Cyber risk is no longer an exceptional event for British companies. It is becoming a normal cost of doing business.
More than two-fifths of UK businesses suffered a cyber breach or attack in the past year, according to the government’s latest Cyber Security Breaches Survey. The report found that 43% of businesses were hit in 2025/26, equal to about 612,000 companies. The rate was unchanged from the previous year.
That is the important signal. The headline figure is not rising, but it is not falling either. Cyber risk has settled into the operating environment.
Cybersecurity is now part of the cost base
For companies, a cyber breach is not only an IT problem. It can stop operations, delay payments, expose customer data and damage trust. It can also increase spending on security software, insurance, staff training and recovery systems.
That makes cybersecurity part of the fixed cost structure, especially for smaller businesses with limited budgets and fewer technical staff.
Phishing remains the main threat. The government survey found that 38% of businesses reported phishing attacks, the same rate as in 2024/25. Phishing was also identified as the most disruptive type of breach or attack among affected businesses and charities.
This matters because phishing does not require a complex technical failure. It often begins with a convincing email, a fake login page or a manipulated invoice. The entry point is simple. The financial damage can be serious.
AI lowers the cost of cybercrime
The UK government has warned business leaders that the threat environment is shifting. Ministers have urged companies to act as AI makes cyberattacks easier to scale and harder to detect.
AI can help attackers write more convincing phishing messages, automate parts of an attack and test systems faster. That lowers the barrier for less sophisticated criminals and increases the volume of potential threats.
For businesses, the conclusion is clear. Defences that looked adequate a few years ago may no longer be enough.
State-linked attacks raise the stakes
The risk is not limited to criminal groups.
The head of Britain’s cyber security agency has warned of a possible rise in cyberattacks linked to hostile states. That adds a geopolitical layer to what many companies still treat as a technical issue.
Cybersecurity is now tied to national security, supply chains and economic resilience.
Energy, transport, finance, healthcare and logistics are especially exposed. Disruption in those sectors can move quickly through the wider economy.
Cyber risk is now permanent
The message for UK business is direct. Cyber breaches are no longer rare shocks. They are a permanent operating risk.
Companies that delay investment may protect cash in the short term. But one serious breach can cost far more than basic protection, staff training and recovery planning.