was £110 including those who lost nothing, £500 among those who lost anything, and the worst 10% lost £12,000 or more. Phishing (45%) and online bank account hacking (40%) were the most common starting point. And the survey counts staff time only where the respondent remembered to include it, which in our experience they rarely do for the frequent low-level attacks described above.
Recovery is getting slower at the smallest end. The share of micro businesses back to normal within a day fell from 92% in each of the two previous editions to 86% this year, and 2% took a month or more. Businesses reporting lost revenue rose from 2% to 5%, and reputational damage from 1% to 3%. The authors describe this as the wider impact of attacks growing even while the headline rate stays flat, and that matches what we see.
Which security controls small businesses are missing
The most useful part of the survey for a small business is the list of basic controls, because the answers by size show exactly which controls a 10 to 49 person business is most likely to be missing.
| Control | Micro | Small | Medium | Large |
|---|---|---|---|---|
| Up to date malware protection | 80% | 85% | 91% | 93% |
| Firewalls covering the network and each device | 72% | 82% | 89% | 93% |
| Admin rights limited to named people | 69% | 86% | 96% | 96% |
| Cloud backup | 73% | 80% | 84% | 79% |
| Security controls on company laptops and phones | 57% | 79% | 90% | 91% |
| Agreed process for reporting a suspicious email | 54% | 72% | 86% | 94% |
| Two factor authentication on anything | 43% | 58% | 79% | 90% |
| Separate Wi-Fi for staff and visitors | 33% | 53% | 80% | 85% |
| VPN for remote staff | 32% | 48% | 72% | 72% |
| Policy to install security updates within 14 days | 32% | 39% | 56% | 73% |
| Monitoring of user activity | 29% | 46% | 68% | 82% |
Source: Cyber Security Breaches Survey 2025/2026, data table 15. Base: 1,154 micro, 507 small, 296 medium and 155 large businesses.
The first four rows are widely adopted at every size. Antivirus, firewalls, backups and limited admin rights are what most businesses bought years ago. Adoption falls from the fifth row onwards. Only 58% of small businesses require two factor authentication on anything, against 79% of medium businesses, and 39% have a policy to install security updates within 14 days, which is the window Cyber Essentials asks for. Fewer than half monitor what users do on their systems.
To make the difference easier to see, we subtracted the small business figure from the medium business figure for each measure in the report. This chart is our calculation, not the department's.
| Measure | Difference | Percentage points |
|---|---|---|
| Continuity plan that covers cyber attacks | 29 | |
| Separate Wi-Fi for staff and visitors | 27 | |
| VPN for remote staff | 24 | |
| Written cyber security policy | 23 | |
| Monitoring of user activity | 22 | |
| Two factor authentication | 21 | |
| Formal incident response plan | 21 | |
| Staff training in the last year | 21 | |
| Cyber risk assessment | 21 | |
| Mock phishing tests | 18 | |
| Security updates within 14 days | 17 | |
| Malware protection | 6 | |
| Cloud backup | 4 |
Our calculation from Cyber Security Breaches Survey 2025/2026 data tables 9, 12, 15, 19 and 41: the medium business figure minus the small business figure for each measure.
Read from the top, the largest differences are in planning and in the controls that need a named owner. A medium business is 29 points more likely to have a continuity plan that covers a cyber attack, 23 points more likely to have a written policy, and 21 points more likely to have trained its staff in the last year. The bottom two rows, malware protection and cloud backup, barely differ. Almost nobody with 30 staff is missing antivirus. What they are missing is MFA, patching discipline, a written plan and somebody watching the logs.
The MFA figure needs a separate note. Since 27 April 2026, version 3.3 of Cyber Essentials has required MFA on every cloud service that offers it, so at least 42% of small businesses would fail the scheme on that one question. Insurers increasingly treat it as a condition of cover too. We covered how to switch it on across Microsoft 365 in our Microsoft 365 security checklist.
Small businesses also declined this year on three measures where they had improved in 2025. The share with a formal cyber security policy fell from 59% to 52%, the share with a continuity plan covering cyber fell from 53% to 44%, and the share that had done a risk assessment fell from 48% to 41%. The report calls these falls statistically significant and says they put small businesses back where they were two years ago. Micro businesses improved, with MFA up from 35% to 43% and company-only device access up from 58% to 64%.
