UK SMEs face rise in cyber attacks with average cost GBP £7,960

Research from BT has revealed that UK small and medium-sized enterprises (SMEs) are being specifically targeted by cyber attackers, with a significant proportion lacking training in cyber security.

The study, conducted in partnership with Be the Business, indicates that around two million SMEs in the UK—representing approximately 39% of the total—have not provided cyber security training to their staff, despite the growing frequency and severity of cyber attacks.

Rising incidents

In the last year, 42% of small businesses report suffering a cyber attack or breach. Among medium-sized businesses, the figure rises to 67%. This upward trend in attacks has had a notable financial impact, with findings from a government survey referenced by BT showing that the average cost for micro and small businesses to recover from a serious breach stands at GBP £7,960.

The report cites phishing as the most prevalent form of attack, with 85% of UK businesses targeted by email scams. Ransomware attacks have also become increasingly common, doubling over the past year; data points to the number of affected businesses rising from under one in 200 to one in 100 over the period. Additionally, BT has highlighted a 1,400% surge in QR code-related scams, also known as 'quishing', over the last five years.

Business impact

The new research suggests that insufficient attention to cyber security measures could carry risks beyond immediate financial loss. A separate BT report notes that larger businesses adopting robust cyber security frameworks tend to demonstrate higher growth. The so-called "cyber agile" organisations reportedly maintain a 20% higher average growth rate in comparison to less proactive firms.

In response to these trends, BT has announced the introduction of a comprehensive security training package designed specifically for SMEs. The new programme aims to offer practical guidance on managing current and emerging threats, from AI and quantum computing to novel forms of account takeover and digital fraud.

Tris Morgan, Managing Director for Security at BT, stated, "At BT, our mission is to enable UK businesses to grow and prosper, and we know the challenges SMEs face protecting themselves from growing cyber threats. These often include budget constraints and the lack of a dedicated cyber team, but for SMEs a cyber attack isn't just an inconvenience; it poses an existential threat.

"The good news is that effective cyber security doesn't require corporate-grade resources. With the right training, basic security measures, and awareness, SMEs can dramatically reduce their risk profile. The key is recognising that, in today's digital landscape, cyber security is not a luxury but a foundation that enables companies to face forwards confidently, rather than forever looking over their shoulder."

Role of AI and external support

The study also reveals shifts in SME attitudes towards the use of artificial intelligence in cyber defence. While 18% name AI-based threats as their primary cyber security concern, 69% of business leaders are considering the use of AI tools for security purposes.

Half of SME leaders (46%) turn to outside industry experts for guidance on improving their organisation's cyber resilience, highlighting a preference for third-party expertise over in-house resources.

BT's new training programme includes educational modules addressing threats such as account takeover, in which cyber criminals use stolen passwords and credentials to access company systems, and quishing, which exploits QR codes as attack vectors.

These initiatives are designed to improve levels of cyber readiness among SMEs, many of whom currently lack the resources of larger firms to address risks effectively. The company has stated that cyber security tools requiring only modest investment can be effective in preventing the majority of attacks being faced by businesses today.

The BT and Be the Business research findings are drawn from surveys of SMEs and government data reporting on the cost and frequency of cyber breaches in the UK. The results underscore the evolving nature of cyber threats to SMEs and the importance of practical measures such as staff training, the use of security tools, and expert guidance.