The UK Government’s Cyber Security Breaches Survey 2025/2026 has landed, and it is worth reading properly.
Not because every small business owner needs to spend their evening studying government statistics. Because the report gives us a useful, grounded picture of what UK businesses and charities are actually dealing with.
The short version:
Cyber attacks have not gone away. Phishing is still doing most of the damage. Some basic controls are improving. But there are still some uncomfortable gaps around staff training, supplier risk, incident response, AI use and cyber governance.
For smaller organisations, those gaps matter.
The headline figure: 43% of businesses reported a breach or attack
The survey found that 43% of UK businesses and 28% of charities reported experiencing some kind of cyber security breach or attack in the last 12 months.
That equates to around 612,000 UK businesses and 57,000 UK charities.
There is an important caveat here. The survey only includes breaches and attacks that organisations were able to identify and were willing to report. Hidden attacks, missed alerts and incidents that were never spotted will not be included.
That matters, especially for smaller organisations that may not have monitoring, managed detection or clear reporting processes in place.
Medium and large businesses were more likely to report breaches or attacks, with 65% of medium businesses and 69% of large businesses affected. Micro businesses reported 42%, and small businesses reported 46%.
That does not automatically mean smaller businesses are safer. It may also mean some attacks are simply not being seen.
If you are unsure what your business would actually detect, this is where managed cyber security support starts to make sense.
Phishing is still the biggest problem
Phishing remains the most common type of breach or attack by a long way.
The survey found that phishing attacks were experienced by 38% of businesses and 25% of charities.
It was also the attack type most often described as the most disruptive, accounting for 69% of businesses and charities that had experienced a breach or attack.
That should make every business pause.
A lot of cyber security conversations still drift towards ransomware, hacking and dramatic worst-case scenarios. Those risks are real. But the thing most organisations are actually seeing, week after week, is still malicious email.
Fake invoices. Password reset scams. Microsoft 365 login pages. Supplier impersonation. Director fraud attempts. Messages designed to make someone click, reply, approve, pay or sign in.
The survey also found that among organisations experiencing a breach or attack, the proportion experiencing phishing attacks only increased this year. For businesses, it rose from 45% last year to 51%. For charities, it rose from 46% to 57%.
That does not mean phishing is “only” phishing.
A single convincing email can lead to stolen credentials, inbox access, payment fraud, data exposure or malware.
This is why email security and security awareness training should not be treated as optional extras.
Ransomware is lower in the survey, but that does not make it irrelevant
The survey reported that ransomware attacks among businesses declined to 1%, down from 3% in both 2024/2025 and 2023/2024.
That is positive.
But it needs careful interpretation.
Ransomware may be lower in the reported survey figures, but it remains one of the most damaging events when it happens. The survey also makes clear that high-cost cyber crime incidents do occur, but they are rare, variable and difficult to measure reliably in this type of survey.
For most small businesses, ransomware planning should not be based on panic.
It should be based on boring, practical questions:
Can you restore your data?
Are your backups separate from your main systems?
Has anyone tested recovery?
Would you know who to call?
Would your staff know what to do first?
If the answer is unclear, look at cloud backup for Microsoft 365 and business continuity planning before you need them.
The cost figures are easy to misread
One of the most interesting, and easiest to misread, parts of the report is the cost data.
The median perceived cost of the most disruptive breach or attack was £0 for businesses and £0 for charities. For medium and large businesses, it increased to £30.
At first glance, that sounds reassuring. But the report is talking about the median perceived cost, not the worst-case cost, and it includes organisations that reported no direct financial loss. The same section shows that the top 5% of cases reached £4,000 for businesses overall, rising to £10,000 for medium and large businesses. The report also found increases in businesses reporting that a breach or attack led to loss of revenue or share value, rising from 2% in 2024/2025 to 5% in 2025/2026. Reputational damage also increased, from 1% to 3%.
So the sensible takeaway is not “cyber incidents cost nothing”.
