West Midlands Cyber
Join the Cluster

What UK Cyber Data Isn’t Showing Us

Official cyber statistics capture different parts of the problem. Comparing survey data, regulatory reporting, and national incident data reveals a much larger layer of cyber exposure below what organisations detect and report.

Contents

Table of Contents

The Cyber Risk We Don’t See: Understanding Britain’s Reporting Gap

The UK has several substantial sources of cyber security data, but they do not measure the same thing. The Cyber Security Breaches Survey records incidents that organisations say they have identified; the Information Commissioner’s Office records a subset of personal-data breaches that meet regulatory reporting requirements; and the National Cyber Security Centre concentrates primarily on incidents sufficiently serious to warrant national-level support. Taken independently, each dataset provides useful evidence. Taken together, they reveal a more fundamental problem: the UK has no single measure of its underlying cyber exposure.

The scale differences are considerable. The Cyber Security Breaches Survey 2025/2026 estimates that 43% of UK businesses identified a breach or attack during the previous 12 months, equivalent to approximately 612,000 businesses. The NCSC, by contrast, received 1,727 incident tips during its 2024–25 reporting year, of which 429 required support from its incident-management team and 204 were categorised as nationally significant. These figures are not contradictory because they describe different populations, thresholds and forms of visibility.

The distinction was explored in the originating analysis, The Gap Between Reality and Reporting: A Model of True Cyber Exposure in the UK, which proposed understanding UK cyber data as a set of filters between underlying exposure, organisational detection, formal reporting and national significance. That model is useful provided the layers are not treated as a numerical funnel: the Breaches Survey, ICO and NCSC datasets overlap in places, but they are not nested samples of the same incident population.

For the West Midlands, this distinction has practical consequences. A region containing large numbers of SMEs alongside complex manufacturing and supply-chain environments cannot infer local cyber resilience from national incident totals or regulatory reporting alone. The incidents visible to national institutions represent only particular parts of the problem, while an organisation’s ability to detect, classify and respond to activity determines how much of its own exposure ever becomes visible.

Key Takeaways

  • The Cyber Security Breaches Survey estimates that 43% of UK businesses identified a breach or attack in 2025/26, but explicitly warns that unidentified attacks mean true prevalence is likely to be higher.
  • Detection, regulatory reporting and national incident response apply different filters, so Breaches Survey, ICO and NCSC figures cannot legitimately be combined into a single incident total or simple hierarchy.
  • Only 40% of businesses that identified a breach or attack reported their most disruptive incident outside the organisation, demonstrating a substantial separation between detected and externally visible activity.
  • NCSC incident data is intentionally concentrated at the severe end of the spectrum: 204 of 429 incidents handled in 2024–25 were nationally significant, compared with 89 the previous year.
  • Regional resilience therefore depends partly on observability: organisations cannot manage, report or learn from cyber activity they fail to detect or classify correctly.

Detected Breaches Are a Measure of Visibility as Well as Exposure

The Cyber Security Breaches Survey provides the broadest recurring national picture of organisational experience. In 2025/26, 43% of businesses and 28% of charities said they had identified a cyber security breach or attack during the preceding 12 months. Prevalence varied markedly by business size, rising from 42% among micro businesses and 46% among small businesses to 65% among medium-sized firms and 69% among large businesses.

Those differences cannot automatically be interpreted as evidence that larger businesses experience proportionately more hostile activity. Larger organisations tend to have more users, systems and external exposure, which can increase the attack surface, but they also generally have more sophisticated monitoring and security capability. A business with centralised logging, managed detection, specialist security staff and established reporting processes is better placed to recognise activity that a less mature organisation may never identify.

DSIT makes this limitation explicit. The survey captures only breaches or attacks that organisations were able to identify and were willing to disclose to researchers, meaning hidden or unidentified activity sits outside the results. The 43% prevalence figure is therefore an estimate of observed organisational experience, not a measurement of every cyber event affecting UK businesses.

This creates an important analytical problem when prevalence changes over time. A lower reported breach rate could reflect a genuine reduction in hostile activity, but it could also reflect changes in detection capability, organisational awareness, attack methods or survey behaviour. Conversely, investment in better monitoring can make an organisation appear statistically more exposed because it begins identifying activity that previously went unnoticed.

