Hiscox puts the UK small-firm attack rate at 38% against a 29% global average
The tenth annual Cyber Readiness Report surveyed nearly 7,000 smaller businesses, 1,000 of them in the UK, and Britain came out with the highest successful-attack rate of any market in the study, at an average $35,908 per incident.
The Watch · Security desk
What happened
- Hiscox's tenth Cyber Readiness Report puts the successful-attack rate among UK small firms at 38% over the past year, against a 29% average across nearly 7,000 smaller businesses worldwide.
- The UK average cost per attack was $35,908, below the global figure, while UK cyber resilience spending averaged $59,700, third among the markets surveyed.
- Among affected firms globally, 32% said the incident delayed growth and expansion plans, the most cited of the business consequences the survey listed.
Why it matters
- What it limits constraint A UK budget case built on loss size is weak: expected cost per firm per year comes out $1,435 under the global figure, so the argument has to rest on how often firms are hit.
- What it costs cost A firm that is hit at the survey's average of four times absorbs $208,000 and 128 hours in a single year, and with dedicated cover at 10% of UK businesses most of that lands on the firm.
- What doesn't add up contradiction The report carries two UK insurance uptake figures that differ four-fold, so any claim about the size of the protection gap depends on which one the arguer picked.
- Who has to decide decision With cyber performance tied to executive pay at a quarter of UK small firms, sign-off on security spend moves to whoever owns that scorecard.
Next story · Security · Sep 23
One operator ran 105 AI-driven attack waves in five days at about $25 a companyConfirmed2 publishers
Multiply the rates by the per-incident costs and the UK looks better than the headline number. A UK small firm faces a 38% chance in a year of an incident averaging $35,908, which works out at an expected $13,645 [1][11][20]. The global equivalent, 29% of $52,000, is $15,080 [2][4][21]. Hiscox's own framing is that the lower UK cost per attack is offset because the higher frequency makes UK firms more likely to meet those costs [12]. It holds for the chance of being hit; on expected annual cost per firm the UK sits $1,435 below the global figure [22].
Firms that reported an incident reported an average of four attacks over 12 months [5], and the $52,000 and 32 hours are stated per incident [4]. Multiply those and a year at a hit firm comes to $208,000 and 128 hours of disrupted operations [26]. The two averages are published separately, and the multiplication assumes a firm hit four times pays the average each time.
Spending has moved the other way. The global average investment in cyber resilience was $51,000; UK firms averaged $59,700, third among the markets surveyed [6][15]. UK resilience spend therefore runs $23,792 above the cost of a single UK incident [24]. Training absorbed the most activity, with 62% of firms updating it, ahead of 55% hiring specialist staff and 51% adopting new technology [7].
The insurance figures in the report do not agree with each other. Government data from the Department for Science, Innovation and Technology puts dedicated cyber cover at 10% of UK businesses and 5% of charities [16]. Separate research cited in the same report puts uptake among UK SMEs at just over 40%, medium-sized firms at around 63% and the FTSE 100 at roughly 70% [17]. One figure is four times the other, on populations that overlap [25].
These are answers from cybersecurity decision-makers at smaller firms, 1,000 of them in the UK, not claims data [3]. A self-reported attack rate only captures the intrusions someone spotted. The 30-point gap between this year's 29% and the 59% in the previous report measures a change in who was asked: 5,750 businesses across seven markets then, almost 7,000 smaller firms now [13][14][23].
Respondents ranked reputation and customer trust as their most significant cyber risk, at 48%, with operational downtime second at 46% and supply chain or third-party disruption at 44% [18]. Among the firms that actually had an incident, 28% faced financial penalties and 26% experienced damaging publicity [8].
What to watch
- Whether Hiscox publishes the market-by-market table, so the UK's 38% can be checked against the second-place market.
- Whether the next DSIT breaches survey moves the 10% dedicated cyber insurance figure for UK businesses.
- Whether underwriters reprice UK small-business cover on frequency now that Britain sits highest of the surveyed markets.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence55
- Adoption40
- Hype gap+15
- Incentives60
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The UK cyberattack rate among small firms reached 38%, with nearly four in 10 UK small firms hit by a successful cyberattack in the past year, according to the latest Hiscox Cyber Readiness Report.
- [2]
The 38% UK figure is significantly above the 29% global average recorded among nearly 7,000 smaller businesses surveyed worldwide.
- [3]
The 10th annual Hiscox report surveyed cybersecurity decision-makers at smaller firms, including 1,000 respondents in the UK, and Britain recorded the highest attack rate among the markets included in the research.
- [4]
Globally, each incident cost organisations an average of $52,000 and resulted in around 32 hours of operational disruption.
- [5]
Globally, businesses that experienced an incident reported an average of four attacks during the past 12 months.
- [6]
The global average investment in cyber resilience reached $51,000.
- [7]
New technology was adopted by 51% of firms, 55% invested in specialist staff and 62% updated employee training.
- [8]
Among firms that experienced an incident, 28% faced financial penalties and 26% experienced damaging publicity.
- [9]
Globally, 32% of affected firms said cyber incidents delayed growth and expansion plans, ahead of higher staffing costs at 31%, direct financial damage at 30% and lost business opportunities at 29%.
- [10]
Globally, 32% of firms said executive pay is now linked to cybersecurity performance; among UK small firms the figure was 25%.
- [11]
In the UK the average cost per cyberattack was $35,908, equivalent to 26,650 pounds, below the global average.
- [12]
The report states that although the UK cost figure was below the global average, the higher frequency of attacks means UK firms are more likely to encounter those costs.
- [13]
The global attack rate fell from the 59% figure reported in Hiscox's previous annual report.
- [14]
The two global attack rates are not directly comparable because last year's research surveyed a broader group of 5,750 businesses across seven markets, while this year's report focuses on almost 7,000 smaller firms.
- [15]
UK businesses reported cyber resilience spending averaging $59,700, or 44,294 pounds, placing the UK third among the markets surveyed for resilience spending.
- [16]
Government data from the Department for Science, Innovation and Technology shows that 10% of UK businesses and 5% of charities hold a dedicated cyber insurance policy.
- [17]
Separate research cited in the report found that just over 40% of UK SMEs hold cyber insurance, compared with around 63% of medium-sized firms and approximately 70% of FTSE 100 companies.
- [18]
Reputation and customer trust ranked as the most significant cyber-related risk, cited by 48% of businesses surveyed, followed by operational downtime or business interruption at 46% and supply chain or third-party disruption at 44%.
- [19]
The UK successful-attack rate is 9 percentage points above the global average.
- [20]
A UK small firm's expected cost of attack per year is about $13,645.
- [21]
The global expected cost of attack per firm per year is $15,080.
- [22]
On expected annual cost per firm, the UK figure is $1,435 below the global figure.
- [23]
The gap between last year's 59% global attack rate and this year's 29% is 30 percentage points.
- [24]
UK average resilience spending exceeds the average cost of one UK incident by $23,792.
- [25]
The SME cyber insurance uptake figure cited in the report is about four times the DSIT figure for UK businesses overall.
- [26]
A firm hit at the global average of four attacks, each at the average cost and disruption, would face $208,000 and 128 hours of disrupted operations in a year.
Sources
2 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comCyber-Attacks Cost Organizations $52,000 on Average
1 article · September 16, 2026
- thecyberexpress.comUK Small Firms Bear Brunt of Rising Cyberattacks, Hiscox Finds
1 article · September 14, 2026
Topics and entities
Topics
- Small business cybersecurity
- Cyber Insurance
Entities
- Department for Science, Innovation and Technology
- Talion Cyber Security
- Hiscox Cyber Readiness Report