The persistence of cyber attacks continues to shape business strategy, according to the tenth annual Hiscox Cyber Readiness Report, by the insurer and based on a survey of 6,800 cyber security decision-makers across the UK, Europe and the United States. About one in three say it delayed growth and expansion plans (32pc), and similar replies came in terms of increased staffing costs (31pc), financial damage (30pc) and lost opportunities (29pc).
Businesses, the survey found, are also concerned by the longer-term consequences of cyber incidents. Reputation and customer trust now rank as the most significant risk for half of those surveyed (48pc), ahead of operational downtime or business interruption (46pc) and supply chain or third-party disruptions (44pc). ย Among those that have experienced an incident, over a quarter were impacted by financial penalties (28pc) or bad publicity (26pc).
Eddie Lamb, Global Head of Cyber at Hiscox, said the findings highlight how the nature of cyber risk has evolved over the past decade. โDuring our 20+ years of insuring cyber risks and our decade of Cyber Readiness research, weโve seen a clear shift in the cyber threat and how businesses respond to it. Cyber risk has become a recurring cost, not an exceptional event, so the investment weโre seeing in cyber resilience is good news as businesses start to take back control.โย
For the report, go to: https://www.hiscoxgroup.com/hiscox-cyber-readiness-report-2026.ย
Comment
Jamie Akhtar, CEO and Co-founder of CyberSmart said: “SMEs are increasingly attractive targets because cyber criminals know they often have fewer resources, smaller security teams and less time to dedicate to cyber security than larger organisations. At the same time, threats are becoming more persistent and sophisticated. For a small business, a successful attack can mean significant disruption, lost customers, reputational damage and, in the worst cases, threaten the future of the business itself.
“What is particularly worrying is that UK firms are therefore more likely to find themselves paying the price of cyber crime. While the average cost of an individual attack in the UK may be lower than the global average, the higher proportion of businesses being successfully compromised means many more firms are being exposed to those costs in the first place. For an SME already dealing with tight margins, higher operating costs and pressure on budgets, an unexpected five-figure cyber incident can have a very real impact on cash flow and growth.
“The positive news is that improving cyber resilience does not have to mean building an expensive in-house security operation. Cyber Essentials gives SMEs a clear, government-backed framework for putting the fundamental controls in place that defend against the most common cyber threats. Working with a trusted managed service provider can then help businesses maintain those protections, identify weaknesses and access specialist expertise without carrying the cost of a large internal team. At a time when every pound matters, relatively modest and consistent investment in the cyber basics can be far more cost-effective than dealing with the financial and operational consequences of an attack after it has happened.โ
