The latest UK cyber security survey highlights why small businesses need clear security controls and a practical recovery plan.

The government’s Cyber Security Breaches Survey 2025/2026, published on 30 April, found that 43% of UK businesses had identified a cyber security breach or attack in the previous 12 months. That represents an estimated 612,000 businesses.

The figure includes attempted attacks as well as breaches; it does not mean that every affected business lost data. Nevertheless, it is a reminder that cyber security belongs on the agenda of businesses of every size.

A plan matters as much as protection

Only 25% of businesses reported having a formal incident response plan. For smaller organisations, knowing who to contact, how to contain a suspected incident and how to restore essential services can make an already difficult situation easier to manage.

What should your business review?

CIT recommends starting with the essentials: multi-factor authentication on important accounts, supported and updated software, suitable endpoint protection and backups that have been tested. Staff should also know how to report suspicious emails and unexpected requests for payments or passwords.

Give someone responsibility for checking these measures regularly. Record your key systems, support contacts and recovery priorities in a short document that remains accessible if your normal systems are unavailable.

Contact CIT to review your business IT security, backup arrangements and recovery planning.