Last year, roughly 612,000 UK businesses got punched. Most of them blamed an email.
A pragmatic, lightly cynical readout of the official numbers, written for the people who actually run the businesses being targeted. No vendor pitches. No vague "the threat landscape is evolving" nonsense. Just the data, the patterns, and what the survey is quietly trying to tell you.
Things did not get better. They got more boring, in a way that should worry you.
The headline number, 43% of UK businesses experienced some kind of cyber breach or attack in the last twelve months, is exactly the same as the year before. After a high-profile twelve months of household-name retailers being publicly humiliated by ransomware crews, you might have expected that figure to spike. It did not. You also might have expected mass mobilisation in response. That largely did not happen either.
The boring news: prevalence of attacks held flat. Ransomware reports actually fell from 3% to 1% of businesses. The unboring news: for the small minority who do get properly hit, the consequences look meaner than last year. Loss of revenue jumped from 2% to 5%. Reputational damage tripled from 1% to 3%. Micro-businesses recovering within a day fell from 92% to 86%. Translation: the bell curve is the same, but the long tail is uglier.
Bigger means more breached. It is not personal, you just have more doors.
Tap or click each tier. The breach rate climbs almost linearly with headcount. The standard explanation, that bigger firms simply have better detection, is partly true. The uncomfortable counter-explanation, that smaller firms are getting breached and not finding out, is also probably true. Both can coexist. They usually do.
If you sell software, you will get hit. If you sell sandwiches, statistically you might not.
Toggle between breach prevalence and cyber crime prevalence. The most-hit sector by either measure is information and communication. But notice the gap between the two views: that is where defences are working.
There is one quiet upside. The information and communication sector saw cyber crime drop from 43% to 22% year on year, even though overall breach prevalence held flat. That is the cleanest evidence in the whole report that defences actually work when you build them. The attempts kept coming. Fewer of them landed.
Phishing is now functionally the only attack you need to plan for.
Among organisations that experienced any kind of breach, 88% experienced phishing. The proportion experiencing only phishing and nothing else rose from 45% to 51% for businesses, and from 46% to 57% for charities. Everything else has shrunk against it.
saw phishing
"Receive fraudulent email" is the entire UK threat model.
Share of breached organisations that experienced each attack type:
Two things to take from this. First, the marketing budget you might have been about to spend on a flashy XDR could probably go further if half of it bought you continuous, realistic phishing simulation and a proper email gateway. Second, ransomware "going down" in this survey reflects an attempted-attack metric, not a damage metric. The big news-cycle ransomware events still happened. The survey simply does not capture the upper tail well.
Click any vector. The detail is where the strategy lives.
Each row is an attack type. The percentage is share of all UK businesses (not just breached ones) that experienced it in the last twelve months.
Pick your scenario. Read the damage. Then project your own.
Two calculators. Left: actual percentile data from the survey. Right: a what-if for your own business based on staff time. The official median cost of a most-disruptive breach is £0, because most attacks fail. The interesting numbers live in the tails.
Costs cover the single most disruptive breach over 12 months. The survey explicitly notes catastrophic cases sit beyond what a sample of this size can resolve. Treat these as the floor, not the ceiling.
Drag the sliders. This is a planning aid, not survey data. It estimates the staff-time cost of one bad incident day before you add tools, advisors, customer comms or downtime.
What everyone has, what everyone is missing, and what is quietly regressing.
Most UK businesses have the basics. The advanced controls, the ones that actually stop modern attacks, sit between 30% and 50%. The most concerning regression is in small businesses (10-49 staff), who undid most of the gains they made last year. Risk assessments, formal policies, and continuity plans all fell back to 2023/2024 levels.
Tick what you already have. The machine will not judge you.
An honest self-assessment for UK business owners. Eight items, derived from the survey's own most-impactful controls. The ring fills as you go. No data leaves this page.
The boardroom is finally noticing. Some of them are even doing something.
For the first time in years, board-level responsibility for cyber security ticked up rather than down. The qualitative interviews credit a year of catastrophic news stories with shifting executive risk appetite. The encouraging trends and the discouraging trends are sitting next to each other.
Cyber as senior-management priority
Charities slid from 68% to 60%, driven entirely by low-income charities (53%, down from 64%). High-income charities held steady at 87%.
Boards with explicit cyber responsibility
Large businesses 68%. Finance and information sector lead. Transport and retail still drag the average down.
Have a formal incident response plan
This is the gap that turns a containable incident into a corporate-existential one. Qualitative interviews are full of "we have a document but we have never tested it".
AI use without AI risk policy
Among the third of UK businesses using or considering AI, three quarters have no specific cyber processes for AI risk. Adoption is outrunning governance.
Six things a UK business owner can actually do next week, in order of return on effort.
The temptation when reading reports like this is to nod, close the tab, and tell yourself you'll think about it on Monday. These are the moves the data actually supports, not the ones a vendor will sell you.
Cyber security is not an IT hobby. It is business continuity wearing a black hoodie.
The businesses that cope better tend to have clearer ownership, better controls, better-rehearsed response, and a calmer view of what can go wrong. That does not mean buying every shiny platform. It means knowing your data, your suppliers, your critical systems, your people, and your first 24 hours after something goes wrong.
Want a quiet conversation about your own 612?
If anything in this briefing made you tilt your head, drop the details below. No sales script, no auto-sequence, no "let's hop on a quick call to learn about your needs". Just a real reply from a real person who's read the same report you have.
This is the part where most websites tell you they're different and aren't.
So the short version: you tell me what's keeping you up at night, I tell you whether it's a real problem, a hyped problem, or a different problem in a hat. If we're a fit, we keep talking. If not, you've still got a useful answer.
What 313SEC tends to handle:
- Cyber Essentials / Plus, properly done, not box-ticked
- Incident response planning that survives contact with reality
- Phishing simulation and email defence that actually works
- Supplier review for the suppliers that matter
- Honest reads on whether your stack is overspending or underspending
Transmission received.
You'll get a real reply, from a real person, within a couple of working days. No sequence, no list. Cheers for reading.