UK Small Business Cyber Attacks: Why More Spend Isn’t Working

13

Key Takeaways

• UK Small Firms report a 38% annual attack rate, the highest of any market Hiscox surveyed globally.
• Britain ranks third worldwide for cyber resilience spend yet still records the worst breach frequency.
• Detection Time drives cost most: breaches exceeding 200 days average $1.33 million more than faster ones.
• Phishing alone caused 51% of UK breaches, while reported ransomware fell to just 1%.
• Incidents delayed growth plans for 32% of affected firms, making cyber a strategic constraint.
• Fortray Tech delivers UK-focused managed detection, email security, and compliance services that measurably shorten response times.

British firms are now among the world’s highest spenders on cyber resilience, and among the most frequently breached. Both facts come from the same dataset, which makes the standard budget conversation considerably harder to hold.

The Hiscox Cyber Readiness Report 2026, drawn from nearly 7,000 cybersecurity decision-makers including 1,000 in the UK, found that 38% of small UK businesses reported a successful hack in the past 12 months. That is the highest rate of any market surveyed, compared with a global average of 29%. Those same UK firms spent an average of £44,294 on resilience measures, the third-highest spend of any country in the study.

This implies that: more money, worse outcomes. That is not an argument for spending less. It is an argument for spending on different things, and for measuring different outcomes. Here is where the gap sits.

What The 2026 UK Attack Data Actually Shows

The Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in the last 12 months, roughly 612,000 organisations. That rate has now held steady year on year rather than falling, which is the more troubling reading: attack volume has not peaked and receded; it has settled into a permanent baseline.

The cost picture is equally specific. Hiscox puts the average UK cost per incident at £26,650, below the global average of £45,000, but arrived at from a far higher attack rate. UK firms pay less per hit and get hit more often. Globally, affected organisations reported an average of four incidents in the year and roughly 32 hours of operational disruption per event.

For a 60-person professional services firm billing at £95 an hour, 32 hours of disruption is not an IT metric. It’s closer to £180,000 in unbillable capacity before a single recovery invoice arrives.