This stark contrast underscores the escalating cyber threat landscape. Smaller businesses are not immune, with 9% experiencing such incidents in the past year.

The research indicates a worrying reality: businesses are 67% more likely to suffer a cyber incident than physical theft and nearly five times more likely to be targeted by cyber attacks than to experience a fire. The repercussions of these cyber incidents are significant, with 31% of businesses reporting operational disruption and 21% suffering data loss and system lockdowns. On average, these incidents cost businesses around £21,000, but the financial impact can soar into the millions.

Alarmingly, despite the risks, only half of UK businesses feel confident in handling a cyber incident. Twenty percent admit uncertainty about managing such events, with this figure rising to 27% among small businesses, who are notably more vulnerable. This lack of preparedness not only heightens the risk of further damage but also poses compliance issues with personal data regulations.

Aviva’s study also highlights a critical gap in cyber insurance coverage, especially among small businesses. Only 17% have a cyber insurance policy, and a similar proportion are unaware of its existence.

Commenting on the research, Stephen Ridley, Head of Cyber, Aviva, said: “It’s important to recognise that businesses of all shapes, sizes and sectors are at constant risk of a cyber attack – particularly at this time of year, with phishing emails often increasing around Black Friday and Christmas. The nature of such a threat means that cyber criminals are evolving their tactics, looking for the opportunity as opposed to setting their sights on large corporates alone.  

“Though our research shows that one in three (31%) businesses see cyber as the biggest risk to their businesses, it’s worrying to see that many businesses do not know how to protect themselves from this emerging threat. Many businesses do not have cyber cover, leaving them exposed to high, unforeseen costs and significant business disruption which could amount to tens of thousands of pounds.  

“If the chance arises, there’s a risk that cyber criminals will act and so it’s key to have both preventative measures and protection in place. Although businesses are more likely to purchase cyber cover after experiencing an attack, more and more affordable products are becoming available on the market from as little as £50 a year, like Aviva’s Cyber Respond. These could be a valuable lifeline to small businesses in particular, should the worst happen.”

Detective Superintendent Ian Kirby, CEO of the National Cyber Resilience Centre Group (NCRCG), said: “Cybercrime is something that can impact on any organisation, whatever its size or wherever it is in the country. It is essential that all businesses across the UK economy therefore have robust cyber practices in place, so that they are in the best position to protect themselves from cyber criminals.

“In the event of a live cyber attack, any business should immediately report it to Action Fraud who will direct them to the relevant law enforcement agency for investigation as appropriate. Importantly, however, I would also encourage small and medium-sized businesses to contact their regional, police-led Cyber Resilience Centre who will be able to offer free, high-quality support on the steps they can take to strengthen their cyber resilience for the future.

“One of the reasons why we are pleased that companies like Aviva have become National Ambassadors for NCRCG is that they recognise the risk of cybercrime, not just to themselves, but to all those in their supply chain, and are taking up the mantle in addressing this risk.”

Recognising these challenges, Aviva has launched Cyber Respond, an insurance policy tailored for micro-SMEs, starting from £50 a year. This policy complements their standard Cyber Complete policy for larger businesses. Aviva’s cyber products offer comprehensive support, including a dedicated team of experts to assist during the critical first hour following an attack and a 24/7 helpline. Additional benefits include specialist IT forensics support, identity fraud monitoring, credit monitoring, reputation management, and counselling services for small business owners affected by cyber events.