United Kingdom businesses • 2025/2026
Forty-three percent identified a breach or attack.
The survey counts the incidents businesses were able to identify and were willing to report, so the true level may well be higher.
Source details and context
Business size
No business size is outside the picture.
Reported rates were forty-two percent for micro businesses, forty-six percent for small businesses, sixty-five percent for medium businesses and sixty-nine percent for large businesses.
Source details and context
Phishing messages
Phishing remained the most common reported attack route.
Phishing means deceptive messages or websites designed to make someone click a link, sign in, share information or approve a payment.
69%
described phishing as their most disruptive incident type
Source details and context
How often affected businesses saw incidents
For some affected businesses, incidents were repeated.
Among businesses that identified a breach or attack, twenty-nine percent experienced one at least weekly and twenty-two percent around once a month.
Source details and context
Safer sign-in
Less than half required two-step sign-in.
Forty-seven percent of businesses required two-factor authentication, meaning a second check is needed as well as a password.
Source details and context
Security updates
Have a 14-day update policy
34%
Timely software updates are not yet standard everywhere.
Thirty-four percent of businesses had a policy to apply software security updates within fourteen days. The second bar is the remaining share of the same survey result.
Source details and context
Incident preparation
Have a formal incident response plan
25%
Have none of the response measures listed
45%
Formal response plans remain limited.
Twenty-five percent had a formal incident response plan, while forty-five percent had none of the response measures listed by the survey.
Source details and context
Buying software
Security is often not central when software is purchased.
Only twenty-two percent considered cyber security to a large extent when buying new software. This is why secure planning should begin before a website or application is built.
Source details and context
Wider United Kingdom threat environment
Nationally significant incidents more than doubled.
The National Cyber Security Centre handled two hundred and four nationally significant incidents, compared with eighty-nine the year before. This is not the total number of United Kingdom attacks, but it does show increasing pressure at the serious end of the threat landscape.
Source details and context
