We would rather show you a sourced figure than a scary one. Everything on this page comes from a published UK source, says which year it covers, and links to where you can check it.
Every figure here is from the Government's own survey of UK businesses. It is the same source our bad-day calculator is built on.
43%
of UK businesses had a cyber breach or attack in the last year
That is roughly 612,000 businesses. It is down from 50% the year before, and the fall came mostly from fewer small firms reporting phishing.
A fall is good news. It is not the same as being safe, and it still means about two in five businesses had something go wrong.
Cyber Security Breaches Survey 2025/2026, DSIT and the Home OfficeThe twelve months to early 2026
46%
of small businesses were hit, against 42% of micro businesses
Attacks do not check how big you are first. Nearly half of small firms were hit, which is not far off the 65% of medium ones, and those medium firms usually have somebody whose job it is to deal with it.
Small businesses get close to the same attacks with none of the same help. That gap is the reason we exist.
Cyber Security Breaches Survey 2025/2026, DSIT and the Home OfficeThe twelve months to early 2026
51%
of breached businesses were hit by phishing and nothing else
Up from 45% the year before. For over half of the businesses that had a bad year, the whole problem was somebody clicking a convincing email.
That is worth knowing before you spend money. The most common way in is not clever software, and the fix is not clever software either.
Cyber Security Breaches Survey 2025/2026, DSIT and the Home OfficeThe twelve months to early 2026
25%
of businesses have written down what to do when it happens
Three quarters of businesses would be working it out on the day, while the phones are ringing and nobody can get into the system.
An incident plan is an afternoon’s work and it is free to write. It is the cheapest thing on this page and the least done.
Cyber Security Breaches Survey 2025/2026, DSIT and the Home OfficeThe twelve months to early 2026
5%
of businesses hold Cyber Essentials
Up from 3% the year before, so it is moving, but slowly. Cyber Essentials is the UK’s entry level security standard and it is increasingly what buyers, insurers and public sector contracts ask for.
Twenty out of twenty one businesses cannot answer that question with a yes.
Cyber Security Breaches Survey 2025/2026, DSIT and the Home OfficeThe twelve months to early 2026
Fraud is now the crime people in the UK are most likely to meet. These are the numbers behind that sentence.
4.5m
fraud incidents against adults in England and Wales
The highest figure since the survey started counting fraud in 2017.
Fraud is now the crime most people are most likely to meet. It is bigger than burglary, bigger than car crime, and most of it never reaches a courtroom.
Crime Survey for England and Wales, Office for National StatisticsYear ending March 2026
7.8%
of adults were a victim of fraud in a single year
About one adult in thirteen, in one year. In a family of six that is not a remote risk, it is a running one.
It also went up by 0.7 percentage points on the year before, while most other kinds of crime did not.
Crime Survey for England and Wales, Office for National StatisticsYear ending March 2026
£1.28bn
stolen through payment fraud in a single year
Up four per cent on the year before, and that is only the money that went through banks and was reported.
Some of it comes back. Not all of it, and not quickly. The rules on getting it back are real but they are hard to use, which is a large part of what CMS SecureMe is for.
Annual Fraud Report 2026, UK FinanceCalendar year 2025
70%
of bank transfer scams started on an online platform
A further 16% started over the phone network. Only a small share began anywhere a bank could see it coming.
By the time your bank is involved, the scam has usually been running for days on a marketplace, a social network or a messaging app.
Annual Fraud Report 2025, UK FinanceCalendar year 2024
Every figure on this page names its publication, says which period it covers, and links to the original. None of it is ours, and we have not rounded anything in our favour.
We do the same inside the products. The cost ranges in Cyber Made Simple are built from the Government survey above, and the scoring weights in CMS SecureMe are written down next to the reasoning for each one. When the evidence says a control does not work, we weight it accordingly and say why. You can read more about how we approach research.
Every figure on this page was last checked against its source on . If one has moved and we have not, tell us: hello@cmsinfosec.com.