West Midlands Cyber
Join the Cluster

Ten Years of UK Cyber Breaches

Ten years of government cyber-security data reveal a mixed picture. Awareness has increased, but persistent attack methods and uneven organisational maturity suggest that exposure has become normalised rather than eliminated.

Contents

Table of Contents

A Decade of UK Cyber Breaches: What Has Actually Changed?

The UK Cyber Security Breaches Survey has now accumulated a decade of evidence about how businesses understand, experience and manage cyber risk. That longitudinal record is more useful than any single annual headline because it allows changes in attack methods, governance and defensive practice to be separated from short-term movements in reported breach prevalence.

The central finding is not a simple story of either improvement or deterioration. Since the breach question took its current broadly comparable form in 2017, the proportion of businesses identifying a breach or attack has fluctuated considerably, from 46% in 2017 to 32% in 2019, back to 46% in 2020, and 43% in 2025/26. Government statisticians have repeatedly cautioned that these figures measure attacks organisations identify rather than total underlying exposure, while changes in detection, working practices and survey methodology complicate comparisons across the full period.

The more revealing trends sit beneath the headline prevalence rate. Phishing has become the dominant form of identified attack; basic technical controls have become commonplace without becoming universal; formal risk management and incident planning remain uneven; and larger organisations continue to display substantially greater governance and detection capability than smaller firms. The originating analysis, A Decade of the UK Cyber Security Breaches Survey: Trends, Plateaus, and What Actually Changed, described this as a form of stabilisation rather than straightforward progress: cyber exposure has become an established feature of organisational life while improvements in organisational maturity have advanced unevenly.

For the West Midlands, that distinction is particularly relevant because the regional economy contains large numbers of smaller businesses alongside complex manufacturing and supply-chain relationships. National averages can obscure significant differences in capability between organisations, yet those differences increasingly affect the resilience of commercial relationships as well as the individual firms concerned.

What does this mean for your business? The West Midlands Cyber Hub translates a decade of UK cyber breach evidence into practical lessons for smaller organisations across the region, in the companion article “Ten Years of Cyber Breaches: What West Midlands SMEs Can Learn”.

Key Takeaways

  • Since 2017, identified breach prevalence among UK businesses has fluctuated rather than followed a sustained downward trajectory, returning to 43% in 2025/26 after several pronounced rises and falls.
  • The composition of identified attacks has changed substantially: among breached businesses, phishing rose from 72% in 2017 to become overwhelmingly dominant, while conventional malware became less prominent.
  • Governance has improved from the early years of the survey, but maturity remains incomplete: only 30% of businesses conducted a cyber risk assessment and 25% had a formal incident-response plan in 2025/26.
  • Business size remains one of the clearest dividing lines in the data, with 69% of large businesses identifying breaches or attacks in 2025/26 compared with 42% of micro businesses, alongside substantial differences in governance and response capability.
  • The decade-long record supports a more demanding definition of progress based on resilience, detection and recovery rather than expecting breach prevalence alone to decline steadily.

Breach Prevalence Has Fluctuated Rather Than Fallen

The first difficulty in interpreting a decade of Breaches Survey data is comparability. The 2016 survey used a materially different approach to recording breaches, and subsequent government reports explicitly state that its prevalence findings should not be compared directly with results from 2017 onwards. The defensible longitudinal series for the current breach measure therefore begins in 2017 rather than treating every percentage published since the survey’s inception as equivalent.

Within that comparable period, the pattern is strikingly unstable. In 2017, 46% of businesses identified a breach or attack during the preceding 12 months. The figure declined to 43% in 2018 and 32% in 2019 before returning to 46% in 2020. It fell again to 39% in 2021. The 2021 report itself observed that prevalence had typically been slightly above four in ten since 2017, with 2019 and 2021 representing exceptions to that broad pattern.

The latest data fits that interpretation. Business prevalence fell from 50% in 2023/24 to 43% in 2024/25 and remained at 43% in 2025/26, equivalent to an estimated 612,000 UK businesses identifying at least one breach or attack. DSIT does not interpret that stability as proof that underlying hostile activity has stabilised, because the survey can record only incidents organisations recognise and disclose.

The decade-long series therefore provides little basis for claiming a sustained reduction in exposure. Equally, it would be too strong to infer from the persistence of the headline rate that defensive investment has achieved nothing. An organisation can become considerably better at preventing serious compromise, detecting attempted attacks and recovering from incidents while continuing to report that it encountered at least one breach or attack during a year. Prevalence is valuable, but it is not a complete measure of resilience.

Phishing Has Become the Persistent Entry Point

The composition of identified attacks provides a clearer long-term signal. In 2017, 72% of businesses that had identified a breach or attack reported phishing, while 33% reported viruses or other malware. By 2021, phishing among breached businesses had increased to 83%, while viruses or other malware had fallen to 9% and ransomware from 17% to 7%.

