UK cyber costs rise as visibility gaps drive longer dwell time

At a glance

What this is: Armis links rising UK cyber loss to expanding attack volumes, delayed detection and weak exposure visibility, with 2025 breach costs averaging £3.78 million.

Why it matters: For IAM, NHI and broader security teams, the message is that unmanaged exposure and slow detection translate directly into higher operational and governance cost.

By the numbers:

• The average cost of a data breach for UK organisations climbed to £3.78 million.
• In the twelve months to September 2025, the National Cyber Security Centre recorded 204 nationally significant cyberattacks.
• Highly significant incidents rose from 12 cases in 2024 to 18 in 2025.
• Only 33% of IT decision-makers worldwide strongly agree their organisation is prepared for a full-scale cyber-warfare attack.

Context

UK cyber insecurity is increasingly a cost and resilience problem, not just a detection problem. As digital footprints expand across IT, OT, IoT and cloud, organisations are discovering that the time between exposure and impact has become a major driver of financial loss.

The article argues that visibility, preparedness and response gaps are now shaping 2026 priorities. That matters for identity governance because the same blind spots that leave assets exposed also leave service accounts, credentials and access paths outside effective control, a pattern covered in the key NHI security challenges discussion.

Key questions

Q: How should security teams reduce breach cost when visibility gaps are widening?

A: Security teams should reduce breach cost by tightening the time between exposure discovery and containment. That means building a single inventory of assets, identities and business ownership, then using it to rank remediation by likely operational impact. If teams can only see the problem after attackers have moved laterally, they have already lost the cost-control advantage.

Q: Why do delayed detections increase financial impact so sharply?

A: Delayed detection gives attackers more time to expand access, disrupt more systems and create more cleanup work. The financial impact rises because recovery, interruption and investigation all scale with dwell time. In identity-rich environments, late detection also means stale credentials and overprivileged accounts stay usable longer, which extends the incident rather than containing it.

Q: What breaks when identity risk is not validated continuously in exposure management?

A: Exposure management breaks when identity risk is treated as static inventory instead of a live attack path. Teams may know an entitlement exists, but they cannot tell whether it is exploitable, whether it reaches critical assets or whether remediation has actually closed the path. That creates false confidence and weak prioritisation.

Q: Which matters more for resilience, faster detection or better prioritisation?

A: Better prioritisation matters first, because faster detection without context can still send teams to the wrong place. Resilience improves when organisations know which exposed assets, identities and processes create the highest business impact, then shorten detection and containment around those priorities. Speed only helps when it is aimed at the right target.

Technical breakdown

Why delayed detection turns cyber incidents into higher losses

The article ties breach cost to how long attackers remain undetected. In practical terms, dwell time increases the chance that an intrusion reaches more systems, more identities and more business processes before containment starts. The longer the attacker operates, the more opportunities there are for data theft, disruption and recovery expense. This is why response speed is not only a security metric but also a financial control. In environments with sprawling cloud, OT and NHI estates, delayed visibility often means the first reliable signal arrives after the attacker has already widened the blast radius. See the Identity Threat Detection and Response (ITDR) Guide.

Practical implication: Measure detection and containment speed as a cost-control metric, not just an operational KPI.

How cyber exposure management changes the control model

Cyber Exposure Management unifies asset visibility, contextual risk and remediation prioritisation across IT, OT, IoT and cloud. The mechanism is simple but important: instead of treating every exposed asset equally, it ranks what matters most to the business and directs action accordingly. That shifts security from a fragmented checklist to a governed exposure model. For identity teams, the parallel is direct. Unowned service accounts, leaked secrets and overprivileged machine identities are exposure items that need the same discovery-to-remediation discipline as endpoints and cloud workloads. See the Attack Surface Management Guide.

Practical implication: Tie asset discovery, ownership and remediation priorities together so exposed identities are treated as business risk.

Why AI-assisted security can reduce breach cost

The article says organisations using AI-assisted cybersecurity reported lower average breach costs than those without it. The key mechanism is not automation for its own sake, but faster triage, better correlation and quicker containment. AI can reduce analyst burden when the environment is noisy and the attacker is moving quickly. That said, the value only appears when the underlying asset and identity data are current enough to trust. Otherwise, faster automation just accelerates the wrong decision.

Practical implication: Use automation to accelerate containment only where identity and asset inventories are already reliable.

