Hiscox puts the UK small-firm attack rate at 38% against a 29% global average

Multiply the rates by the per-incident costs and the UK looks better than the headline number. A UK small firm faces a 38% chance in a year of an incident averaging $35,908, which works out at an expected $13,645 ^[1][5][1]. The global equivalent, 29% of $52,000, is $15,080 ^[2][4][2]. Hiscox's own framing is that the lower UK cost per attack is offset because the higher frequency makes UK firms more likely to meet those costs ^[6]. It holds for the chance of being hit; on expected annual cost per firm the UK sits $1,435 below the global figure ^[3].

Firms that reported an incident reported an average of four attacks over 12 months ^[7], and the $52,000 and 32 hours are stated per incident ^[4]. Multiply those and a year at a hit firm comes to $208,000 and 128 hours of disrupted operations ^[4]. The two averages are published separately, and the multiplication assumes a firm hit four times pays the average each time.

Spending has moved the other way. The global average investment in cyber resilience was $51,000; UK firms averaged $59,700, third among the markets surveyed ^[10][11]. UK resilience spend therefore runs $23,792 above the cost of a single UK incident ^[6]. Training absorbed the most activity, with 62% of firms updating it, ahead of 55% hiring specialist staff and 51% adopting new technology ^[12].

The insurance figures in the report do not agree with each other. Government data from the Department for Science, Innovation and Technology puts dedicated cyber cover at 10% of UK businesses and 5% of charities ^[13]. Separate research cited in the same report puts uptake among UK SMEs at just over 40%, medium-sized firms at around 63% and the FTSE 100 at roughly 70% ^[14]. One figure is four times the other, on populations that overlap ^[7].

These are answers from cybersecurity decision-makers at smaller firms, 1,000 of them in the UK, not claims data ^[3]. A self-reported attack rate only captures the intrusions someone spotted. The 30-point gap between this year's 29% and the 59% in the previous report measures a change in who was asked: 5,750 businesses across seven markets then, almost 7,000 smaller firms now ^[8][9][5].

Respondents ranked reputation and customer trust as their most significant cyber risk, at 48%, with operational downtime second at 46% and supply chain or third-party disruption at 44% ^[15]. Among the firms that actually had an incident, 28% faced financial penalties and 26% experienced damaging publicity ^[16].