Cybersecurity Statistics: Sourced UK Business Figures for 2026

The most useful cybersecurity statistics for UK businesses come from a handful of sources: the government's Cyber Security Breaches Survey, the NCSC and large industry studies from IBM and Verizon. Each measures something different, so the figures should be read as indicators, not forecasts.

Every figure below was taken from a page we opened, and carries its source and year. Anything we could not verify has been left out. Where a number is a respondent's perception rather than a measurement, we say so.

Sources used: the DSIT Cyber Security Breaches Survey 2025/2026 (published 30 April 2026), the NCSC Annual Review 2025 (reported 14 October 2025), the IBM Cost of a Data Breach Report 2025, UK edition (published 30 July 2025) and the Verizon DBIR 2026 (dataset October 2024 to November 2025).

Prevalence: how often UK organisations are hit

The DSIT survey reports business prevalence of 50% in 2023/2024 and 43% in 2024/2025, so the share identifying a breach has fallen from that peak. The survey itself cautions that it only counts breaches organisations could identify and were willing to report, so the true level is likely higher.

The NCSC figures describe serious, nationally significant incidents, not everyday phishing, which is why they are a smaller number than the survey.

Read the prevalence figures alongside the size breakdown in the small business section: the headline 43% hides a range from 42% for micro businesses to 69% for large ones. A larger estate, more staff and more suppliers simply give attackers more to try.

Cost: what breaches are reported to cost

Treat the two sources with care. The DSIT figures are perceived costs from survey respondents, covering many small incidents. The IBM figures come from a study of 600 organisations that suffered breaches, covering March 2024 to February 2025, so they skew towards larger, costlier events.

A practical reading: budget for the realistic middle, such as response support and recovery time, and test your insurance and backups against the expensive tail. The sums involved in a serious event can exceed what a small firm holds in reserve.

Causes: how attackers get in

Both studies point to the same set of basics: patching, identity protection and supplier control. For the most common social engineering route, see what phishing is and how to prevent it.

Notice that exploited vulnerabilities lead in the Verizon data while IBM's UK sample puts supplier compromise first. Both reward the same habits: know what you run, patch what is exposed, and understand what your suppliers can reach.

Small business: size changes the picture

Source: DSIT survey 2025/2026. Further DSIT figures show 55% of small businesses and 61% of medium businesses held insurance covering cyber risk, and 12% of small businesses held Cyber Essentials certification.

Verizon's 2026 report counted 7,152 breaches with confirmed data disclosure at small and medium-sized businesses, with third-party involvement in 55%. It notes these firms are disproportionately affected by ransomware and often have fewer resources to respond.

Our page on cybersecurity for small business sets out the practical controls for this group.

Workforce and governance

Our guide on training employees on cybersecurity awareness covers the people controls in more detail.

What these cybersecurity statistics mean in practice

Numbers on their own do not tell you what to do. Four practical readings follow from the tables.

• Exposure is normal, not exceptional. Four in ten businesses identify an incident each year, so planning for one is ordinary risk management.
• Most incidents are minor, a few are severe. A median cost of £0 sits alongside multi-million-pound averages in large studies. Plan for the tail, not the median.
• Basic hygiene addresses the commonest routes. Patching, multi-factor authentication and supplier checks target the leading causes. Cyber Essentials covers several of them.
• Governance lags behind awareness. Most businesses say cyber is a priority but few train staff or hold an incident plan, which is where managed IT support and an independent cyber security audit help.

How to use these figures in your business

Use the statistics to frame a conversation with your board or insurer, not to scare anyone. Pick the three that map to your gaps, such as patching, training and incident planning, and attach an owner and a date to each.

Always quote the source and year, and do not mix survey percentages with industry-study averages in a single sentence. The first describe how many organisations are affected. The second describe how much breaches cost when they are serious.

Response and governance behaviours

The gap between priority (72%) and action (19% training, 25% incident plans) is the most consistent theme in the DSIT data. Both are areas where a Cyber Essentials assessment gives a structured starting point.

Limitations of these sources

Good use of statistics means knowing what each study can and cannot say.

• DSIT survey: self-reported, counts only incidents organisations identified and were willing to report, and costs are perceived rather than measured. Results for large businesses and some subgroups are less statistically reliable.
• NCSC Annual Review: counts incidents the NCSC handled, so it measures serious cases brought to its attention, not total activity.
• IBM: based on 600 organisations that experienced breaches, so averages skew higher than a typical UK business would see.
• Verizon: built from incident data contributed to Verizon, so it reflects the cases its contributors see.

None of these should be read as a prediction for your organisation. Use them to prioritise, then check your own position through an audit or assessment.

Revisit the figures each year. The DSIT survey and the NCSC review are annual, and the Verizon and IBM reports are published each year too, so a one-page summary of your own position against the latest numbers is easy to keep current.

Conclusion

These cybersecurity statistics show a consistent picture: incidents are common, most are modest, a few are costly, and the leading causes are preventable with disciplined basics. Use the figures as a starting point and review your own position against them. If you would like help turning them into a plan, get in touch with NetMonkeys.

Frequently Asked Questions (FAQs)