WIREDGOV

The Cyber Security Breaches Survey 2025/2026 is an annual report commissioned by the Department for Science, Innovation and Technology (DSIT) and the Home Office.

It summarises the annual trends in cyber security awareness, approaches to risk management, prevalence and impact of breaches, incident response and the evolving threat landscape.

This year’s report is broken down into five key chapters:

1. Awareness and attitudes
2. Approaches to cyber security
3. Prevalence and impact of cyber breaches of attacks
4. Dealing with cyber breaches or attacks
5. Cyber crime

Key findings

One of the key findings from the report is the engagement from board and overall corporate governance. While 72% of businesses consider cyber security a high priority for senior management, a figure consistent with last year’s report, the charity sector saw a drop in the number of senior managers engaging with cyber security. However, over all there was an increase in board level engagement for large businesses from 27% to 31%, reversing a long downward trend.

Awareness of the government’s Cyber Aware campaign increased among microbusinesses and charities. The report also identified growing awareness of the Cyber Governance and Software Security Codes of Practice, following recent efforts by government to promote adoption across industry.  

The qualitative findings suggest that a series of high-profile cyber attacks over the past year has elevated cyber risk higher on the corporate agenda. However, this increased awareness has not yet translated into significant changes in behaviour, with little overall increase in cyber insurance uptake or investment in staff training and awareness programmes.

The report also highlighted continuing weaknesses in supply chain risk management. Only one in ten businesses reported reviewing risks associated with their immediate suppliers, while around half assessed risks across their wider supply chain. Levels of engagement varied significantly depending on organisational size.

A new section introduced this year examines organisational adoption of artificial intelligence. Almost half of businesses stated that AI was not currently relevant to their organisation, although medium-sized and large businesses were more likely to be adopting AI tools. Concerns around trust, cost, and return on investment were identified as key factors influencing adoption timelines.

Overall, the report concludes that while awareness of cyber risk continues to improve, there remains considerable work to do to ensure cyber security is consistently treated as a strategic priority by boards and organisations across the UK supply chain.

You can read the report in full here.