West Midlands Cyber
Join the Cluster

Cyber Security Breaches Survey 2026

The latest UK data suggests stability in cyber incidents, but the headline masks persistent exposure, uneven detection and significant differences in organisational capability.

Contents

Table of Contents

Cyber Security Breaches Survey 2026: What Businesses Need to Know

The 2025/26 Cyber Security Breaches Survey presents a picture of a threat environment that remains widespread while organisational responses improve only unevenly. Published by the Department for Science, Innovation and Technology and the Home Office on 30 April 2026, the survey found that 43% of UK businesses identified a cyber security breach or attack during the previous 12 months, unchanged from 2024/25 and equivalent to approximately 612,000 businesses. The apparent stability follows a fall from 50% in 2023/24, although methodological changes mean the current prevalence measure should only be compared directly across those three survey years.

The headline percentage captures only part of the story. Phishing continues to dominate identified attacks, larger businesses report substantially greater exposure than smaller organisations, and most businesses have adopted several basic technical controls. Yet formal risk assessment, supply-chain scrutiny, incident planning and preparation for AI-related security risks remain much less common. The survey therefore describes an environment in which cyber security has become an established management concern without becoming an equally established management discipline.

The originating analysis, The UK Cyber Security Breaches Survey 2025/26: Stagnation, Scale, and the Illusion of Progress, examined this gap between apparent stability in the headline measures and the much less uniform picture underneath. The distinction is particularly relevant to the West Midlands, where SMEs operating within manufacturing and other interconnected supply chains may be exposed not only through their own systems but through customers, suppliers and technology providers.

What does this mean for your business? The West Midlands Cyber Hub turns the findings of the 2026 Cyber Security Breaches Survey into five practical priorities for smaller organisations looking to strengthen their cyber resilience, in the companion article “Cyber Security Breaches Survey 2026: Five Actions for West Midlands SMEs”.

Key Takeaways

  • Some 43% of UK businesses identified a breach or attack in 2025/26, unchanged from the previous year and equivalent to an estimated 612,000 businesses, although unidentified attacks mean actual exposure is likely to be higher.
  • Basic controls are widely adopted, but only 30% of businesses conducted a cyber risk assessment, 25% had a formal incident-response plan and 15% reviewed cyber risks from immediate suppliers.
  • Nearly a third of businesses were using, adopting or considering AI, yet only 24% of that group had cyber security practices or processes in place to manage AI-related risks.
  • Cyber crime is highly concentrated among repeat victims: 20% of affected businesses identified between 11 and 99 cyber crimes during the year and 5% identified 100 or more.
  • For West Midlands businesses, the most significant gaps lie increasingly in governance, incident preparedness and supply-chain assurance rather than the absence of basic security technology.

The Headline Rate Is Stable, but Exposure Is Uneven

The survey found that 43% of businesses identified at least one breach or attack during the preceding year. Business size remains strongly associated with reported prevalence: 42% of micro businesses and 46% of small businesses identified an incident, compared with 65% of medium-sized organisations and 69% of large businesses.

Those differences need careful interpretation. Larger organisations generally have more employees, systems, suppliers and digital services, creating a larger potential attack surface. They are also more likely to possess monitoring systems, security specialists and formal processes capable of identifying activity that might remain unnoticed in a smaller organisation. DSIT explicitly notes that lower prevalence among smaller businesses may partly reflect poorer identification and reporting practices rather than lower underlying exposure.

The national figure therefore measures identified experience rather than total hostile activity. The survey itself cautions that breaches and attacks may remain hidden or unidentified, meaning its prevalence estimates are likely to understate the full extent of the problem.

That qualification is particularly important when interpreting the unchanged 43% rate as evidence of progress or deterioration. Stability could reflect several simultaneous effects, including changing attack volumes, better prevention, stronger detection or shifts in the types of attack organisations encounter. The survey provides evidence about each of these dimensions, but the headline percentage cannot distinguish between them by itself.

Phishing Dominates the Recorded Threat

Phishing remains by far the most frequently identified attack type. Thirty-eight per cent of all businesses reported phishing during the previous year, compared with 12% identifying impersonation attacks and much smaller proportions reporting technically intrusive categories such as ransomware. Among businesses experiencing any breach or attack, phishing was considered the most disruptive form by 69%.

There are signs of movement within this pattern. Ransomware was identified by 1% of businesses in 2025/26, down from 3% in both 2024/25 and 2023/24. Phishing prevalence also declined from 42% two years earlier to 38%, although it was not significantly different from the preceding year. At the same time, the proportion of breached businesses experiencing phishing and no other measured form of attack increased from 45% to 51%.