It is this:
Many incidents are low-cost or contained, but a smaller number can become very expensive, disruptive and reputation-damaging.
That is exactly why cyber security needs to be proportionate. Not overblown. Not fear-based. Proportionate to your risk, your data, your contracts, your compliance needs and your ability to recover.
Basic cyber hygiene is improving, but there are still gaps
The survey shows that many organisations have adopted basic technical controls.
Among businesses:
81% had updated malware protection
74% backed up data securely via a cloud service
74% had password policies
74% had network firewalls
73% had restricted admin rights
Those are encouraging figures.
But the survey also shows weaker adoption in other important areas:
47% of businesses required two-factor authentication
36% used a VPN for staff connecting remotely
30% used monitoring
For charities, adoption was lower in several areas, including two-factor authentication at 38%, secure cloud backup at 57%, and network firewalls at 45%.
This is where many smaller organisations sit: they have some protection, but not always enough joined-up protection.
Antivirus alone is not a cyber security strategy. Backups alone are not a recovery plan. MFA on some accounts is not the same as MFA across the business.
A good starting point is to compare your current setup against Cyber Essentials and then close the obvious gaps.
Micro businesses have improved on MFA
There was some good news for micro businesses.
The survey found increases in micro businesses that only allow access via company-owned devices, rising from 58% in 2024/2025 to 64% in 2025/2026.
Micro businesses requiring two-factor authentication also increased from 35% to 43%.
The proportion of micro businesses with an external cyber security provider increased from 39% to 44%.
That is encouraging, because micro businesses often do not have in-house IT or cyber expertise. For many, the most realistic route is not building an internal security team. It is having a trusted partner who can help put the right controls in place and explain what matters in plain English.
Small businesses appear to have slipped backwards in some areas
The survey also raises a concern.
Small businesses improved on several cyber hygiene measures last year, but in 2025/2026 some of those gains reversed.
For small businesses:
Cyber security risk assessments dropped from 48% in 2024/2025 to 41%
Formal cyber security policies dropped from 59% to 52%
Business continuity plans covering cyber security dropped from 53% to 44%
That is a pattern worth taking seriously.
It suggests that some small businesses may be doing one-off security work, then losing momentum.
Cyber security cannot just be a project you complete once. It needs light-touch review, especially when staff change, systems change, suppliers change, contracts change or insurance requirements change.
If your business has not reviewed this recently, our guide on how to pass Cyber Essentials is a practical place to start.
Staff training remains low
The survey found that staff training and awareness raising activities remained stable for businesses at 19%.
For charities, training decreased from 21% in 2024/2025 to 17% in 2025/2026, driven by a decline among low-income charities.
That is a concern when phishing remains the most common type of attack.
Training does not need to be dull. It does not need to blame staff. It should help people spot the common tricks, report suspicious emails quickly and feel confident asking for a second opinion.
Good security awareness training gives people permission to pause and in many attacks, that pause is the difference between “we nearly got caught” and “we have a problem”.
Supply chain risk is still not being reviewed by many organisations
The survey found that only 15% of businesses reviewed the cyber security risks posed by their immediate suppliers.
Only 6% looked at their wider supply chain.
Among charities, 9% reviewed immediate supplier risks and 4% reviewed wider supply chain risks.
This is one of the biggest practical gaps in the report.
Most organisations now rely on external software, outsourced IT, cloud platforms, payment providers, payroll systems, accountants, marketing platforms, CRMs and sector-specific tools.
That means cyber risk is not only inside your business. Some of it sits with the companies you depend on.
This does not mean every small business needs a complex supplier assurance programme.
But it does mean asking better questions:
Who has access to our systems or data?
Which suppliers could disrupt us if they were attacked?
Do our key providers use MFA?
Do they back up our data?
Who is responsible if something goes wrong?
Are cyber security requirements written into contracts?
If supply chain risk is becoming more important for your business, especially for tenders or larger customer contracts, read our page on supply chain cyber security and Cyber Essentials for supply chains.
