Nearly four in 10 UK small firms were hit by a successful cyberattack in the past year, according to the latest Hiscox Cyber Readiness Report. The UK cyberattack rate reached 38%, significantly above the 29% global average recorded among nearly 7,000 smaller businesses surveyed worldwide.

The 10th annual report surveyed cybersecurity decision-makers at smaller firms, including 1,000 respondents in the UK. Britain recorded the highest attack rate among the markets included in the research. Globally, businesses that experienced an incident reported an average of four attacks during the past 12 months.

UK cyberattack Rate Outpaces Global Average

The findings place UK small businesses at greater exposure to successful cyberattacks than their international counterparts. While 29% of organisations globally reported a successful attack, the figure rose to 38% among small UK businesses.

The report also found that cyber incidents are creating measurable financial and operational costs. Globally, each incident cost organisations an average of $52,000 and resulted in around 32 hours of operational disruption.

In the UK, the average cost per cyberattack was $35,908, equivalent to £26,650. Although that figure was below the global average, the higher frequency of attacks means UK firms are more likely to encounter those costs.

The global attack rate also fell from the 59% figure reported in Hiscox's previous annual report. However, the two figures are not directly comparable because last year's research surveyed a broader group of 5,750 businesses across seven markets, while this year's report focuses specifically on almost 7,000 smaller firms.

Cyber Incidents Affect Business Growth

Cyber incidents are also influencing business decisions beyond immediate recovery costs. Globally, 32% of affected firms said cyber incidents delayed growth and expansion plans.

Other reported consequences included higher staffing costs for 31% of businesses, direct financial damage for 30%, and lost business opportunities for 29%.

Reputation and customer trust ranked as the most significant cyber-related risk, cited by 48% of businesses surveyed. Operational downtime or business interruption followed at 46%, while supply chain or third-party disruption was identified by 44%.

Among firms that experienced an incident, 28% faced financial penalties and 26% experienced damaging publicity.

UK Firms Increase Cyber Resilience Spending

Businesses are responding to the continuing threat by increasing spending on cyber resilience. The global average investment reached $51,000, with firms directing spending toward new technology, specialist staff and employee training.

New technology was adopted by 51% of firms, while 55% invested in specialist staff and 62% updated employee training.

UK businesses reported considerably higher spending, averaging $59,700, or £44,294, on cyber resilience. That placed the UK third among the markets surveyed for resilience spending.

The report also identified a growing connection between cybersecurity performance and executive compensation. Globally, 32% of firms said executive pay is now linked to cybersecurity performance. Among UK small firms, the figure was 25%.

Cyber Insurance Gap Remains

The findings also highlight a continuing gap between cybersecurity exposure and insurance uptake in the UK. Government data from the Department for Science, Innovation and Technology shows that 10% of UK businesses and 5% of charities hold a dedicated cyber insurance policy.

Separate research cited in the report found that just over 40% of UK SMEs hold cyber insurance, compared with around 63% of medium-sized firms and approximately 70% of FTSE 100 companies.

The latest Hiscox findings therefore show a combination of high cyberattack exposure, substantial investment in cyber resilience, and relatively limited cyber insurance uptake among UK businesses.

The CISA and FBI, along with cybersecurity agencies from Australia, Canada, New Zealand and the U.K., have released new guidance on outage communications for service providers dealing with major IT and OT outages. The guide calls for prompt, factual and audience-specific communication during disruptions caused by malicious cyber activity or non-malicious events.

Titled “Communicating Under Pressure: Best Practices for Service Providers,” the guidance says effective communication is critical to limiting operational impact when IT and OT outages affect customers, network defenders, critical infrastructure owners and operators, and the public. It recommends that organizations clearly communicate what is known, what remains unknown and what is still under investigation, while providing frequent updates as circumstances change.

Outage Communications Should Start With Facts

The agencies recommend that service providers establish an outage communications plan before an incident occurs. The plan should define incident thresholds, escalation paths, target audiences and procedures for status pages, customer and partner notices, and regulatory communications. Organizations are also advised to establish cross-functional incident teams involving engineering and operations, communications, legal, risk and compliance, and customer support.

The guidance calls for clearly defined roles, including an incident lead, communications lead and spokesperson. It also recommends parallel workstreams so technical teams can focus on diagnosing and remediating the root cause while communications teams manage external messaging and leadership handles strategy and regulatory requirements.

For organizations responding to cyber incidents, the guidance places particular emphasis on balancing transparency with operational security. If malicious activity is suspected or confirmed, external communications should not compromise investigations, containment efforts or other response activities. Organizations are also advised against making premature conclusions when the root cause remains under investigation.

Service Providers Urged to Tailor Messages

The guidance recommends segmenting communications for technical teams, executives and the public. Audiences can include enterprise IT teams and security operations centers, employees and customers, government partners and regulators, critical infrastructure owners and operators, as well as the media and general public.

During an outage, organizations should lead with a concise summary covering affected systems, user impact, scope and the known cause without speculation. The agencies also advise against vague descriptions such as “service degradation” and recommend messaging that can be understood quickly during high-pressure situations.

Transparency is another central principle. Service providers are advised to state what they know and do not know, use a single source of truth such as a status page, and focus communications on actionable guidance rather than reputation management. Customers should be told what actions they need to take or clearly informed when no action is required.

The guidance also calls for continuous, time-stamped updates that show the incident timeline, actions taken, and recovery milestones. Organizations should maintain a single status page and align external messaging with legal, contractual and sector-specific reporting obligations.

Agencies ultimately frame effective outage communications around five principles: immediate acknowledgement, technical and actionable information, transparency, accountability, and continuous updates. For service providers, the guidance positions communication as an important part of incident response, alongside technical remediation and recovery.