Cyber measurement therefore contains an unusual feature: improved capability can initially make the visible problem larger.

Detection and External Reporting Are Different Filters

Even when organisations identify an incident, much of that activity never reaches an external reporting system. The 2025/26 Breaches Survey found that only 40% of businesses and 36% of charities that had identified breaches or attacks reported their most disruptive breach outside the organisation.

The reasons help explain why external reporting data cannot be treated as a proxy for detected incidence. Among organisations that did not report externally, 72% of businesses and 73% of charities said the incident was not considered significant enough to report. Ten per cent of businesses said they did not know who to report it to, while smaller proportions believed that reporting would make no difference or preferred to deal with the matter internally.

Even among businesses that did report externally, there is no single destination collecting a comprehensive picture. Banks and payment providers were the most commonly cited destination among externally reporting businesses, followed by internet or network providers, government agencies, Action Fraud, suppliers and the police. Reporting directly to the NCSC represented less than 0.5% within this group in the latest survey.

The ICO observes another subset again. Its incident data concerns security breaches affecting personal information and is shaped by UK GDPR reporting obligations, including the requirement to notify qualifying personal-data breaches within 72 hours of discovery. The regulator itself identifies limitations in its data, including changes in recording over time and the use of best-fit categories where several factors may have contributed to an incident.

This means that an ICO incident should not be treated simply as one rung above a breach recorded by the Breaches Survey. A disruptive ransomware event may require regulatory reporting because personal information is affected, while another operationally damaging cyber incident may not fall within the same reporting obligation. Regulatory visibility depends on the nature of the incident and the legal threshold, not merely its technical severity.

National Incident Data Measures a Different End of the Problem

NCSC incident statistics apply another filter. During the period covered by the NCSC Annual Review 2025, the organisation received 1,727 incident tips, from which 429 incidents required support from its incident-management team. Of those, 204 were considered nationally significant and 18 were categorised as highly significant.

The change in severity is notable. The number of nationally significant incidents rose from 89 in 2023–24 to 204 in 2024–25, while highly significant incidents increased from 12 to 18. The number of incidents receiving NCSC support remained broadly stable, at 430 and 429 respectively, meaning the composition of the workload shifted substantially towards more serious cases even though its total size barely changed.

That is a materially different signal from general breach prevalence. The Breaches Survey asks whether organisations observed defined forms of cyber attack or breach; NCSC incident management concentrates resources according to potential or realised national impact. The NCSC itself cautions that many businesses are not required to report breaches and that its data does not reflect the true number of cyber incidents affecting the UK.

A rise in nationally significant incidents can therefore coexist with broadly stable reported prevalence among businesses without creating a statistical contradiction. The two measures answer different questions: one concerns how common identified cyber activity is across organisations, while the other concerns how much serious activity reaches a threshold requiring national intervention.

The Datasets Should Be Treated as Parallel Filters

The attraction of combining Breaches Survey, ICO and NCSC figures is that they appear to form a pyramid, with a large population of attacks narrowing through reporting until only the most serious incidents reach national authorities. Conceptually, that is useful; statistically, it needs qualification.

The datasets do not contain the same underlying population. The Breaches Survey is based on a probability sample and extrapolates organisational experience to the wider business and charity populations. ICO statistics are administrative data generated through a particular regulatory regime. NCSC figures represent incidents reaching an operational national-security body through reporting, partner information and the organisation’s own information flows. Their reference periods, definitions and thresholds are also different.

They should therefore be understood as parallel observations of cyber activity rather than consecutive stages through which every incident passes. Detection acts as one filter, legal obligations and reporting decisions create another, while national significance creates a third. The same event may appear in several systems, one system or none of them.

That distinction prevents a tempting but unsupported calculation. It is not valid to take the survey estimate of 612,000 businesses identifying attacks, subtract ICO reports and then subtract NCSC cases to estimate the number of hidden incidents. The categories are neither mutually exclusive nor directly comparable, and the largest category of all, attacks that occur without being detected, cannot be measured directly.

