What the 2026 Cyber Security Breaches Survey means for small businesses

Every spring the UK government publishes the Cyber Security Breaches Survey, and every spring the headline numbers are easy to skim past. The 2025/2026 edition, published on 30 April 2026, is worth a slower read if you run a small business. It tells you how often firms like yours are hit, what usually goes wrong, and which basic protections owners are quietly dropping. This post pulls out the figures that matter and turns them into things you can do this week.

The headline: roughly four in ten businesses were hit

According to the survey, 43% of businesses reported a cyber breach or attack in the last 12 months, which is roughly 612,000 businesses. That is level with the previous year, after a fall from 50% in 2023/2024. So things are not getting worse, but they are not getting better either.

Size matters less than you might hope. The survey found 42% of micro businesses and 46% of small businesses reported a breach or attack, compared with 65% of medium and 69% of large businesses. Bigger firms are hit more often, but a business with a handful of staff still has close to a coin-flip chance of seeing something in any given year.

Phishing is still the main way in

Phishing, meaning fake emails, texts or calls designed to trick someone into handing over a password or money, affected 38% of businesses. Among businesses that were hit, 69% said phishing was the most disruptive type of incident they faced. Ransomware, by contrast, affected 1% of businesses, down from 3% in the two previous years.

The practical lesson is that the biggest risk is usually not a sophisticated technical attack. It is an ordinary person on an ordinary Tuesday clicking a convincing message. The NCSC publishes a guide called "Phishing scams: how to spot and report them", and its advice is simple: banks will not ask for personal details by email, so contact them using a number you found yourself rather than one in the message.

What it actually cost

This part is more reassuring than many owners expect. The median perceived cost of the most disruptive breach was £0 for businesses overall. For the costliest 5% of cases, the perceived cost was £4,000 for all businesses and for micro and small businesses. Among medium and large businesses it was £10,000 at the same point.

Do not read that as "it does not matter". These are the owners' own estimates, and the survey also found that 19% of businesses reported a negative outcome from a breach. A median of nothing hides a tail of firms that lost real time, money or customer trust. The aim is to stay in the large group that shrugged it off.

Small businesses are slipping on the basics

The most useful finding for owners of small firms is that some good habits have gone backwards. Among small businesses, the survey reports that:

• risk assessments fell to 41%, down from 48%
• a formal cyber security policy fell to 52%, down from 59%
• business continuity plans that cover cyber fell to 44%, down from 53%

Micro businesses, by contrast, improved in places. Two-factor authentication rose to 43% from 35%, using only company-owned devices rose to 64% from 58%, and using an external cyber security provider rose to 44% from 39%. Two-factor authentication is the cheapest item on that list and one of the most effective, so if you are in the 57% without it, that is your first job.

Almost nobody has a plan for when it happens

Only 25% of businesses have a formal incident response plan. Among micro businesses the figure is 21%, compared with 57% for medium businesses and 76% for large ones. If something goes wrong on a Friday afternoon, most small firms are making it up as they go.

A plan does not need to be long. One page can answer the questions you will not want to think about under pressure: who do we call, which accounts do we lock first, where are the backups, and how do we tell customers. The NCSC points small organisations to its "Small Business Guide: Response and Recovery" and to Exercise in a Box, a free tool for rehearsing how you would respond to an attack. It also says organisations should plan for cyber incidents as part of general risk planning, and recommends not paying a ransom, since payment does not guarantee you get your data back and makes you a target again.

One commentator quoted in IT Brief, Ross McKean of DLA Piper, suggests defining your "minimum viable business": the smallest set of systems you need to keep trading, with tested workarounds for when your main systems are offline. For a small shop or agency that might simply be email, your card payment provider and a shared list of customer orders.

Your suppliers are part of your security

The survey found only 15% of businesses reviewed the cyber risks posed by their immediate suppliers, and 6% looked at their wider supply chain. Among micro businesses the supplier review figure was 12%, and among small businesses 22%.

For a small business, "suppliers" means the website host, the payment provider, the booking or ordering system, your accountant's portal and any freelancer with access to your accounts. A short list of who has access to what, and who you would contact if one of them had a problem, is a perfectly sensible review. If your website or ordering platform is built and hosted by someone else, ask them plainly how it is kept updated and backed up. If you want help on that front, our cloud and security team works with local businesses on exactly this.

Cyber Essentials and AI

Only 5% of businesses hold Cyber Essentials, the government-backed certification scheme, up from 3% the previous year. The rate is 12% among small businesses and 35% among large ones. You do not need it to be safe, but working through its requirements is a structured way to check the basics.

On AI, the survey found 31% of businesses are using, adopting or considering it, but only 24% of those have practices in place to manage the cyber risks that come with it. In plain terms: before staff paste customer details into a chatbot, agree what is and is not allowed.

What to do this week

• Turn on two-factor authentication for email, banking, your website admin and your accounting software.
• Write a one-page incident plan with names, phone numbers and the order in which you would lock accounts.
• List your suppliers and who has access to your systems, then remove anyone who no longer needs it.
• Run the NCSC's free Check Your Cyber Security tool and work through the Cyber Action Toolkit's first steps for small businesses.
• Spend ten minutes with your team on spotting phishing, using the NCSC guide as the script.
• Agree a simple rule for what can be put into AI tools.

The mood among experts

Commentary on the results has been fairly flat. Tom Kidwell of Ecliptic Dynamics, speaking to IT Brief, called the findings "depressingly familiar" and said breach levels have not shifted and preparedness has not improved. That is a fair summary, and it is also an opportunity: if most of your competitors are not doing the basics, doing them puts you well ahead.

The survey only counts what organisations noticed and reported, so the true picture could be worse. Treat it as a prompt to spend an hour on the fundamentals, not a reason to worry.