The Cyber Security Breaches Survey is the UK government's official measure of how often organisations are hit and how they manage cyber risk, yet most coverage quotes one percentage and skips the method that gives it meaning. This guide explains the Cyber Security Breaches Survey 2025/2026, published by the Department for Science, Innovation and Technology (DSIT) and the Home Office on 30 April 2026, and compares it with the 2025 edition published on 10 April 2025. It sets out the headline figures by organisation size and type, what the survey measures and what it cannot, and how to use the results in board reporting, supplier assurance and benchmarking. It is written for CISOs, risk managers, trustees and small business owners in the UK. Figures were checked against the GOV.UK releases on 8 November 2026. For EU threat data in the same format, see the ENISA Threat Landscape Guide.
Last reviewed: November 2026.
Key takeaways
- 43% of UK businesses identified a breach or attack in the 12 months before the 2025/2026 survey (about 612,000), the same headline as the 2025 edition; charities fell to 28% from 30%.
- Size drives the numbers: 69% of large and 65% of medium businesses identified a breach or attack, against 42% of micro businesses, largely because bigger organisations detect more.
- Phishing dominates: it affected 38% of businesses and 25% of charities and was the most disruptive type of breach or attack.
- Governance is thin outside large firms: 31% of businesses have a board member responsible for cyber security, 30% did a cyber risk assessment and 15% reviewed immediate suppliers.
- Cyber Essentials uptake is low but rising: 5% of businesses hold it (3% in the 2025 edition), 35% of large businesses.
What the survey is and how it is run
The Cyber Security Breaches Survey is an annual official statistic on the frequency and impact of cyber breaches and on how UK businesses, charities and education institutions approach cyber security. The GOV.UK collection lists editions from 2017 onwards, and the survey informs government cyber policy. From the 2025/2026 release the reference period is labelled with two years, because fieldwork spans the turn of the year.
| Method element | 2025/2026 edition |
|---|---|
| Status and publisher | Official Statistics, published by DSIT with the Home Office as co-funder and responsible statistician |
| Fieldwork | Ipsos, 11 August to 12 December 2025; 44 qualitative interviews in October and November 2025 |
| Mode | Random probability sample, mainly telephone with an online option (225 of 3,774 interviews, 6%, online) |
| Sample | 2,112 businesses, 1,085 charities, 273 primary schools, 222 secondary schools, 33 further education colleges, 49 higher education institutions |
| Sample frames | Market Location database for businesses (replaced the IDBR in 2022/2023); charity regulators for England and Wales, Scotland and Northern Ireland; official lists for education |
| Weighting | Businesses by size, sector and region (region new this year); charities to the charity population; education samples unweighted |
| Exclusions | Sole traders, public sector bodies other than education, businesses with no IT capacity or online presence |
| Response rates (raw / adjusted) | Businesses 7% / 13%; charities 13% / 27% |
| Margin of error (95%) | Businesses ±1.6 to ±2.6 points; charities ±2.1 to ±3.5 points; higher education ±11.9 points on a 50% estimate |
The technical report states that breaches go undetected, so the survey probably underestimates their true level. It measures what organisations identified and reported to an interviewer, not what happened.
Headline figures: 2025/2026 compared with 2025
| Measure | 2025 edition (fieldwork Aug to Dec 2024) | 2025/2026 edition (fieldwork Aug to Dec 2025) |
|---|---|---|
| Businesses identifying a breach or attack | 43% (about 612,000) | 43% (about 612,000) |
| Charities identifying a breach or attack | 30% (about 61,000) | 28% (about 57,000) |
| Medium businesses | 67% | 65% |
| Large businesses | 74% | 69% |
| Businesses that were victims of cyber crime | 20% (about 283,000) | 19% (about 267,000) |
| Charities that were victims of cyber crime | 14% (about 29,000) | 14% (about 28,000) |
| Board member responsible for cyber security (businesses) | 27% | 31% |
| Cyber risk assessment (businesses) | 29% | 30% |
| Reviewed immediate suppliers (businesses) | 14% | 15% |
| Hold Cyber Essentials (businesses) | 3% | 5% |
| Any cyber insurance (businesses) | 45% | 47% |
Most year on year movements are within the margin of error for businesses (up to ±2.6 points). Treat one-point changes as stable and look for movements that persist across two or three editions.
