Government publishes annual cyber security breaches survey

The cyber breaches survey 2025 details the frequency and impact of cyber breaches attacks on businesses, charities and educational institutions.

Key findings this year include:

• Just over four in ten businesses (43%) and three in ten charities (30%) reported having experienced any kind of cyber security breach or attack in the last 12 months.
• Like in previous years, this is much higher for medium businesses (67%), large businesses (74%) and high-income charities (64%).
• By far the most common type of breach or attack is phishing, reported by 85% of businesses and 86% of charities among the organisations that have identified any breaches or attacks.
• Larger organisations were more likely to put in place a number of response measures following a cyber breach or attack, and to have an incident response plan (53% of medium businesses and 75% of large businesses), as were those in the health, social care or social work sector (66%), finance or insurance sector (50%) and the information or communication sector (43%).
• Awareness of the 10 Steps guidance (12% of businesses and 15% of charities), and Cyber Essentials (12% of businesses and 15% of charities) was lower still, also reflecting a longer-term decline in awareness of the 10 Steps since 2020 (19% of businesses and 27% of charities) and Cyber Essentials since 2022 among businesses (16%). Limited awareness was particularly notable among micro businesses.
• Small businesses have seen increases on a number of cyber hygiene measures, including a rise in those undertaking cyber security risk assessments (48% up from 41% in 2024), an increase in those having cyber insurance in place, either from a specific cyber insurance policy or as cover from a wider insurance policy (62% up from 49% in 2024).
• The most common preventative measure adopted following a breach or attack was additional staff training (32% of businesses and 38% of charities), with likelihood to take some form of action to prevent future breaches and attacks increasing with organisation size.