When I sit down with business owners across Derbyshire, the question I hear most often is: “What would a cyber attack actually cost us?”
Until now, we’ve had to rely on estimates, anecdotes, and case studies. But on 12 November 2025, the government published independent research that gives us a clear answer.
The average UK business faces costs of £195,000 from a significant cyber attack.
Let me put that in perspective and more importantly, let me show you why it doesn’t have to be your reality.
What does “significant” actually mean?
Before we go further, let’s be clear about what we’re measuring. The research defines a “significant” cyber attack as any successful incident costing at least £500.
Yes, you read that correctly. Just £500.
This isn’t about catastrophic ransomware attacks that shut down your entire operation. A “significant” incident could be:
- A phishing attack that compromises one employee’s email account
- Malware that requires professional IT remediation
- A data breach that triggers ICO reporting requirements
- Lost productivity while systems are restored
- Emergency callout fees for IT support
The £195,000 figure is calculated by averaging across all firm sizes and all sectors in the UK. It reflects what happens when you total up:
- Direct financial losses
- IT recovery costs
- Lost business during downtime
- Regulatory fines (where applicable)
- Reputational damage
- Legal and professional fees
- Insurance excess payments
For context, 43% of UK businesses that’s,over 600,000 organisations, experienced a cyber security breach or attack in the past year alone.
What does £195,000 mean for a Derbyshire SME?
Let’s make this real. Let’s talk about what £195,000 means for the businesses I work with every day.
For a trades business
A typical Chesterfield building firm might turn over £200,000-£400,000 annually. An established electrical contractor might do £500,000.
A £195,000 cyber incident would represent:
- 40-97% of annual turnover for a smaller operation
- 6-12 months of profit wiped out
- Potential inability to pay staff or suppliers
- Serious cash flow crisis requiring emergency financing
Trades businesses hold more valuable data than they realise. Customer addresses, access codes, payment details, project schedules, supplier contracts. You’re holding the keys to people’s homes and businesses – literally and digitally.
For a care home
A 30-bed care home typically generates £600,000-£1 million in annual revenue, with tight margins of 5-15%.
A £195,000 incident could mean:
- 20-32% of annual turnover
- Potentially 1-2 years of profit eliminated
- CQC compliance issues if resident data is compromised
- Loss of family trust that’s almost impossible to rebuild
- Potential closure if cash reserves are insufficient
You’re holding some of the most sensitive data possible: medical records, mental capacity assessments, medication schedules, next-of-kin details, safeguarding information.
For a school
A primary school with 300 pupils operates on a budget of roughly £1-1.5 million, with minimal financial reserves.
A £195,000 cyber attack represents:
- 13-19% of the entire annual budget
- Money that would otherwise fund teaching assistants, resources and essential services
- Potential breach of DfE safeguarding requirements
- Parental trust that takes years to rebuild
- Governors facing serious questions about due diligence
Schools hold pupil data, staff records, safeguarding concerns, SEND information, free school meals eligibility and contact details for vulnerable families.
Why are 43% of businesses getting hit?
The government research reveals that over 600,000 UK organisations experienced cyber breaches in the past year. That’s 43% of all businesses.
The National Cyber Security Centre (NCSC) managed 204 significant or highly significant cyber incidents in just one year – that’s one major incident every two days.
So why is this happening at such scale?
1. The UK is Europe’s top target
We’re the most targeted country for cyber attacks in Europe. We have a strong digital economy, widespread connectivity and valuable data. That makes us attractive to criminals.
2. The barrier to entry has collapsed
You don’t need to be a technical genius to launch a cyber attack anymore. Ransomware-as-a-service platforms mean criminals can buy ready-made attack tools. Phishing kits are available for pennies. The dark web has made cyber crime accessible to anyone with basic computer skills.
3. Remote working expanded the attack surface
Post-pandemic, we’re all working more flexibly. That means more devices, more locations, more home networks, more cloud services. Every connection point is a potential vulnerability.
4. SMEs think they’re too small
The biggest vulnerability isn’t technical, it’s psychological. Business owners tell me “we’re too small to be a target” or “we don’t have anything worth stealing.”
The criminals aren’t selecting victims based on size. They’re using automated tools that scan for vulnerabilities. If you’re online, you’re in the game.
5. Basic protections aren’t in place
The research tells us something crucial: businesses with Cyber Essentials controls make 92% fewer insurance claims.
That means the vast majority of successful attacks are hitting businesses without basic protections. Not sophisticated defences. Basic protections.
The sector-specific reality
While £195,000 is the national average across all businesses, the government research shows that some sectors face even higher costs:
- Information sector: £337,000
- Management sector: £334,000
- Entertainment: £331,000
- Manufacturing: £330,000
- Financial services: £309,000
But here’s what matters for Derbyshire SMEs: these aren’t just “big business” problems.