Cyber insurance is common, but it is not a substitute for controls
The survey found that 47% of businesses and 35% of charities reported being insured against cyber security risks in some way.
Small businesses were more likely than businesses overall to have some form of cyber insurance, at 55%. Medium businesses were higher again at 61%.
That fits what we are seeing in the real world.
Cyber insurance is becoming part of normal business risk management. But insurance is not the same as protection.
Insurers increasingly ask about MFA, backups, patching, security awareness training, endpoint protection and incident response. If you cannot answer those questions clearly, getting cover may be harder. If you can answer them, you are also reducing the chance of needing to claim in the first place.
If cyber insurance questions are causing headaches, our cyber insurance readiness content may help you understand what insurers are often looking for.
AI is being adopted faster than AI risk is being managed
The survey included AI as a newer area of interest.
Around 31% of businesses and 25% of charities were either using AI, adopting it or actively considering using it.
Of those organisations, around 24% of businesses and 27% of charities reported having cyber security practices or processes in place to manage the risks from AI technology.
That leaves a gap.
Many organisations are experimenting with AI tools before they have agreed what staff can upload, what data should stay out, who approves tools, and how outputs should be checked.
This is not about pretending AI is bad.
It is about recognising that AI use can overlap with data protection, confidentiality, supplier risk and cyber security.
If staff are using AI tools in your business, it is worth having a simple AI usage policy and a clear approval process.
Incident response plans are still not widespread
The survey found that formal incident response plans were in place at 25% of businesses and 19% of charities.
Larger organisations were more likely to have one, with 57% of medium businesses and 76% of large businesses having a formal incident response plan. Among micro businesses, the figure was 21%.
This is another area where smaller organisations can make meaningful progress without huge complexity.
An incident response plan does not need to be a 40-page document.
At a basic level, it should answer:
Who makes decisions?
Who contacts the IT or cyber provider?
Who speaks to staff?
Who contacts customers, insurers, banks or regulators if needed?
Where are key passwords, recovery details and supplier contacts stored?
What should staff do if they suspect a phishing email, account compromise or malware infection?
A plan written during a calm week is much better than a plan invented during a crisis.
Cyber Essentials is moving in the right direction
The survey found that awareness of Cyber Essentials was 17% among businesses and 16% among charities.
It also found that the proportion of businesses holding Cyber Essentials increased from 3% in 2024/2025 to 5% in 2025/2026.
That increase was driven by large businesses, rising from 21% to 35%, and small businesses, rising from 5% to 12%.
There is still plenty of room for improvement, but this is a positive sign.
Cyber Essentials is not perfect, and it is not the whole of cyber security. But for many smaller organisations it gives a clear, practical baseline.
It helps with core controls such as firewalls, secure configuration, access control, malware protection and security updates.
It can also support tenders, supply chain conversations and cyber insurance applications.
If you need help preparing, start with our guide on how to pass Cyber Essentials.
What should small businesses take from the 2025/2026 survey?
The report is long, but the practical message is fairly clear.
Most smaller organisations do not need enterprise complexity.
They do need the basics done properly.
That means:
Use multi-factor authentication where possible, especially on email and cloud accounts.
Keep software and devices updated.
Use good email security and staff awareness training to reduce phishing risk.
Back up important data and test recovery.
Restrict admin access.
Know which suppliers matter most.
Have a simple incident response plan.
Review Cyber Essentials if customers, insurers or tender requirements are starting to ask harder questions.
Get help where you do not have internal expertise.
Cyber security does not need to be dramatic.
It needs to be understood, owned and reviewed.
The Cyber Security Breaches Survey 2025/2026 shows that many organisations are improving. It also shows the same familiar weak spots: phishing, training, supplier risk, MFA, incident planning and governance.
For small businesses, those are not abstract issues.
They are the areas most likely to decide whether an attempted attack becomes a bad day, a costly incident, or something you can contain quickly.
If you want a practical review of where your organisation stands, book a quick security check.