Incident plans, outside help and insurance, by size
Only a quarter of businesses have a formal incident response plan, and 45% have none of the five incident measures the survey asks about. For small businesses the plan figure is 36%.
| In place | Micro | Small | Medium | Large |
|---|---|---|---|---|
| Named people with roles during an incident | 36% | 48% | 67% | 82% |
| Written guidance on who to notify | 29% | 50% | 68% | 84% |
| Guidance on when to report outside the business | 28% | 44% | 60% | 74% |
| A formal incident response plan | 21% | 36% | 57% | 76% |
| A plan for telling customers and the public | 13% | 24% | 37% | 63% |
| A continuity plan that covers cyber attacks | 29% | 44% | 73% | 85% |
| And the other way round | ||||
| None of the incident measures above | 48% | 33% | 16% | too few to report |
Source: Cyber Security Breaches Survey 2025/2026, data tables 9 and 41.
The difference between what businesses say they would do and what they have written down is large. Asked what they would do after an attack, 81% of businesses said they would inform their directors and 62% would keep a record. Asked what they already had in place for that moment, 48% of micro businesses and 33% of small ones said nothing. The qualitative interviews found that even businesses with a plan had rarely tested it. One large manufacturer told the researchers its plan was "not fully documented and has not been tested. This keeps me awake at night."
Half of small businesses have a rule not to pay a ransom. A quarter of the people responsible for cyber security did not know whether their business had such a rule, which in our view means it does not.
Who looks after all this also changes with size, and the small business column is the interesting one.
| Measure | Micro | Small | Medium | Large |
|---|---|---|---|---|
| Uses an outside provider for cyber security | 44% | 64% | 70% | 42% |
| Someone at board or senior level owns cyber security | 29% | 37% | 52% | 68% |
| Ran staff training or awareness sessions in the last year | 14% | 33% | 54% | 84% |
| Sought outside information or advice in the last year | 41% | 58% | 71% | 61% |
| Has heard of Cyber Essentials | 14% | 25% | 56% | 64% |
Source: Cyber Security Breaches Survey 2025/2026, data tables 6, 7, 9 and 19. The advice and awareness questions were each asked of half the sample.
Small and medium businesses are the most likely to use outside help. 64% and 70% have an external provider for cyber security. The figure drops to 44% for micro businesses and 42% for large ones, which tend to have their own teams. The survey also notes that external IT and security providers were by far the most common source of advice, named by 39% of small businesses, and that only 1% of businesses named the National Cyber Security Centre. Awareness of Cyber Essentials among small businesses is 25%, so three in four have never heard of the scheme that many public sector contracts now ask for. Those that had heard of it were far more likely to hold it: 12% of small businesses now have the certificate, up from 5% last year.
| Position | Micro | Small | Medium | Large |
|---|---|---|---|---|
| A standalone cyber policy | 8% | 15% | 24% | 32% |
| Cyber cover inside a wider policy | 37% | 40% | 36% | 22% |
| No cover | 33% | 20% | 10% | 9% |
| The person responsible did not know | 22% | 25% | 30% | 37% |
Source: Cyber Security Breaches Survey 2025/2026, data table 4. Asked of half the sample: 580 micro, 241 small, 154 medium and 76 large businesses.
A fifth of small businesses have no cover for a cyber incident at all, and a quarter of the people in charge of cyber security did not know either way. We would check. Cover included within a general business policy can exclude the costs that matter in practice, such as forensic investigation, ransom negotiation and customer notification, and the 40% of small businesses relying on that kind of cover may find it thinner than they think. Among businesses with no cover, the reasons given were that they had not heard of cyber insurance (39%), that it was not a budget priority (34%) and that leadership was not interested (27%). Only 19% said it was too expensive.
What the survey cannot tell you
We have quoted this survey a lot, so it is fair to say where it is weak.
- It only counts what businesses noticed and were willing to describe. The authors say the real rates are probably higher, and the monitoring figures above suggest the undercount is biggest for the smallest businesses.
- Sole traders are excluded, as are businesses with no IT or online presence. "Micro" here means one to nine employees.
- The size samples are small. With 507 small businesses interviewed, a figure near 50% has a margin of error of about 4.7 points either way. For medium businesses it is 6.1 points. A two or three point difference between size bands means nothing.
- Costs are what the respondent estimated, including staff time, some months after the event. They are not audited figures.
- The cost tables merge micro with small businesses, and medium with large, to get usable sample sizes. For medium and large businesses that lost something, the worst 10% of cases cost £83,600 or more, but that comes from 47 interviews and the department will not publish the worst 5% at all.
- The fieldwork ran from August to December 2025, so everything above describes the year to roughly autumn 2025.
What we would do first, in order
If we were handed the survey and a 25 person business we had never seen, this is the order we would work in. None of it needs a new product. Most of it is configuration and paperwork.
- Switch on MFA for everyone, on everything that supports it. Email first, then the accounts package, then remote access. 42% of small businesses have not done this, and it is the control that stops a phished password from being useful.
- Set a 14 day patch window and prove it is being met. Automatic updates on every laptop and phone, a monthly report showing what is missing, and a plan for anything still on Windows 10.