The research also reveals that cyber attacks attempting intellectual property and knowledge theft cost the UK between £1 billion to £8.5 billion in 2024. Case studies showed that IP theft could pose an existential threat to SMEs, particularly when stolen intellectual property is used to develop rival products.
If you’ve developed a unique process, a innovative product design, or a competitive advantage – it’s at risk. And unlike physical theft, you might not even know it’s happened until a competitor launches “your” innovation.
The ripple effect: It’s not just your problem
Here’s something that keeps me up at night and should concern every business owner: when your organisation suffers a data breach, you’re not the only victim.
The government research found that 437,000 people became fraud victims in 2023 specifically because of data breaches at organisations they trusted. That’s 11% of all fraud victims in England and Wales.
The annual cost? £755 million.
When a Chesterfield builder’s customer database gets compromised, those families become fraud targets.
When a care home’s records are breached, vulnerable elderly residents and their families face identity theft.
When a school’s data is stolen, children and their parents are exposed.
Your cyber security isn’t just about protecting your business. It’s about protecting your community.
The solution that actually works
Now for the empowering part – and this is where the government research gives us genuine hope.
Organisations with Cyber Essentials in place make 92% fewer insurance claims.
Read that again. Not 9%. Not 50%. 92%.
In the past year, over 51,000 UK businesses got Cyber Essentials certified (38,591 Cyber Essentials certificates and 12,477 Cyber Essentials Plus). They’re not all large corporations. They’re businesses just like yours.
What is Cyber Essentials?
It’s a government-backed certification scheme that focuses on five basic technical controls:
- Firewalls – controlling who and what can access your networks
- Secure Configuration – setting up devices and software correctly
- User Access Control – managing who can access what
- Malware Protection – defending against viruses and malicious software
- Security Update Management – keeping everything patched and current
That’s it. No mystery. No jargon. Just practical protections.
These aren’t sophisticated, expensive enterprise solutions. They’re the fundamentals that stop the majority of attacks.
Think of it like locking your car and taking the keys out. It won’t stop a determined professional car thief with specialist equipment. But it will stop the opportunist trying door handles in the car park.
What £195,000 vs. Cyber Essentials really means
Let’s compare the numbers:
The Risk:
- £195,000 average incident cost
- 43% chance of experiencing a breach this year
- Potential business closure for many SMEs
- Cascade of fraud affecting your customers
- Years to rebuild reputation and trust
The Protection:
- Cyber Essentials certification: typically £300-500 for self-assessment, £1,000-2,000 for Plus certification with audit
- 92% reduction in insurance claims
- Demonstrable due diligence to customers, regulators, and insurers
- Competitive advantage when tendering for contracts
- Peace of mind
The maths isn’t complicated. The question is: what’s your business worth?
Taking action: Where to start
If you’re a Derbyshire business owner reading this and thinking “we need to sort this out,” here’s what to do:
Step 1: Assess where you are
Be honest about your current protections:
- Do you have firewalls on all devices?
- Are software updates applied promptly?
- Do staff use unique, strong passwords?
- Is malware protection installed and updated?
- Do you control who can access what data?
Step 2: Understand what’s at risk
Make a list of what you’d lose:
- Customer databases
- Financial records
- Intellectual property
- Operational capability during downtime
- Trust and reputation
Step 3: Implement the basics
You don’t have to do everything at once. Start with:
- Enable automatic updates on all devices
- Install and update antivirus software
- Enforce strong password policies
- Restrict admin access to essential staff only
- Back up critical data regularly
Step 4: Get certified
Cyber Essentials certification proves you’ve got the basics right. It’s:
- Recognised by insurers (often reducing premiums)
- Required for government contracts
- Increasingly expected by major clients
- Simple to understand and implement
- Affordable for SMEs
The bottom line
The government research is unequivocal: cyber attacks cost UK businesses £14.7 billion annually. That’s 0.5% of our entire GDP.
The average business faces £195,000 in costs from a significant incident.
43% of businesses were hit last year.
But businesses with Cyber Essentials make 92% fewer insurance claims.
The threat is real. But so is the solution.
For Derbyshire businesses – whether you’re a builder in Chesterfield, a care home in Buxton, or a school in Matlock – the choice is clear.
You can hope you’re in the 57% that didn’t get hit this year. Or you can take proven, practical action to reduce your risk by 92%.
I know which side I’d rather be on.
Need help getting started?
Black Swan Cyber Security Solutions specialises in helping Derbyshire SMEs implement Cyber Essentials without the complexity or jargon. We speak your language, understand your business and make cyber security practical.
Let’s have a conversation about what £195,000 means for your business – and how to make sure you never have to find out the hard way.
Data sources: Department for Science, Innovation and Technology, “Summary of research on the economic impact of cyber attacks,” 12 November 2025; includes independent reports from KPMG, Alma Economics, and Frontier Economics