Breaches and attacks by size, type and sector
- By business size (2025/2026): micro 42%, small 46%, medium 65%, large 69% identified a breach or attack.
- Types: phishing affected 38% of businesses and 25% of charities and was the most disruptive type for 69% of affected organisations. In the 2025 edition, 85% of businesses and 86% of charities that had any breach or attack had experienced phishing.
- Negative outcomes: 19% of businesses and 11% of charities had a breach or attack with a negative outcome, against 16% for both in 2024/2025.
- Sector: information and communication businesses reported breaches or attacks at 63% (69% the year before), while cyber crime in that sector fell from 43% to 22%.
- Education (2025/2026): 49% of primary schools, 73% of secondary schools, 88% of further education colleges and 98% of higher education institutions identified a breach or attack. See Education Sector Cyber Statistics.
The size gradient is partly detection. Large organisations have monitoring, logging and staff who notice attempted attacks; micro businesses often do not. A low figure for small firms is not evidence of low risk.
Cyber crime and costs
The survey separates breaches or attacks (any identified event) from cyber crime (offences such as unauthorised access, with an estimated victim count). Cyber crime results are comparable only from 2023/2024 onwards.
| Measure (2025/2026) | Businesses | Charities |
|---|---|---|
| Victims of cyber crime | 19% (about 267,000) | 14% (about 28,000) |
| Victims of cyber-facilitated fraud | 3% (about 43,000) | 1% (about 3,000) |
| Median perceived cost of most disruptive breach or attack | £0 (£30 for medium and large) | £0 |
| 95th percentile cost | £4,000 (£10,000 for medium and large) | £1,000 |
| Median cost of non-phishing cyber crime | £250 including zero-cost cases, £750 excluding them | Not reported separately |
From 2025/2026 the survey reports costs as medians and percentiles only. DSIT dropped means and says cost estimates should not be extrapolated to national totals. Costs are self-perceived and exclude much of the indirect cost a serious incident causes. For cost modelling, combine the survey with insurer and incident data; see the Cyber Insurance Statistics Guide.
Governance, risk management and supply chains
| Measure (2025/2026) | Businesses | Charities |
|---|---|---|
| Cyber security a high priority for senior management | 72% | 60% (68% in 2024/2025) |
| Board member or trustee responsible | 31% (large businesses 68%) | 30% |
| Cyber risk assessment | 30% | 27% (29% in 2024/2025) |
| Reviewed immediate suppliers / wider supply chain | 15% / 6% | 9% / 4% |
| Formal incident response plan | 25% (micro 21%, medium 57%, large 76%) | 19% |
| Formal cyber security strategy | Medium 57%, large 74% | High-income charities 44% |
Board responsibility ranged from 54% in finance or insurance to 17% in transport or storage. Risk assessment among small businesses fell to 41% from 48%. Supplier review remains the weakest area: fewer than one business in six looks at its immediate suppliers' cyber risk. See the Third-Party Risk Management Guide.
Cyber Essentials, guidance and insurance
- Cyber Essentials: 5% of businesses hold it (3% in the 2025 edition), 35% of large and 12% of small businesses. Prompted awareness was 17% of businesses and 16% of charities. See the Cyber Essentials Guide.
- NCSC 10 Steps: 17% of businesses and 19% of charities were aware of the 10 Steps to Cyber Security, yet 94% of businesses and 80% of charities had taken action under at least one step. The 10 Steps measures are not comparable with releases before 2022/2023.
