The Cyber Security Breaches Survey 2025/2026, published by the Department for Science, Innovation and Technology and the Home Office on 30 April 2026, finds that 43% of UK businesses identified a cyber breach or attack in the last twelve months, while only 25% have a formal incident response plan. That gap is the most useful finding in this year’s survey for a regulated firm, because it is the plan, not the attack, that decides whether an incident becomes a reportable failure.
The survey is the government’s official annual measure of cyber security in UK organisations. This edition is based on 2,112 businesses and 1,085 charities surveyed between August and December 2025, plus 44 qualitative interviews.
What did the 2026 survey find?
The headline figures, all from the survey’s main report:
- Breaches are common and scale with size. 43% of businesses identified a breach or attack, rising to 65% of medium-sized and 69% of large businesses.
- Phishing still dominates. 38% of businesses experienced phishing, far ahead of any other type. Impersonation fell to 12% from 17%.
- Ransomware is rarer but not trivial. Ransomware was reported by 1% of businesses, down from 3% in each of the two previous years.
- Consequences are rising. The share of businesses reporting lost revenue or share value rose from 2% to 5%, and reputational damage from 1% to 3%.
- Governance is thin. 31% of businesses have a board member with explicit responsibility for cyber security.
- Supply chains are barely examined. 15% of businesses reviewed risks from their immediate suppliers and 6% looked at their wider supply chain.
- Basic controls are incomplete. 47% of businesses use any form of two-factor authentication, and 47% hold cyber insurance.
- Cyber Essentials is growing slowly. 5% of businesses hold Cyber Essentials, up from 3%.
Why is the incident response gap the finding that matters?
Because it is the one control that determines the outcome once everything else has failed. Only 25% of businesses have a formal incident response plan. The figure rises to 57% of medium-sized and 76% of large businesses, which means that more than two in five medium-sized firms, the size of many regulated professional practices, would face an incident without an agreed plan.
An incident response plan is a written, rehearsed set of decisions about who does what when a security incident is suspected. It names who leads, who can authorise isolating systems, who speaks to the regulator, the insurer and clients, and how evidence is preserved. Without one, those decisions are made for the first time under pressure, usually by people who have never discussed them.
For a regulated firm the clock starts early. Under UK GDPR Article 33, a notifiable personal data breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. FCA-regulated firms have notification expectations under Principle 11 and the SUP 15 rules, and the SRA expects firms to report serious issues promptly. Seventy-two hours is not long if the first day is spent working out who is in charge.
What does falling ransomware actually tell us?
Less than it appears. The survey’s ransomware figure fell to 1% of businesses, but the share suffering lost revenue or share value more than doubled. The NCSC’s own 2025 Annual Review, published on 14 October 2025, recorded 204 nationally significant incidents in its reporting year, up from 89 the year before. Fewer firms may be hit, but the incidents that do land are larger, and they land on organisations whose preparation has not kept pace.
The phishing figure is the more important signal for professional services. At 38%, phishing is the route by which most breaches begin, and the payment-diversion and impersonation fraud that follows is precisely the kind of incident where a rehearsed plan, a call-back procedure and a clear escalation path determine whether money leaves the firm.
What should a plan for a regulated firm contain?
It should be short enough to use and specific enough to act on. In our experience a workable plan for a firm of 50 to 250 people covers:
- Roles and authority. An incident lead, a deputy, and the named partner or director who can authorise shutting down systems, engaging outside help and paying for it.
- Severity levels. Three or four levels, each with a clear trigger and a clear escalation, so that a phishing click and a ransomware outbreak are not handled the same way.
- Notification map. Who must be told and by when: the ICO, the sector regulator, the insurer, affected clients, and the police through Action Fraud where relevant.
- Evidence preservation. What must not be wiped, rebuilt or restored until it has been captured, and who captures it.
- Communications. Pre-agreed holding statements for clients and staff, and a rule about who may speak externally.
- Recovery priorities. Which systems come back first, and the realistic time to restore each from backup.
- Contacts that work offline. A printed or offline copy of every number above, because email may be the system that is down.
A plan that has never been exercised is a draft. A two-hour tabletop exercise, walking the leadership team through a realistic scenario, finds most of the gaps in a plan before an attacker does.
Who owns this at board level?
Someone named. Only 31% of businesses have a board member with explicit responsibility for cyber security, which leaves most incident plans without anyone senior who has agreed to the authority they grant. In a regulated firm, the senior manager responsible for operational resilience is the natural owner, and the plan should be approved at that level so that the authority it grants is real.
What to do this quarter
- Confirm whether you have a written incident response plan, and when it was last updated and tested.
- Name an incident lead, a deputy and a board-level owner, and record their authority in writing.
- Build a notification map with deadlines for the ICO, your sector regulator and your insurer.
- Check that your cyber insurance policy’s notification and panel-supplier terms match the plan.
- Run a tabletop exercise with the leadership team using a phishing-led payment diversion scenario.
- Print the contact list and keep it somewhere that does not depend on email or the file server.
How Rhentech helps
Our incident response service covers both sides of the gap the survey describes: writing and exercising a plan before anything happens, and leading the response when it does. Where the underlying controls are part of the problem, a cybersecurity audit establishes the baseline, and our managed IT and cybersecurity service maintains it. Our earlier article on UK GDPR and cybersecurity obligations sets out the regulatory side for boards.
If your firm is one of the three in four without a tested plan, book a free initial consultation and we will discuss what a proportionate plan looks like for your size and sector.
Frequently asked questions
What did the Cyber Security Breaches Survey 2025/2026 find?
Published on 30 April 2026, it found that 43% of UK businesses identified a cyber breach or attack in the previous twelve months, rising to 65% of medium and 69% of large businesses. Phishing remained the most common type at 38% of businesses, and only 25% of businesses had a formal incident response plan.
What is an incident response plan?
An incident response plan is a written, rehearsed set of decisions about who does what when a security incident is suspected: who leads, who can authorise shutting systems down, who contacts the regulator, insurer and clients, and within what time. Its value comes from being agreed and tested before an incident, not drafted during one.
Does falling ransomware mean the risk has reduced?
Not in a way a regulated firm should rely on. The survey reports ransomware fell to 1% of businesses from 3%, but the share reporting lost revenue or share value after a breach rose from 2% to 5%. Fewer incidents with larger consequences is a reason to prepare more, not less.
How quickly must a personal data breach be reported in the UK?
Under UK GDPR Article 33, a notifiable personal data breach must be reported to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Sector regulators such as the FCA and SRA have their own notification expectations that run alongside.
Sources
- DSIT and Home Office, Cyber Security Breaches Survey 2025/2026, 30 April 2026.
- NCSC, UK experiencing four ‘nationally significant’ cyber attacks every week, 14 October 2025.
- UK GDPR Article 33, notification of a personal data breach to the supervisory authority.
Reviewed 20 October 2026.