So, time has flown by for this year and we’re steadily approaching September… well, maybe time hasn’t passed quickly for you, but it’s about that time to start reviewing the UK cyber breaches landscape. Specifically, the UK Governments 2026 Cyber Breach Survey.
What’s the most common threat in 2026? Has the frequency of attacks increased since 2025? And what does the latest government data tell us about where businesses are still falling short?
Let’s take a look.
43% of UK businesses reported experiencing a cyber breach or attack in the last 12 months.
At first glance, that might not sound so bad. The figure is effectively unchanged from the previous year’s 43%, following a significant drop from 50% in 2023/2024. The important point is that cyber attacks aren’t necessarily increasing year after year anymore. Instead, they’re sitting at a level where almost half of UK businesses are consistently being affected.
The latest Cyber Security Breaches Survey, published by the Department for Science, Innovation and Technology (DSIT) and the Home Office, estimates that this 43% represents approximately 612,000 UK businesses.
And importantly, these figures only include attacks that organisations were able to identify and were willing to report. The true number is likely to be higher.
Phishing continues to be the clear leader when it comes to attacks against UK businesses.
38% of all UK businesses reported experiencing a phishing attack in the last 12 months.
That makes phishing the primary route attackers are using to get through the door. While it’s tempting to think of phishing as a problem caused by obviously suspicious emails, the reality is becoming more complicated, as you’ll know if you’ve seen our Phishing YouTube series.
Attackers can now use AI and other tools to produce convincing messages, replicate branding and personalise their approach. The old warning signs of bad grammar, strange formatting and an a sender address like “@totallyMicrosoft123132132.com” are long gone.
The government survey itself found that interviewees perceived phishing as becoming easier for attackers to commit, contributing to a perceived increase in attack volumes.
Looking at the stats, we can still see that human error is still a massive cause of Cyber Breaches. Technical controls such as email filtering, MFA, endpoint protection and secure authentication all have an important role to play. But if an attacker can persuade someone to hand over their credentials or approve something they shouldn’t, even a well-protected business can find itself in trouble.
It’s easy to look at the current cyber security landscape and assume that every type of attack is becoming more common. The data doesn’t quite support that. In fact, some traditional threats have actually declined. For example, ransomware affected 1% of UK businesses in 2025/2026, down from 3% in both of the previous two surveys. Impersonation attacks also fell from 17% in 2023/2024 to 12% this year.
That doesn’t mean ransomware has suddenly become harmless. If anything, it demonstrates why simply counting attacks doesn’t tell the whole story. A relatively small number of ransomware attacks can still have a significant impact on the organisations that experience them. Meanwhile, phishing remains widespread because it doesn’t necessarily require sophisticated malware or an elaborate technical exploit, nowadays all it needs is someone to exploit an LLM…
There is one area where the latest survey does show a much broader range of attacks: further and higher education.
Among educational institutions that had experienced a breach or attack, phishing affected 96% of further and higher education organisations.
But the numbers for other attack types were also considerably higher than those seen across businesses generally:
These figures represent further and higher education institutions specifically, rather than UK businesses as a whole.
This is an important distinction because the threat landscape isn’t identical across every sector.
For most businesses, phishing remains overwhelmingly dominant. In sectors with large user bases, complex networks and significant amounts of sensitive information, attackers have more opportunities to diversify their approach.
The lesson isn’t that every business should suddenly start preparing for every conceivable cyber attack.
It’s that your cyber security strategy should reflect the risks your organisation actually faces.
There are some positive signs in the latest survey.
Cyber security was considered a high priority by senior management in 72% of UK businesses, broadly unchanged from last year.
More importantly, the proportion of businesses with a board member explicitly responsible for cyber security increased from 27% to 31%.
That’s progress, but it also means that almost seven in ten businesses still don’t have a board member with explicit responsibility for cyber security.
If last year was about awareness, this year is about stabilisation. The latest data doesn’t necessarily tell businesses that they need more tools, more software or a bigger IT budget, but it does show indicate shifting tides on both sides, and as usual, awareness is paramount, hence, why we made this blog!
Phishing remains dominant. Almost half of UK businesses experienced some form of cyber breach or attack. Supply chain risk remains poorly understood. And while board engagement is improving, the majority of businesses still don’t have explicit board-level responsibility for cyber security.
Will these stats increase or decrease for the 2026-2027 survey? Who can say, one thing is for certain though, cyber attacks are NOT stopping, so either way, they should be taken seriously.
We hope you enjoyed this blog! We release two weekly blogs on topics like IT and Cyber Security, as well as reviews like this. Stay safe!