The resulting picture is one of concentration rather than diversification in the attacks most commonly visible to businesses. Phishing can be attempted cheaply and repeatedly and can support credential theft, fraud, impersonation and subsequent compromise. Its continued prevalence also means that investment in sophisticated security technologies does not remove the need for effective identity controls, authentication, staff awareness and processes for handling suspicious communications.

For businesses, however, frequency should not be confused with consequence. A blocked phishing message and a ransomware incident that interrupts operations both contribute to cyber security statistics in different ways, but their economic effects are not comparable. Understanding exposure therefore requires attention to what happens after an attack as well as how often attacks are encountered.

Cyber Crime Is Concentrated Among Repeat Victims

The survey separately measures cyber crime, which is a subset of the wider breaches and attacks captured elsewhere in the research. Nineteen per cent of businesses identified at least one cyber crime during the year. DSIT estimates that UK businesses experienced approximately 5.19 million cyber crimes in total, although it cautions that this extrapolation has a wide margin of error because the mean is affected by a relatively small number of organisations experiencing very high volumes.

The distribution explains why the aggregate estimate is so large. Among businesses experiencing cyber crime, one third identified a single incident and 42% experienced between two and ten. A further 20% identified between 11 and 99 cyber crimes, while 5% reported 100 or more. The median was three incidents, whereas the mean was 19, demonstrating how strongly repeat victimisation among a minority of organisations influences the overall scale estimate.

This distinction has practical implications for risk management. A national average can conceal organisations that experience persistent targeting because of their sector, digital footprint, customer relationships or previous compromise. For those businesses, cyber risk is not well represented by an annual probability of experiencing an incident; it is a recurring operational condition that needs continuous management.

The concentration of activity also argues against interpreting the estimated 5.19 million incidents as though they were evenly distributed across the economy. Most businesses do not experience anything close to the mean. A smaller group accounts for a disproportionate amount of identified cyber crime, making repeat victimisation an important subject for further sectoral and regional analysis.

Basic Technical Controls Are Ahead of Formal Risk Management

Most businesses now report several established cyber hygiene measures. Eighty-one per cent had up-to-date malware protection, while 74% used secure cloud backups, 74% had password policies, 74% used network firewalls and 73% restricted administrative rights. More advanced controls were less common: 47% used two-factor authentication, 36% had virtual private networks for remote access and 30% monitored users.

The contrast with formal risk-management practice is substantial. Only 30% of businesses conducted a cyber security risk assessment, almost unchanged from 29% the previous year. Although 72% considered cyber security a high priority for senior management, only 31% assigned board-level responsibility.

This gap indicates that adoption of security technology has advanced further than the governance structures needed to manage cyber risk systematically. Installing anti-malware software or enabling backups addresses identifiable technical problems; risk assessment requires an organisation to understand its systems, dependencies, threats and potential business consequences, then revisit those judgements as operations change.

Small businesses provide a particularly useful warning against assuming that maturity moves consistently in one direction. In 2025/26, 41% of small businesses conducted a cyber risk assessment, down from 48% the previous year. The proportion with a formal cyber security policy fell from 59% to 52%, while those with business-continuity plans covering cyber security declined from 53% to 44%.

These changes do not establish a general deterioration in SME cyber resilience, but they demonstrate that practices can regress as well as improve. Capability requires maintenance, particularly when responsibilities compete with other commercial priorities.

Supply-Chain Assurance Remains a Significant Weakness

The disparity between internal controls and external dependency becomes clearer in the survey’s supply-chain findings. Only 15% of businesses formally reviewed cyber risks associated with their immediate suppliers, while 6% examined risks in the wider supply chain.

Business size again produces a marked difference. Immediate supplier risk was reviewed by 12% of micro businesses and 22% of small businesses, compared with 30% of medium-sized organisations and 48% of large businesses. Even among the largest firms, therefore, supplier cyber assessment was not universal.

For the West Midlands, these figures have particular economic significance because manufacturing and engineering activity frequently depends on extended supplier networks. Digital relationships can include shared platforms, electronic data exchange, remote support, logistics systems, software providers and specialist subcontractors. The security of an individual organisation consequently provides only a partial indication of the resilience of the commercial system in which it operates.

This creates an asymmetry for SMEs. Smaller suppliers may have comparatively limited resources for formal cyber governance while increasingly being asked by larger customers to demonstrate security maturity. The resulting pressure is likely to make cyber assurance more relevant to procurement and supplier qualification, particularly where disruption could affect production or contractual delivery.