By 2025/26, phishing was identified by 38% of all businesses and accounted for the overwhelming majority of the cyber-crime experience captured by the survey. Among businesses identifying any breach or attack, 51% experienced phishing and no other category of attack measured by the survey, up from 45% the previous year. The qualitative research also found a perception among interviewees that phishing had become easier for attackers to conduct at volume.

The decline of some traditional malware categories alongside the persistence of phishing illustrates how the threat has adapted to defensive practice. Improvements in endpoint protection, operating-system security and other technical controls have altered parts of the attack surface, but attackers have continued to exploit identity, communication and human decision-making. Phishing is inexpensive to conduct at scale and can support credential theft, fraud, impersonation and subsequent compromise without requiring an attacker to defeat every technical control directly.

There is also a measurement consequence. If a common attack method can be attempted cheaply and repeatedly, successful cyber security does not necessarily mean that organisations stop encountering it. A business may block hundreds of malicious messages and still identify phishing as an attack during the survey period. The persistence of phishing therefore demonstrates both continuing hostile activity and the limitations of using attack prevalence as the sole indicator of defensive performance.

Basic Technical Controls Have Become Normal but Not Universal

One of the clearest forms of progress over the decade is the wider adoption of basic cyber hygiene. The 2020 survey, for example, found that the proportion of businesses saying they never updated software had fallen from 26% in 2016 to 17% in 2020. Cloud backup adoption had also increased substantially from its earlier baseline. At the same time, more businesses were seeking cyber guidance and conducting risk assessments than in the survey’s first years.

By 2025/26, 81% of businesses reported up-to-date malware protection, 74% used secure cloud backup, 74% had password policies and 74% used network firewalls. Restricted administrative rights were reported by 73%. These figures show that several controls once associated with comparatively deliberate security practice have become normal features of business IT.

The gaps become clearer when moving beyond the most established controls. Two-factor authentication was used by 47% of businesses, virtual private networks for remote staff by 36%, and user monitoring by 30%. Only 24% of businesses reported having controls across all five technical areas associated with Cyber Essentials, while 5% held Cyber Essentials certification itself. Certification had nevertheless risen from 3% the previous year, including a particularly large increase among small businesses from 5% to 12%.

This produces a more nuanced picture than either stagnation or continuous improvement. Technical hygiene has advanced materially across the decade, but adoption is uneven and the baseline itself has moved. Businesses now depend on cloud services, remote access, software supply chains and other digital infrastructure to a degree that was less pronounced when the survey began. Better controls are therefore being applied to organisations whose technological dependencies have simultaneously become more extensive.

Governance Improved Early but Has Not Matured at the Same Rate

The early surveys recorded meaningful gains in management attention. The proportion of businesses with a board member responsible for cyber security rose from 28% in 2016 to 37% in 2020 and 38% in 2021. Over a similar period, the proportion conducting cyber risk assessments increased from 23% in 2016 to 35% in 2020, while written cyber security policies rose from 29% to 38%.

Those early gains did not translate into universal or steadily increasing formal governance. In 2025/26, 72% of businesses considered cyber security a high priority for senior management, but only 31% had board-level responsibility for it. The latter figure had risen from 27% the previous year, reversing an earlier downward trend, yet it remained well below the level of stated senior-management prioritisation.

The gap is also visible in risk management. Only 30% of businesses conducted a cyber security risk assessment in 2025/26. Supply-chain scrutiny was considerably less common: 15% reviewed cyber risks associated with immediate suppliers and only 6% considered their wider supply chain. Among large businesses, immediate-supplier review reached 48%, compared with 12% of micro businesses and 22% of small businesses.

These figures distinguish awareness from institutionalisation. Senior leaders can regard cyber security as important without the organisation having formalised responsibility, assessed risk systematically or extended governance into supplier relationships. Over the decade, cyber has clearly moved further into mainstream management attention; the harder transition has been from recognition to repeatable organisational practice.

Business Size Continues to Divide Cyber Capability

The persistent relationship between organisational size and reported breach prevalence is one of the most consistent features of the survey series. In 2025/26, 42% of micro businesses and 46% of small businesses identified a breach or attack, compared with 65% of medium businesses and 69% of large businesses. The same broad pattern has appeared throughout the series.

Exposure provides part of the explanation. Larger organisations tend to have more employees, systems, suppliers and digital interactions, increasing the number of opportunities for hostile activity. Detection capability provides another. Organisations with security teams, centralised monitoring, formal reporting processes and specialist suppliers are more likely to recognise activity that a smaller business may never classify as a cyber incident. The survey therefore cannot be used to conclude simply that large businesses are less secure because they identify more attacks.

Governance indicators show the opposite side of this size effect. In 2025/26, 57% of medium businesses and 70% of large businesses had a formal cyber security strategy. Formal incident-response plans were held by 57% of medium businesses and 76% of large businesses, compared with 21% of micro businesses. Board-level responsibility reached 68% among large businesses.

The result is a persistent capability gradient. Smaller organisations may face fewer absolute points of exposure, but they are also less likely to possess the formal structures required to assess, detect and manage incidents. This has particular relevance to the West Midlands because SMEs frequently participate in supply chains where their digital relationships connect them to much larger customers. The cyber capability of the chain is consequently not determined solely by the maturity of its largest members.

