Nearly one in three organisations globally (29%) have been hit by a successful cyber attack in the past year, according to the 10th annual Hiscox Cyber Readiness Report, based on a survey of nearly 7,000 cybersecurity decision-makers at smaller firms, including 1,000 in the UK.
UK firms fared worse than the global average: 38% of small UK businesses reported a successful hack in the past 12 months, making Britain the most vulnerable market among those surveyed. Globally, affected firms reported an average of four attack incidents over the same period.
Cyber incidents now cost organisations an average of $52,000 globally, alongside roughly 32 hours of operational disruption. In the UK specifically, the average cost per attack came in at $35,908 (£26,650), a lower absolute figure than the global average but one arrived at from a much higher attack rate, meaning UK firms overall are more likely to face that cost in the first place.
This year's 29% global attack rate is notably lower than the 59% Hiscox reported in its ninth annual report last year, which surveyed a broader mix of 5,750 businesses across seven markets rather than this year's narrower focus on almost 7,000 smaller firms specifically. That change in sample composition, rather than a genuine improvement in global cyber resilience, is the more likely explanation for the shift, and is worth bearing in mind when comparing this year's figures directly against last year's headline number.
The report found lasting strategic consequences for affected firms: 32% globally said cyber incidents delayed growth and expansion plans, with similar shares reporting increased staffing costs (31%), direct financial damage (30%) and lost business opportunities (29%).
Meanwhile, reputation and customer trust now rank as the most significant cyber-related risk for almost half of businesses surveyed (48%), ahead of operational downtime or business interruption (46%) and supply chain or third-party disruption (44%).
Among organisations that experienced an incident, more than a quarter faced financial penalties (28%) or damaging publicity (26%).
Firms are responding with higher resilience investment: the global average spend on cyber resilience measures reached $51,000, covering new technology (51% of firms), specialist staff hiring (55%) and updated employee training (62%). UK firms spent considerably more than the global average, at $59,700 (£44,294), the third-highest resilience spend of any market surveyed.
The report also found a growing trend of linking executive pay to cybersecurity performance: 32% of firms globally now do so, including a quarter (25%) of UK small firms specifically.
Eddie Lamb, global head of cyber at Hiscox, said the findings highlight how the nature of cyber risk has evolved over the past decade.
"During our 20-plus years of insuring cyber risks and our decade of Cyber Readiness research, we've seen a clear shift in the cyber threat and how businesses respond to it," he said. "Cyber risk has become a recurring cost, not an exceptional event, so the investment we're seeing in cyber resilience is good news as businesses start to take back control."
These findings sit alongside an ongoing, well-documented gap between cyber exposure and insurance take-up specifically in the UK.
Government data from the Department for Science, Innovation and Technology shows just 10% of UK businesses and 5% of charities hold a dedicated cyber insurance policy, a gap BIBA has cited alongside last year's Hiscox findings to justify its own broker-facing cyber awareness campaign.
Separate GlobalData research has found just over 40% of UK SMEs currently hold cyber insurance, against around 63% of medium-sized firms and roughly 70% of FTSE 100 companies. Given this year's finding that UK firms face both a higher attack rate and above-average resilience spending, that persistent insurance gap looks increasingly hard to justify on cost grounds alone.
The UK-specific numbers in this year's report tell a sharper story than the global headline figure alone. British small firms are getting hit more often than their international peers, and are already spending more than most to defend themselves, yet insurance take-up remains stuck at roughly one in ten businesses.
For brokers, that combination, high exposure, high defensive spend, low insurance penetration, is close to the clearest possible case for cyber cover that data can make, and suggests the barrier to closing the UK's cyber protection gap has less to do with businesses underestimating the risk and more to do with how that risk gets translated into an actual insurance purchase.
