Photo by Luke Southern on Unsplash
Picture every ten businesses on your high street, in your trade association, or in the group chat you use to share supplier contacts. Statistically, more than four of them dealt with a cyber security breach or attack in the last twelve months. That is not a number designed to frighten you into buying something. It is the picture the latest government research is painting, and it is worth sitting with for a moment before deciding whether it applies to you.
What 43% actually tells us
The figure comes from annual government research that tracks how UK organisations experience cyber incidents. Forty-three percent of businesses reported a breach or attack in the previous twelve months. That number has stayed stubbornly elevated for several years running. It has never dropped to the point where anyone in the security field would say the threat is quietly going away.
What the headline does not show you is the full picture behind those incidents. Some businesses faced ransomware that locked them out of their own files. Some had email accounts taken over. Some received convincing phishing messages that a staff member nearly acted on. The range is wide. But what those businesses share is that either someone actively chose to target them, or an automated attack swept them up in a wider campaign that did not discriminate by size.
Why small businesses stay in the firing line
There is a persistent assumption that attackers focus on large targets because that is where the real money is. Some criminal groups do work that way. But the threat picture for small businesses is shaped by different economics.
Smaller organisations typically run with less security investment, fewer dedicated IT people, and software that does not always get updated as quickly as it should. That combination makes them easier and cheaper to breach. For an attacker running automated scans across thousands of systems, a small business with a known unpatched vulnerability is an easy win. It costs the attacker almost nothing to exploit it.
There is also the supply chain dimension. A small business can be targeted not for what it holds directly, but for the access it has to larger clients or partners. Your systems, your shared credentials, and the trust your clients place in your communications all have value to someone who wants to get further into a supply chain.
Where most breaches actually start
The government research is consistent on this point: phishing is the most commonly reported attack type. After that come impersonation attempts, where attackers pose as a trusted person or brand to get someone to hand over credentials, approve a payment, or click a link they should not have.
Unpatched software runs close behind. When a vulnerability is publicly disclosed, attackers begin scanning for systems that have not applied the fix, sometimes within hours. A business that delays updates by even a few days is operating in a window of real risk.
This reshapes where the focus should go. A perimeter firewall is a useful thing. But if the main entry points are email-based attacks and known software flaws, then security awareness training and keeping every device properly updated move up the priority list quickly. Knowing how to recognise a suspicious email and having a clear way to report one without embarrassment is a genuine security control, not just a cultural nicety. And closing the software gaps in your environment before attackers find them is one of the most direct responses available, which is exactly what vulnerability management is designed to do.
The impact is not always a headline
When people imagine a cyber breach, they often picture a dramatic shutdown or a story in the news. Some incidents do look like that. But a significant portion of the breaches captured in the research result in quieter, slower damage: staff time lost to recovery, operational disruption measured in hours or days, the cost of investigating what was accessed and by whom, and the ongoing uncertainty that follows.
For a small business without a dedicated security function, even a moderate incident can hit hard. If customer data, financial records, or email accounts are involved, the consequences extend well beyond IT. They touch legal obligations under UK data protection law, customer relationships, and in some cases your ability to keep operating while the situation is sorted out.
What a practical response looks like
The 43% figure should not trigger alarm. What it should do is prompt a straightforward question: if your business ended up in that statistic next year, how prepared would you be?
The essentials are well understood. Apply software and security updates across every device your team uses, and do it promptly rather than putting it off. Use multi-factor authentication on email, cloud services, and anything that holds sensitive data. Keep backups somewhere an attacker who gets into your network cannot reach. Make sure your team knows how to spot a phishing attempt and give them a genuinely easy way to flag something suspicious.
If you are not confident where your biggest exposures sit, managed security gives you continuous monitoring and specialist oversight without building an internal team. For businesses that also want a structured, government-backed way to demonstrate their fundamentals are covered, Cyber Essentials is the UK certification built around exactly the controls that address the most common attack types in the research. And if you want to understand how to prioritise what you fix first, this earlier post on handling too many vulnerabilities with too little time covers that question directly.
The short version
Four in ten UK businesses dealt with a cyber incident last year. The most common ways attackers get in are phishing emails and unpatched software. The impact ranges from minor disruption to serious operational and financial damage. The response does not need to be complicated, but it does need to be deliberate. Understanding where your business actually stands today is where that starts.
If you want to work through what your business specifically needs, get in touch with CyberStark and we can take it from there.