18/03/2026
Cybercrime is a pervasive and growing threat that affects businesses of all sizes. UK Government data shows that 43% of businesses[1] faced a cyber breach last year, demonstrating that small and medium-sized enterprises (SMEs) are not too small to be targets. Ransomware pressure is also rising, placing boards on notice.
The state of UK cyber risk Prevalence and attack vectors
>Reported breaches: 43% of businesses reported a cyber breach or attack in the last year
>Phishing dominance: Among those businesses hit, 85% cite phishing as the primary cause. Phishing remains the number one route in for attackers[2]
>Ransomware: Ransomware attempts increased, equating to roughly 19,000 companies[3]
The good news is that a handful of controls can reduce cyber risk. Implementing these controls can help turn cyber from a critical business risk into a manageable risk, which Insurers will expect you to have in place.
These five essential controls are:[4]
>Multi-factor authentication (MFA)
>Patching (ensuring a regular patching cadence)
>Tested backups (including secure backups)
>Endpoint detection and response (EDR)/email and endpoint protection
>Access hygiene (e.g., implementing least privilege)
Cyber insurance is essential for fighting back against modern threats. It provides a comprehensive safety net that extends beyond mere financial reimbursement.
Key coverages can include:
>Incident response: Provides 24/7 access to experts, including forensic investigators and legal counsel
>Business interruption: Covers lost revenue due to a covered cyber event
>Liability cover: Protects the business from claims arising from a breach, such as regulatory fines or third-party lawsuits
>Crime protection: Covers financial losses from crime events like funds transfer fraud
>Conclusion: a manageable risk
The path to turning cyber risk into manageable risk involves three clear steps:
Step one:
Foundation: Start with the five core controls: Multi-Factor Authentication (MFA), regular patching, secure backups, Endpoint Detection and Response (EDR) and least privilege access.
Step two:
Validation: Prove these controls are in place by achieving certification such as cyber essentials, which demonstrates your commitment to security.
Step three:
Protection: Ensure your cyber insurance coverage aligns with your security controls, so you have financial and expert support when an incident occurs.
By combining strong cyber hygiene, certification and tailored insurance, SMEs can significantly reduce exposure and recover quickly if the worst happens.
Don’t wait until it’s too late — speak to your independent insurance broker today to review your cyber risk strategy and arrange comprehensive cyber insurance cover that safeguards your business.
Sources:
[1] https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025 #:~:text=breaches%20and%20attacks-,Just%20over%20four%20in%20ten%20businesses%20(43%25),-and%2three%20in
[2] https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025 #:~:text=Phishing%20attacks%20remained,breach%20of%20attack
[3] https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025 #:~:text=increased%20between%202024%20and%202025.-,The%20estimated%20percentage%20of%20all%20businesses%20who%- 20experienced%20a%20ransomware%20crime%20in%20the%20last%2012%20months%20increased%20from%20less%20than%200.5%25%20in%202024%20to%201%25%20in%202025%2C%20which%20equates%20to%20an%20estimated%20 19%2C000%20businesses%20in%202025.,-Phishing%20cyber%20crime%20remained%20by
[4]https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-Infrastructure-v3-1-January-2023.pdf
