Every year, DSIT (the Department for Science, Innovation and Technology) and the NCSC publish the UK Cyber Security Breaches Survey. It’s the most authoritative source of data on how small UK businesses are actually doing on cyber risk — not the theoretical risk, but what’s really happening. And every year it makes for uncomfortable reading.
The 2026 edition is no different. The headlines are familiar: a significant proportion of UK businesses experienced at least one cyber breach or attack in the past twelve months. Phishing remains the most common vector. Awareness is improving but action isn’t keeping pace. And a new theme has entered prominently this year: AI-assisted attacks are arriving faster than most SMEs have security measures in place for them.
What the Numbers Show
The survey consistently finds that around four in ten UK businesses experienced a breach or attack in the past year. Medium-sized businesses fare worse than micro-businesses — partly because they’re more attractive targets and partly because they’ve adopted more digital infrastructure that creates more attack surface.
The most common type of attack remains phishing. Around three-quarters of businesses that experienced a breach said phishing was involved. That number has barely shifted in years, which tells you something: phishing works, defences against it aren’t improving fast enough, and the attack is getting easier and cheaper for attackers to execute at scale.
Ransomware is less common by frequency but far more damaging when it lands. Businesses that reported a material financial impact from a breach were predominantly ransomware victims. For small businesses with limited cash reserves and no cyber insurance, a ransomware incident is genuinely existential.
The AI finding is new and worth dwelling on. The 2026 survey specifically asked about AI-assisted attacks for the first time. A meaningful proportion of businesses that experienced phishing attacks reported they were highly convincing — no spelling errors, personalised content, accurate references to their business. That’s the fingerprint of AI-generated phishing. Meanwhile, only a small fraction of SMEs have any specific measures in place for AI-assisted threats.
The Basic Controls Gap
Here’s the frustrating part. The survey consistently finds that basic technical controls — the ones that would stop the majority of attacks — are still not universally in place.
Multi-factor authentication (MFA) adoption has grown, but a substantial proportion of businesses still don’t have it configured for email accounts, cloud services, or remote access. Given that credential theft via phishing is the most common attack path, this is a significant gap. MFA doesn’t stop every attack but it stops most credential-stuffing attempts cold.
Software patching is another area where the numbers are poor. Most breaches that aren’t phishing-based exploit known, patched vulnerabilities in software that hasn’t been updated. The businesses that get compromised through unpatched software aren’t unlucky — they’re running behind on a maintenance task that costs almost nothing to do.
Password policies remain weak in many SMEs. Shared accounts, recycled passwords, and default credentials on devices (routers, printers, NAS drives) continue to appear in breach reports. These aren’t sophisticated attack vectors.
What the Survey Says About AI Tools
There’s a new risk category the 2026 survey flags that didn’t feature prominently in previous editions: the use of AI tools by staff without any security policy governing them.
A large proportion of businesses have employees using AI tools — ChatGPT, Copilot, Claude, and others — for work tasks. A much smaller proportion have any formal policy about what data can be shared with those tools. Employees routinely paste client data, internal reports, contracts, and financial information into AI systems governed by third-party data policies. Most of them aren’t doing it maliciously — they’re just trying to get the job done.
For a business subject to GDPR, this creates direct data protection exposure. For a business handling commercially sensitive information, it creates competitive risk. The ICO has noted that data sharing with AI tools is an area of growing concern and has published guidance that most SMEs haven’t read.
What to Actually Do About It
The survey typically recommends five priority actions for businesses that find themselves in the breach-experienced cohort. These align with the Cyber Essentials certification controls, which are worth pursuing if you haven’t already.
Turn on MFA for everything you can. Email, cloud storage, accounting software, CRM, remote access. Do it this week. It takes an hour and significantly reduces your exposure to credential theft. Microsoft 365 and Google Workspace both make this straightforward in the admin panel.
Update your software. Run Windows Update. Update your router firmware (see our guide on router security). Check that any software you use has automatic updates enabled. This is the unsexy work that prevents the majority of exploitation-of-known-vulnerabilities attacks.
Create an AI tool policy. You don’t need a 40-page document. A one-pager that tells staff: don’t paste client data, financial information, or commercially sensitive material into AI tools unless you’ve checked the tool’s data processing terms. Something is better than nothing.
Check what devices are on your network. Log into your router admin panel and look at the connected devices list. Unknown devices warrant investigation. A compromised printer or smart TV can be used as a pivot point into your network.
Get incident response basics in writing. Who do you call if something goes wrong? NCSC’s Cyber Incident Response guidance is free, short, and worth bookmarking before you need it. Action Fraud is the UK reporting body for cyber crime — have the number to hand.
None of these are expensive. Most are free. The survey data suggests a large fraction of UK businesses that experience breaches hadn’t done them. That’s the gap the annual survey reveals, and it’s a gap that’s entirely closable.