UK businesses shockingly unaware of how to handle security threats

The UK’s 2024 cybercrime survey shows alarming deficiencies in how businesses handle and report security breaches: only 22% have formal incident response plans, 10% report disruptive breaches to police, and even fewer engage with the NCSC or ICO; 39% took no action after their most disruptive breach. Awareness and use of official guidance (Cyber Aware, 10 Steps, Cyber Essentials) continue to decline, especially among micro and small businesses. Average breach costs are modest (£1,206) but rise sharply when material outcomes occur (£6,940 on average; up to £40,400 for larger firms). An estimated 312,000 UK businesses and 27,000 charities were targeted, with phishing identified by 90% and larger organizations disproportionately facing non-phishing threats such as unauthorized access, malware, and ransomware.