The regional policy issue is therefore broader than encouraging SMEs to adopt additional controls. Businesses need practical routes to understanding customer requirements, assessing their own exposure and producing credible evidence of security without imposing assurance costs disproportionate to their size.

Incident Preparation Lags Behind Incident Experience

The survey also identifies a substantial gap in formal preparation for cyber incidents. Only 25% of businesses had an incident-response plan, although adoption increased sharply with size, reaching 57% among medium businesses and 76% among large businesses. Forty-five per cent of all businesses had none of the incident-response measures examined by the survey.

This sits uneasily alongside the prevalence data. Hundreds of thousands of businesses identify attacks each year, yet formal preparation for dealing with a serious compromise remains a minority practice. Organisations frequently respond when something happens: among businesses that experienced a breach or attack, 81% informed directors or senior managers, 62% maintained an internal record and 61% took action intended to prevent recurrence. The weakness lies more in preparation before the event than the complete absence of reaction afterwards.

Cost data helps explain why preparedness can be undervalued. The median perceived cost of the most disruptive breach or attack was £0, and most organisations reported relatively modest direct costs. At the 95th percentile, however, perceived cost reached £4,000 for businesses overall and £10,000 among medium and large businesses. The survey also recorded increases in businesses reporting lost revenue or share value, from 2% to 5%, and reputational damage, from 1% to 3%.

These figures should not be interpreted as a comprehensive estimate of economic loss: the survey measures perceived costs and acknowledges that rare, high-cost incidents are difficult to capture robustly. They nevertheless illustrate a familiar risk distribution in which routine incidents may have little direct consequence while a smaller number generate much more serious disruption. Preparedness is principally intended for that tail of the distribution.

AI Adoption Is Running Ahead of AI Security Practice

One of the survey’s more significant new indicators concerns artificial intelligence. Thirty-one per cent of businesses were already using AI, adopting it or actively considering its use. Among that group, only 24% reported having cyber security practices or processes in place specifically to manage risks associated with the technology.

The mismatch is more informative than either figure separately. AI adoption introduces additional relationships with organisational data, software, external models, cloud infrastructure and third-party platforms. Some of the associated risks are extensions of established cyber disciplines, including access management, data governance and supplier assurance, while others relate more specifically to how AI systems are developed, configured and used.

The survey does not establish that organisations without AI-specific processes are operating insecurely, nor does it measure the effectiveness of the controls reported by those that have them. It does, however, show that explicit consideration of AI-related cyber risk is substantially less common than adoption or planned adoption.

For a region seeking productivity gains through advanced technology, that gap deserves attention. AI implementation in manufacturing, professional services and technology businesses will increasingly take place within existing digital estates rather than in isolated experimental environments. Security governance therefore needs to develop alongside adoption if new capability is not to add poorly understood dependencies to already complex systems.

The Priority Is to Close the Governance Gap

The 2025/26 survey does not support a narrative in which UK business cyber security is simply failing. Basic technical controls are widespread, two-factor authentication has increased among micro businesses, Cyber Essentials certification is becoming more common, and some attack categories have declined. Nor does it justify complacency based on a stable headline breach rate. The same dataset shows persistent weaknesses in risk assessment, incident planning, supplier scrutiny and preparation for emerging technology.

For West Midlands organisations, the next stage of maturity is therefore less about accumulating disconnected security products and more about converting technical protection into an organised management capability. That involves understanding which systems and suppliers are operationally important, assigning responsibility, assessing risk, preparing for disruption and being able to demonstrate appropriate controls where customers or regulators require assurance.

The regional dimension becomes most important where individual organisational weaknesses can propagate through commercial relationships. An SME with limited cyber governance may nevertheless supply a major manufacturer; an IT provider may support dozens of regional businesses; a compromised account may provide access to shared platforms; and an inadequately governed AI service may introduce dependencies that neither buyer nor supplier has fully assessed. Resilience at that level cannot be inferred from the presence of anti-malware software or a firewall.

The 2025/26 survey consequently points towards a more useful test of progress than next year’s breach percentage. Improvement would be visible in a greater proportion of organisations assessing risk systematically, preparing for incidents, understanding supplier dependencies and integrating security into technology adoption. Those measures would not eliminate hostile activity, but they would provide stronger evidence that businesses are becoming better able to prevent routine attacks from developing into serious operational and economic disruption.