The value of the model lies elsewhere: it shows why no single dataset can support a claim about total UK cyber exposure.

Organisational Observability Is Uneven

The visibility problem becomes more significant when organisational capability is considered. The Breaches Survey found that only 25% of businesses had a formal incident-response plan in place, while 45% had none of the incident-response measures tested by the survey. Larger companies were considerably more likely to have formal plans: 76% of large businesses and 57% of medium-sized businesses had one, compared with 21% of micro businesses.

Those differences affect more than the quality of the response after an incident. Organisations with established roles, escalation processes, logging, detection and incident procedures have a better chance of distinguishing routine technical problems from malicious activity, preserving evidence and deciding whether an external report is required.

This creates a measurement bias with direct policy implications. The organisations most capable of recognising cyber incidents can contribute disproportionately to the visible data, while businesses with weaker controls may appear less affected partly because less activity is observed. The survey’s higher prevalence rates among medium and large businesses should therefore be read alongside their greater organisational capability rather than interpreted solely as a distribution of threat.

For a regional economy with a substantial SME population, this is especially relevant. A low level of reported regional incidents would not, by itself, establish strong resilience. Without corresponding evidence about monitoring, governance, incident response and reporting behaviour, low visibility could indicate either low exposure or weak observability.

Better Reporting Will Improve the Picture but Not Complete It

UK policy is already moving towards greater reporting in parts of the economy. Under the government’s proposals for the Cyber Security and Resilience legislation, more harmful incidents affecting operators of essential services and relevant managed and digital service providers would become reportable, with an initial notification required within 24 hours and a fuller report within 72 hours. Regulators and the NCSC would receive the information simultaneously.

That should improve visibility in strategically important sectors and provide better information about systemic vulnerabilities. It will not, however, resolve the wider observability problem. Regulatory reporting is necessarily selective, because reporting every attempted phishing email, blocked probe or low-impact incident would create more noise than useful intelligence. Nor can mandatory reporting capture attacks that organisations never detect.

The policy challenge is therefore not simply to maximise reporting volume. More useful measurement requires clearer separation between prevalence, detection, consequence and disclosure, together with greater ability to analyse patterns across datasets without pretending that they measure identical phenomena.

Regional organisations can contribute to that process by generating evidence closer to operational experience. Anonymised intelligence about recurring SME problems, supply-chain incidents, common control failures and sector-specific dependencies could reveal patterns that national datasets necessarily aggregate. For the West Midlands, such evidence would be particularly valuable in understanding how cyber exposure manifests within manufacturing and interconnected supply chains, where operational disruption may be economically significant without reaching national incident thresholds.

Cyber Resilience Depends on Seeing Enough of the System

There will never be a definitive count of every cyber attack affecting UK organisations. Some attempts fail before reaching their target, some are blocked automatically, some succeed without detection, and others are discovered long after the original compromise. Even where incidents are known, differences in definitions and reporting obligations mean that no administrative system will capture the whole population.

The more useful objective is to understand the biases in what can be observed. The Cyber Security Breaches Survey provides a broad estimate of incidents organisations recognise; regulatory reporting captures particular classes of harm; and NCSC data provides a view of serious activity with national implications. Each contributes evidence that the others cannot provide, but each also has boundaries that need to be respected.

For the West Midlands, the unresolved question is whether regional cyber capability can be measured with greater precision than national datasets currently allow. That requires attention not only to reported incidents but to the mechanisms that determine visibility: monitoring, incident-response maturity, supply-chain information sharing and the ability of smaller organisations to recognise when a security event warrants investigation.

The distinction has practical consequences for how resilience is assessed. If better detection can produce more recorded incidents, then declining incident counts are not necessarily evidence of improvement, while rising counts are not necessarily evidence of deterioration. A more credible assessment needs to combine exposure with the organisation’s ability to detect, contain, recover from and learn from incidents.

That shifts the analytical problem from counting what reaches the surface to understanding how much confidence can reasonably be placed in the picture beneath it. For regional cyber strategy, improving that visibility is not merely a measurement exercise; it is part of improving resilience itself.