- Give staff one way to report a suspicious email, and test it. A reporting button in Outlook and a mock phishing exercise twice a year. 28% of small businesses have no agreed process, and two thirds did not test their staff last year.
- Write the one page incident plan. Who to ring, in what order, what to switch off, who talks to customers, and when to tell the ICO and the insurer. Our continuity plan template has the structure. Then run through it once with a pretend ransom note.
- Turn on logging and have somebody read the alerts. Microsoft 365 audit logging, sign-in alerts and endpoint protection reporting to one place. This is the missing control behind the first chart in this article, and it is what reduces a three week mailbox compromise to a three hour one.
- Check the insurance and decide on Cyber Essentials. Find out what the current policy covers. If the answer is "general liability", get a quote for standalone cover and expect the first question to be about step one. Then look at Cyber Essentials, which covers the first two steps by design.
Cyber Security Breaches Survey 2026 FAQs
What is the Cyber Security Breaches Survey?
It is an annual official statistic from the Department for Science, Innovation and Technology and the Home Office, with the fieldwork carried out by Ipsos. The 2026 edition, officially titled 2025/2026, was published on 30 April 2026 and is based on interviews with 2,112 UK businesses, 1,085 charities and 577 education institutions between August and December 2025.
What percentage of UK businesses had a cyber attack in 2026?
43% of UK businesses identified a cyber attack or breach in the previous 12 months, which the survey estimates at around 612,000 businesses. By size it was 42% of micro businesses, 46% of small, 65% of medium and 69% of large businesses. The rate was the same in the 2025 edition and down from 50% in 2024.
What is the most common cyber attack on UK small businesses?
Phishing. 40% of small businesses with 10 to 49 staff were phished in the year, and 88% of all businesses that identified any attack had been phished. Impersonation of the business or its staff was next at 17% of small businesses. Ransomware affected 2%.
How much does a cyber attack cost a small business in the UK?
The typical cost of the most disruptive incident for a micro or small business was £0, because most attacks are blocked. Where the business lost money, data or access, the typical cost was £560, the middle half of cases cost between £60 and £3,000, and one in ten cost £10,000 or more. These are costs the businesses estimated themselves, including staff time.
How many UK small businesses use multi-factor authentication?
58% of small businesses require two factor authentication for at least one system, compared with 43% of micro businesses, 79% of medium businesses and 90% of large ones. Across all businesses the figure rose from 40% to 47% in a year. Since April 2026 Cyber Essentials has required MFA on every cloud service that offers it.
How many UK businesses have an incident response plan?
25% of UK businesses have a formal incident response plan. By size it is 21% of micro businesses, 36% of small, 57% of medium and 76% of large. 45% of businesses have none of the five incident response measures the survey asks about.
How many UK businesses have cyber insurance?
47% of businesses have some form of cover, but only 10% have a standalone cyber policy. Among small businesses, 15% have a standalone policy, 40% have cover inside a wider policy, 20% have no cover and 25% of the people responsible did not know.
Is ransomware still a threat to small businesses?
Yes, but it is rare. 1% of all businesses and 2% of small businesses were targeted with ransomware in the year, down from 3% of all businesses in each of the two previous editions. It remains the type of incident most likely to produce the very large losses at the top of the cost tables.
Where this leaves a small business
The survey's own conclusion is unusually direct for a government document. A year of headline attacks on well known retailers and manufacturers did not change what most businesses do, and the difference in resilience between large firms and everyone else has not narrowed. For a business with 10 to 50 staff, the data says you are at least as exposed as anyone else and less likely to notice. The controls you are missing are the cheap ones.
AIS Technology looks after IT, Microsoft 365 and cyber security for businesses across Essex and London, and the six steps above are part of our managed IT service rather than something billed on top. If you would like to know how your business compares with the figures in this article, get in touch and we will go through it with you.
Sources
- GOV.UK, Cyber security breaches survey 2025/2026, Department for Science, Innovation and Technology and the Home Office, published 30 April 2026, https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- GOV.UK, Cyber security breaches survey 2025/2026: data tables (ODS), https://assets.publishing.service.gov.uk/media/69f317b4ab602a88957eeeff/DSIT_Cyber_Security_Breaches_Survey_2025-2026_tables_.ods
- GOV.UK, Cyber security breaches survey collection page, https://www.gov.uk/government/publications/cyber-security-breaches-survey
- National Cyber Security Centre, Cyber Essentials overview, https://www.ncsc.gov.uk/cyberessentials/overview
- IASME, Important update: changes to Cyber Essentials for April 2026, https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/
- Information Commissioner's Office, Personal data breaches: a guide, https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/