The Department for Science, Innovation and Technology’s Cyber Security Breaches Survey 2025 found that 43% of UK businesses had experienced a cyber security breach or attack in the preceding 12 months. That figure describes reported experience across survey respondents. It does not show how often incidents recur, confirm that every incident was a crime or predict an individual organisation’s likelihood of being affected.
The survey separates breaches and attacks from cybercrime. One organisation may report an attempted attack without it meeting the survey’s definition of cybercrime, while another may experience repeated crimes. Understanding that distinction gives business leaders a more useful basis for interpreting the findings.
This article examines reported incidents, repeat cybercrime, common attack types and business impacts. It also considers how to use the findings in operational planning without treating national survey results as a forecast of your organisation’s exposure or costs.
This is a historical analysis of the 2025 edition, which was published on 10 April 2025 and drew on fieldwork conducted between August and December 2024. The subsequent 2025/26 survey was published on 30 April 2026 and should be used when a current snapshot is required.
The survey found that 43% of businesses and 30% of charities had experienced a cyber security breach or attack. A smaller share, 20% of businesses and 14% of charities, reported at least one cybercrime. The figures are different because a breach or attack is not automatically classified as a crime.
Repeat incidents also matter. Businesses that experienced cybercrime reported a mean of 30 crimes and a median of four. The difference indicates that some organisations reported a much higher number of crimes than the typical respondent, so the mean alone can give a misleading impression of a common experience.
The survey also found that 52% of businesses that identified a breach or attack experienced them at least monthly, while 29% reported activity at least weekly. These frequencies describe affected respondents, not all UK businesses. They are a reminder to track recurrence internally rather than recording only whether an organisation was affected.
For operational planning, record the incident type, date, systems involved and disruption caused. Among businesses that identified a breach or attack, 7% reported temporary loss of access to files or networks. This kind of disruption can restrict routine work, so response plans should identify system owners and recovery priorities.
The survey reported that 23% of businesses and 22% of charities had a formal incident response plan. A plan should identify who assesses impact, coordinates containment and oversees recovery. It should also define how teams preserve evidence and communicate with stakeholders.
Organisations reviewing these arrangements can use a cyber incident tabletop exercise to test escalation routes, decision authority and communications before a real incident occurs.
External reporting is another part of incident readiness. Thirty-nine per cent of businesses that identified a breach or attack reported their most disruptive incident outside the organisation, including to external cyber security or IT providers. Excluding reports to those providers, the share was 25%. Assigning responsibility for escalation and maintaining clear reporting routes can help teams make decisions consistently during an incident.
The survey provides evidence about the kinds of impact businesses reported, but it should not be treated as a cost forecast for an individual organisation. Among businesses that identified a breach or attack, 4% reported lost revenue or share value, compared with 2% in 2024. One per cent reported reputational damage, unchanged from the previous year.
These figures show how often respondents reported these impacts, not the value of lost revenue or future reputational harm.
The reported mean cost of a business’s most disruptive breach or attack was £1,600, including responses reporting no cost. Excluding those zero-cost responses, the mean was £3,550, while the median was £0. These are self-reported estimates of the most disruptive incident, not a measure of the full financial impact across all incidents.
Actual costs depend on which systems and services are affected, how long disruption lasts and what investigation and recovery require. A business may need to restore systems, replace compromised credentials or divert staff from planned work. For example, an unavailable ordering platform can delay transactions while technical teams investigate and restore access.
To understand exposure, record incident-related spending separately from wider business impact. Track investigation and restoration work, service interruption, delayed transactions and staff time. Reviewing these records with finance and security teams can help leaders identify which systems or processes create the greatest disruption and where resilience investment may have the most value.
Use scenarios to test exposure without treating survey percentages as a cost estimate. Consider a compromised finance account, an unavailable customer portal or interrupted file access. For each scenario, identify affected services, recovery dependencies and decisions that could delay operations.
Leaders preparing an investment proposal can connect these scenarios to a board-ready cyber security business case that relates security spending to resilience, service continuity and measurable business priorities.
The 43% business figure measures respondents reporting a breach or attack, not confirmed cybercrime. The survey found that 20% of businesses had experienced at least one cybercrime. The distinction matters because a broad breach-or-attack figure and a crime figure answer different questions and should not be used interchangeably.
Reported rates also varied by business size. The survey found that 41% of micro businesses, 50% of small businesses, 67% of medium businesses and 74% of large businesses reported a breach or attack. These results show differences among size groups, but they do not establish the cause of those differences.
Security practices varied too. Twenty-nine per cent of businesses overall conducted cyber security risk assessments, broadly in line with 31% in 2024. Among small businesses, the figure was 48%, up from 41%.
Up-to-date malware protection was reported by 77% of businesses, down from 83% in 2024, while 68% restricted administrator rights, compared with 73% the previous year.
These figures can prompt an internal review, but national rates do not show whether a control is effective in a particular organisation. Compare survey findings with your own risk assessments, incident records and control coverage. A structured cyber security posture assessment can help translate that evidence into prioritised improvements tied to the organisation’s environment.
Phishing was the most commonly reported type of breach or attack. Eighty-five per cent of businesses that identified a breach or attack reported phishing. The survey also recorded impersonation, malware, ransomware and denial-of-service attacks.
These percentages refer to businesses that identified a breach or attack, not all businesses surveyed.
The survey estimated that UK businesses experienced approximately 8.58 million cybercrimes in the preceding 12 months, including approximately 680,000 non-phishing cybercrimes. These are extrapolated estimates of crime events, not counts of affected organisations or police-recorded offences. The report cautions that estimates rely on organisations identifying and recalling incidents.
The newer 2025/26 survey estimated 5.19 million cybercrimes among UK businesses, but that figure should not be inserted into an analysis of the 2025 report. The subsequent edition used fieldwork conducted between August and December 2025 and reports its own prevalence, frequency and impact findings.
For practical risk reviews, compare national patterns with internal incident records. Classify phishing, impersonation, malware, denial of service and ransomware consistently, then record which systems or processes each incident affected. Keep the reporting period and definitions consistent when comparing internal results with survey findings.
Where phishing is a recurring concern, combine technical controls with cyber security awareness training and defined processes for reporting suspicious messages. Training should complement email security, identity protection and incident response rather than act as the organisation’s only defence.
CyberOne’s Managed Extended Detection and Response service uses managed Microsoft Sentinel and Microsoft Defender capabilities to support threat detection and response. It may suit organisations reviewing how they investigate recurring alerts or coordinate response across their Microsoft security environment.
The service should be scoped around the systems to monitor, the response authority your team wants to retain and the recovery needs of your organisation. National survey findings may help define questions for a provider, but they cannot determine which telemetry, service levels or response actions your organisation requires.
Leaders considering managed monitoring should assess whether the service can investigate the attack types and business systems relevant to their environment. They should also define how analysts will escalate incidents, which containment actions require approval and who remains responsible for recovery and risk acceptance.
Use the Cyber Security Breaches Survey 2025 to inform a review of your organisation’s priorities, not as a prediction of its exposure. Identify where improved visibility, clearer ownership or stronger incident planning would make the greatest difference to continuity and decision-making.
Set a practical improvement priority, then align security, IT and business leaders around the changes required. For example, an organisation with limited incident records might first establish consistent classification and escalation. A business that already has reliable data might prioritise testing recovery dependencies or extending monitoring across critical systems.
Contact CyberOne to discuss the right next step for your organisation.