Incident Response Remains a Significant Maturity Gap

A decade of defensive investment has improved many preventive controls, but the latest survey indicates that preparation for incidents remains less developed. Only 25% of businesses had a formal incident-response plan in 2025/26. Thirty-nine per cent had assigned incident roles and responsibilities, 34% had written guidance on whom to notify and 32% had guidance covering when incidents should be reported externally. Almost half of businesses, 45%, had none of the incident-response measures tested by the survey.

Actual experience does prompt action. Among businesses identifying a breach or attack, 81% informed directors or senior managers, 62% kept an internal record and 61% took some action intended to prevent future incidents. Yet external reporting occurred for only 40% of the most disruptive incidents.

The distinction between reactive behaviour and prior preparation is important. An organisation can improvise effectively after a relatively minor event without possessing the structures required for a more disruptive compromise. Formal planning establishes responsibilities, escalation thresholds, communications arrangements and decision-making before an incident places the organisation under operational pressure.

For regional resilience, this may be a more useful maturity indicator than the annual prevalence rate. An economy cannot realistically eliminate routine hostile activity, particularly phishing and other attacks that can be attempted at very low cost. It can, however, improve the ability of organisations to identify serious incidents, limit their consequences and restore operations.

Supply-Chain Risk Has Outgrown Organisational Boundaries

The survey began in a period when much business cyber guidance was framed primarily around the security of an individual organisation. Over the subsequent decade, cloud services, outsourced IT, managed service providers, digital platforms and increasingly integrated supply chains have made that boundary less meaningful.

The 2025/26 figures show that governance has not fully caught up with this dependency. Although 30% of businesses conducted a cyber risk assessment, only half that proportion reviewed the cyber risk presented by immediate suppliers, and fewer than one in ten examined their wider supply chain.

For an industrial economy such as the West Midlands, that gap has particular significance. Manufacturing and engineering supply chains can connect smaller firms to large customers through shared data, software, remote access, logistics and production dependencies. A supplier does not need privileged access to a customer’s core systems to become operationally significant; disruption to a specialised component, service or data flow can itself affect continuity.

The decade-long evolution of cyber risk therefore increasingly challenges an organisation-by-organisation model of resilience. Improvements in individual technical controls remain necessary, but the economic consequence of a cyber incident can propagate through commercial dependencies that are only partially visible to the affected organisations.

Progress Should Be Measured Through Consequence and Resilience

The Cyber Security Breaches Survey has become considerably richer since its first publication, but the decade-long record does not support a simple expectation that successful cyber policy should produce a steadily declining headline breach rate. The attack environment, organisational technology and detection capability are all changing simultaneously.

The latest survey provides a useful example. Forty-three per cent of businesses identified a breach or attack, yet only 19% of businesses experiencing one reported a negative outcome of the types measured. At the same time, the proportion reporting lost revenue or share value following an incident increased from 2% to 5%, while reported reputational damage rose from 1% to 3%. Most incidents produced little or no perceived direct financial cost, but a minority generated substantially larger losses.

Cyber crime provides another perspective. An estimated 19% of businesses experienced at least one cyber crime during the year, broadly consistent with 22% in 2023/24 and 20% in 2024/25. DSIT estimates approximately 5.19 million cyber-crime events against UK businesses, reflecting significant repeat victimisation among some organisations.

These measures point towards a better framework for judging progress. The relevant questions are increasingly whether organisations detect serious activity, whether attacks translate into material harm, whether essential operations can continue, how quickly affected organisations recover and whether incidents expose vulnerabilities across suppliers or customers. A business that encounters phishing but prevents compromise is in a fundamentally different position from one that fails to identify an intrusion until operations are disrupted, even though both may contribute to a breach-prevalence statistic.

A Decade of Data Points to Uneven Maturity Rather Than Simple Stagnation

The strongest conclusion from ten years of Breaches Survey evidence is more qualified than saying that nothing has improved. Basic technical controls are more established than they were at the beginning of the series, management awareness increased substantially during its early years, and the composition of attacks has changed as defensive technology and attacker behaviour have evolved. Those developments represent genuine change.

The unresolved problem is that organisational maturity has not advanced evenly. Formal risk assessment remains a minority practice, incident planning is far from universal, supply-chain scrutiny is limited and substantial differences persist between small and large businesses. Meanwhile, the technological environment that those controls must protect has become more dependent on external services, connected systems and digital supply chains.

For the West Midlands, the implication is that regional cyber resilience cannot sensibly be judged by asking whether fewer organisations report attacks next year. A stronger test would examine whether smaller firms are closing the capability gap, whether supply-chain risks are being assessed more systematically, whether incident-response preparation is improving and whether organisations can prevent routine hostile activity from becoming economically disruptive.

A decade of data has therefore changed the question. The relevant measure of progress is no longer simply how many organisations encounter cyber attacks, but how effectively the economy absorbs them without allowing routine exposure to become material harm.