Small firms are quietly going backwards on the cyber basics
Nearly half of small businesses were hit in the previous year. The share doing the simple groundwork fell.
The government's Cyber Security Breaches Survey for 2025/2026 makes uncomfortable reading for smaller firms, and not because the attack numbers jumped. They did not move much. What moved was the groundwork.
The numbers
42% of micro businesses and 46% of small businesses reported a breach or attack in the previous twelve months. Phishing remained the most common form by a wide margin. For most businesses the median cost of the most disruptive incident was recorded as zero, but the worst 5% of cases reached around £4,000 for micro and small firms, and £10,000 for medium and large ones.
The part that should worry you
Among small businesses the proportion carrying out a cyber risk assessment fell from 48% to 41%, and the proportion with a formal written cyber security policy fell from 59% to 52%. Those are the cheapest controls available. They cost time rather than money, and they are what makes every other control work, because you cannot protect what nobody has written down.
Where to start if you have let it slide
Phishing is still the way in, so staff awareness and multi factor authentication earn their keep before anything expensive. Cyber Essentials is the government backed baseline and it is built around five controls a small firm can realistically complete. If you already hold it, renewal is the moment to check the answers are still true rather than copied forward.
What this means for your business
A median cost of zero hides the tail. Most incidents cost nothing and a small number cost thousands, and the firms doing the basics are the ones that stay out of the tail. If your last risk assessment predates your current systems, that is the job for this month.
#WEARECOBALT
Ready when you are.
Tell us what's slowing your business down. We'll tell you exactly how we'd fix it — plainly, with no obligation.