Four in ten attacked. Two in ten ready.

The government’s Cyber Security Breaches Survey 2025/2026 found 42% of micro businesses and 46% of small businesses suffered a breach or attack in the previous twelve months. Across all UK businesses it was 43% — roughly 612,000 firms in a single year. Applying the micro rate to official business counts puts around 483,000 of the UK’s micro businesses on the receiving end of an attack. (DSIT CSBS 2025/2026; DBT business counts)

Being small is not cover. Smaller firms are reached by the same automated attacks as everyone else, with far less standing in the way.

Preparedness is going backwards

The uncomfortable finding in the same survey is the direction of travel. The proportion of small businesses with a formal cyber security policy fell from 59% to 52% year on year. Only 21% of micro businesses have a formal incident response plan — a written answer to the question of what happens on the morning it goes wrong — against 25% of businesses overall. Just 30% carry out formal risk assessments.

Skills are the constraint underneath that. DSIT puts the proportion of UK businesses with a basic cyber security skills gap at 49%, with around 30% lacking advanced skills. (DSIT, Cyber Security Skills in the UK Labour Market 2025)

Why the cost argument misses

Owners are often sold cyber security on fear of the bill, and the numbers don’t support it. Reported breach costs for micro and small businesses sit at a median of £0, reaching about £4,000 at the 95th percentile. The real exposure is the days of trading lost while you rebuild, the cover you can’t rely on and the contracts you can’t win. Some 45% of micro businesses hold cyber insurance of any form, but only 8% hold a standalone policy — and insurers and larger customers alike tend to want evidence of basic controls before they commit.

What actually closes the gap

Very little of it is expensive. Two-factor authentication costs nothing on most business software, and micro business use has already risen from 35% to 43%. A one-page incident response plan — who to call, what to disconnect, who must be told, how the business keeps trading — costs an afternoon and would move four in five micro businesses out of the unprepared column. Cyber Essentials, held by 12% of small businesses and up from 5%, turns those basics into evidence a customer or insurer will accept.

Ageing infrastructure is the other half of the problem: 41% of micro businesses still run on on-premises servers, which means patching, backups and physical security all fall to the owner. (DSIT, UK Business Data Survey 2024)

With a median UK cyber security salary of £55,000, hiring is not an option at this size — and the market has worked that out. Reliance on an external provider has risen from 39% to 44% of micro businesses. Resilience at this scale was never something a small business was expected to hold on its own.