NHI Mgmt Group analysis

Visibility debt is now a direct financial liability. When organisations cannot see their full asset and identity exposure, they lose the ability to prioritise remediation before an incident becomes expensive. The article's cost figures show that the economic penalty of blind spots is no longer abstract. For identity programmes, the same debt appears in unmanaged service accounts, stale secrets and unowned access paths. Practitioners should treat visibility as a balance-sheet control, not a reporting exercise.

Cyber Exposure Management is the right abstraction for cross-domain risk. The article's CEM framing matters because it links discovery, context and remediation into one operational model. That is more useful than isolated fixes across cloud, endpoint or identity because the attacker does not respect those boundaries. Where exposure includes non-human identity risk, the same model should cover service accounts, tokens and certificates alongside infrastructure assets. Practitioners should converge on one prioritisation model instead of three disconnected ones.

The readiness gap is the governance gap. The finding that only 33% of IT decision-makers strongly agree their organisation is ready for a full-scale cyber-warfare attack points to a control problem, not a confidence problem. Organisations often overestimate response readiness because they measure tooling deployment rather than containment capability. The practical lesson is to test whether exposure data, ownership and escalation paths still work under pressure. Practitioners should validate readiness by simulating failure, not by trusting policy documents.

AI-assisted defence changes the economics of response, not the need for governance. Lower breach costs associated with AI-assisted security suggest that speed and correlation now matter more than raw alert volume. But the benefit only holds if the organisation has trustworthy identity and asset data feeding the models. Inaccurate inventories make faster response brittle. Practitioners should use automation to compress decision time, while keeping human accountability around exposure ranking and containment authority.

From our research library:

• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: Identity Threat Detection and Response (ITDR) Guide

What this signals

Exposure prioritisation is becoming the core resilience discipline. UK enterprises are no longer being judged only on whether they can detect attacks, but on whether they can reduce the business blast radius before loss compounds. The operational shift is from counting alerts to ranking exposure, ownership and recovery paths.

Service-account governance belongs inside the same exposure model as infrastructure. Hidden machine identities are often the shortest path between an initial foothold and a costly incident, which is why visibility into them matters as much as cloud posture. Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs, and that gap is a programme risk, not a niche hygiene issue.

Resilience programmes should assume attackers exploit blind spots first. As attack volume rises, the question for practitioners is not whether tools generate more telemetry, but whether the organisation can convert visibility into containment fast enough to protect critical services.

For practitioners

• Map exposure across IT, OT, IoT and cloud Build a single inventory that includes business ownership, criticality and reachability so exposure can be prioritised consistently across domains.
• Treat service accounts as reportable assets Include service accounts, tokens and certificates in exposure management workflows so hidden identities are not excluded from risk reviews.
• Track dwell time as a financial control Measure how long incidents remain undetected and correlate that with recovery cost, extortion exposure and business interruption.
• Test response readiness before escalation Run exercises that force teams to validate ownership, containment paths and decision rights under time pressure rather than assuming they exist.

Key takeaways

• UK cyber losses are rising because organisations still struggle to see and govern exposure before attackers expand access.
• The article connects higher breach costs to longer dwell time, wider blast radius and weaker response readiness.
• Practitioners need unified visibility, prioritised remediation and validated response paths to limit financial impact.

Related NHI Mgmt Group resources: Attack Surface Management Guide · Ultimate Guide to NHIs: Key Challenges and Risks · Identity Threat Detection and Response (ITDR) Guide · Digital Forensics (DFIR) Guide

Key terms

• Continuous Cyber Threat Exposure Management: Continuous cyber threat exposure management is a programme for discovering, validating, analysing, and remediating security exposure on an ongoing basis. It focuses on what is actually exploitable, not just what is theoretically vulnerable. The value comes from combining exposure data, control testing, threat intelligence, and business context into one prioritised workflow.
• Dwell Time: Dwell time is the period between an attacker gaining access and defenders detecting or removing them. Shortening dwell time matters because most damage happens while the attacker remains unnoticed. In identity-led environments, reducing dwell time depends on visibility into access paths, privileges, and session behaviour.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Service Account: A special-purpose account used by applications, automated tools, or services rather than a human user to interact with systems, APIs, and infrastructure. Service accounts are a primary category of NHI and one of the most frequently exploited attack vectors.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity control to the broader resilience and risk programmes their organisations depend on.