Key Insights from the NCSC’s Cyber Security Breaches Survey 2025

Breaches Slightly Down—But Threat Volumes Rising

• In the 12 months to April 2025, 43% of UK businesses reported experiencing a cyber breach or attack, a reduction from 50% in 2024. 30% of charities were affected.
• However, fewer reported incidents do not equal fewer attacks overall: data show a growing volume of cybercrime across the UK .

Phishing Still Dominates

• A staggering 85% of breached businesses and 86% of affected charities cited phishing as the root cause
• Organisations report rising use of AI‑driven social engineering, making phishing increasingly deceptive.

Medium & Large Businesses Under Persistent Fire

• While micro and small business breaches fell, medium and large firms remained seriously hit: 67% of medium and 74% of large businesses were breached, on par with 2024

Cyber Hygiene Shows Signs of Improvement

• Uptake of risk assessments rose: from 41% to 48% of small businesses.
• Cyber insurance, formal policies, and business continuity planning also saw notable year-on-year growth in SMEs.
• Basic controls (firewalls, secure backups, endpoint protection, password policies) are now widespread. Yet only 40% of businesses and 35% of charities use multi-factor authentication (MFA).

Ransomware Becoming More Common & Costlier

• Ransomware attacks, while still less frequent than phishing, are increasing, particularly hitting larger organisations.
• The average cost of a disruptive breach edged up from £6,940 to £8,260 for businesses; and £1,205 to £1,600 for those without an outcome.

Institutional & Educational Sector Highlights

• Educational institutions face even higher rates: 60% of secondary, 85% of colleges, and 91% of universities suffered attacks. Weekly breaches occur in 30% of higher-ed institutions.
• Crucially, schools and colleges show higher board-level engagement (over 95%) and often feature mature governance mechanisms .

What This Means for You

1. Don’t be lulled by falling percentages. Reduced reporting may mask attacks slipping under the radar.
2. Adopt advanced defences. MFA, VPNs, staff training, and user monitoring remain underutilised, yet essential.
3. Strengthen board engagement. Cyber oversight improves resilience, allowing strategic investment before incidents strike.
4. Monitor emerging threats. AI‑augmented phishing and ransomware gangs are evolving fast; proactive threat intelligence is vital.
5. Plan and insure responsibly. Cyber insurance, risk assessments, and incident planning aren’t optional, they are prerequisites.