- Cyber Aware: 30% of businesses and 30% of charities were aware of the campaign.
- Insurance: 47% of businesses and 35% of charities had some form of cyber insurance, but only 10% of businesses and 5% of charities had a specific cyber policy; the rest have cover bundled into wider policies.
Comparability caveats
- Not comparable with pre-2016 data: the earlier Information Security Breaches Surveys used a different design.
- Cost series breaks: cost collection changed in 2020/2021, and means were dropped in 2025/2026.
- Cyber crime and fraud: cyber crime is comparable from 2023/2024; cyber-facilitated fraud is not directly comparable with 2023/2024.
- Regions: region classification moved from Government Office Regions to ITL1 in 2025/2026, and region weighting was added.
- Low response: adjusted response rates are lower than before the COVID-19 pandemic, which raises the risk of non-response bias even with weighting.
Using the survey in practice
- Pick the right base: download the ODS data tables from the release page and find the row for your size band or sector, not the national headline.
- Answer the same questions internally: did we identify a breach or attack in the last 12 months, was phishing involved, did we have a negative outcome, do we have a board lead, a risk assessment, a supplier review and an incident response plan.
- Compare and explain gaps: where you are below your size band, record why and what you will do; where you are above on breaches identified, check whether that reflects better detection rather than worse security.
- Track over editions: keep the same measures each year so movements in your organisation can be set against the national series, using only comparable years.
- Report with caveats: state the margin of error and the fact that figures are self-reported when presenting to a board or regulator.
What the numbers mean for defenders
- Benchmark against your size band, not the headline: a large business should compare itself with the 69% detection figure and the 76% incident response plan figure, not with the all-business 43% and 25%.
- Phishing controls pay first: phishing is both the most common and most disruptive type. Phishing-resistant authentication and reporting routes address the biggest single share. See the Phishing Statistics Guide.
- Use the governance gaps in board papers: 31% board responsibility and 15% supplier review are national baselines a board can see itself against. The Board Cyber Risk Reporting Guide shows how to present them.
- Ask suppliers about Cyber Essentials: with 5% uptake, requiring it in contracts is still a meaningful filter, particularly for small suppliers with access to your systems.
- Do not read low costs as low risk: a £0 median reflects many minor events; the tail is where business-ending incidents sit.
Control mapping: board responsibility evidences NIST CSF 2.0 GV.RR-01; risk assessment ID.RA-03 and NIST SP 800-53 RA-3; supplier review GV.SC-07 and SR-6; incident response planning IR-8.
Practitioner checklist
- Cite the edition as "Cyber Security Breaches Survey 2025/2026, DSIT and Home Office" with the figure's base (all businesses, size band, or those with a breach).
- Compare your organisation with its size band and sector rather than the all-business headline.
- Check the margin of error before reporting a year on year change; ignore one or two point moves.
- Put the board responsibility, risk assessment and supplier review figures beside your own position in the annual board report.
- Record whether you have a formal incident response plan, cyber insurance with a specific policy and Cyber Essentials, so you can compare like for like.
- Do not extrapolate the survey's cost medians to national or sector totals; DSIT advises against it.
- Re-check each spring when the next edition is published and update internal benchmarks.
Standards and references
- DSIT and Home Office: Cyber Security Breaches Survey 2025/2026
- DSIT and Home Office: Cyber Security Breaches Survey 2025/2026 technical report
- DSIT and Home Office: Cyber Security Breaches Survey 2025/2026 education institutions findings
- DSIT and Home Office: Cyber Security Breaches Survey 2025
- GOV.UK: Cyber Security Breaches Survey 2025/2026 release page and data tables
- GOV.UK: Cyber Security Breaches Survey collection
Related NHI Mgmt Group resources: Cybersecurity Statistics Guide · Small Business Cyber Statistics · Cyber Essentials Guide · ENISA Threat Landscape Guide · Data Breach Statistics Guide