What the latest Government figures mean for UK organisations
Cyber attacks can sometimes feel like something that happens somewhere else. A major retailer goes offline, a large organisation suffers a data breach or millions of customer records are compromised and it makes the headlines.
But the latest UK Government figures paint a much broader picture.
According to the Cyber Security Breaches Survey 2025/26, “43% of UK businesses identified a cyber security breach or attack in the previous 12 months”. That’s approximately 612,000 businesses.
And the risk isn’t limited to large organisations. Businesses of every size are dealing with cyber threats, while organisations that depend heavily on technology are particularly exposed.
For UK businesses, cyber security is increasingly becoming part of everyday business risk.
The numbers behind the threat
The Government’s latest research gives us an idea of the scale.
The Cyber Security Breaches Survey found that 43% of businesses identified a breach or attack in the previous 12 months. Among medium-sized businesses that figure rises to 65%, while 69% of large businesses identified an attack or breach.
Separate Government research into the economic impact of cyber attacks estimates they cost UK businesses around £14.7 billion every year, equivalent to approximately 0.5% of UK GDP.
For an individual business, the estimated average cost of a significant cyber attack is almost £195,000.
Those figures put cyber security into a very different context. It isn’t simply an IT issue. An incident can affect operations, finances, customers, suppliers and reputation.
Not identifying an attack doesn’t necessarily mean you’re secure
There’s an important detail in these statistics.
The Government survey measures businesses that ‘identified’ a cyber security breach or attack.
That distinction matters.
An organisation needs sufficient visibility to know that something has happened in the first place. Smaller businesses may have fewer security monitoring resources and therefore may be less likely to identify certain incidents.
The same principle applies to vulnerabilities within software.
Not knowing that a vulnerability exists doesn’t mean the software is secure. It simply means you haven’t found it.
Your software is part of your attack surface
Most organisations now depend on considerably more technology than they did even a few years ago.
There are websites, customer portals, bespoke CRMs, mobile applications, APIs, integrations, internal systems and third-party platforms.
Then there is the software behind those systems.
Modern applications can contain code written internally alongside open-source packages, frameworks and third-party dependencies. They may connect to external APIs, hold credentials and process confidential customer or business information.
AI is accelerating this further. Developers can produce code faster, while people with relatively little traditional development experience can now create working applications using AI coding tools.
That’s an incredible opportunity, but every new application also needs to be considered from a security perspective.
The fact that software works doesn’t automatically mean it’s secure.
What should UK organisations be doing?
There isn’t one product, process or certification that eliminates cyber risk. Good security is built in layers.
The starting point is understanding what you have.
Organisations should know what software they operate, what information it has access to, which third-party services it relies upon and who is responsible for maintaining it.
Software and dependencies should be kept updated, access should be appropriately controlled and credentials need to be protected.
Security testing should also be considered throughout the lifecycle of software rather than only after an incident.
This is particularly important because software continually changes. New features are released, packages are updated, integrations are introduced and new vulnerabilities are discovered.
A system that was assessed six months ago isn’t necessarily the same system running today.
Find it before someone else does
One of the most useful things an organisation can do is proactively look for weaknesses.
Vulnerability scanning can help identify potential security issues within applications and codebases, from exposed credentials and vulnerable dependencies to weaknesses within the application itself.
Formal penetration testing also has an important role, particularly where deeper human-led testing or independent assurance is required. The two approaches don’t need to compete. Regular vulnerability scanning can sit alongside penetration testing and other cyber security controls as part of a layered approach.
The objective is simple: increase visibility.
If you know a vulnerability exists, you have an opportunity to assess it, prioritise it and fix it.
If an attacker finds it first, the situation can look very different.
Cyber security is becoming business critical
The scale of the Government’s figures should make UK organisations think.
612,000 businesses identifying a breach or attack in a single year. An estimated £14.7 billion annual cost. Almost £195,000 for the average significant attack.
These aren’t reasons to panic. They’re reasons to take cyber security seriously.
For organisations operating bespoke software, applications or digital platforms, understanding what’s happening inside that software should be part of that process.
That’s why Hacka exists!
Hacka helps businesses and development teams identify potential vulnerabilities, exposed credentials, dependency and supply-chain risks and other security issues within their applications and codebases.
Findings are prioritised and supported with remediation guidance, helping teams understand what’s important and what they can do about it.
Because the goal isn’t simply to find more vulnerabilities.
It’s to find the ones that matter and fix them before somebody else has the opportunity to exploit them.
For further reading, take a look at:
UK Government: Cyber Security Breaches Survey 2025/26
UK Government – Independent research on the economic impact of cyber attacks on the UK
