The UK government launched a national campaign on 17 February 2026 to harden corporate cyber defences, with a clear focus on small and medium-sized businesses. It promotes the Cyber Essentials scheme and puts the annual cost of cyber threats at GBP 14.71 billion. Behind the awareness message lies a sobering picture: 82% of medium and large organisations reported an IT incident in the past year, while certification uptake, though rising, remains a minority practice.
🔑 Key takeaways
- DSIT and NCSC campaign launched on 17 February 2026, running across social media, podcasts and radio.
- 82% of medium and large organisations suffered an IT incident in the past year.
- Cyber Essentials uptake among larger firms rose from 23% to 30%.
- A significant cyber attack costs the targeted business GBP 195,000 on average.
- The claimed 92% reduction in insurance claims lacks a disclosed methodology.
A campaign aimed squarely at SMEs
Led by the Department for Science, Innovation and Technology (DSIT) and the National Cyber Security Centre (NCSC), the campaign urges business leaders to “lock the door” on cyber criminals. It runs across social media, podcasts, radio and business networks, targeting small and medium-sized firms that often lack time and specialist staff. The stated goal is to help them deploy baseline protections, secure their operations, protect jobs and support growth. The message also stresses supply-chain security and the long-term resilience of SMEs.
Numbers that put the risk in context
The government puts the annual cost of cyber threats to Britain at GBP 14.71 billion, or roughly GBP 14.7 billion according to press reports. A significant cyber attack costs the targeted business GBP 195,000 on average. According to DSIT and NCSC data, half of small businesses suffered a cyber attack or data breach in the past twelve months.
The Longitudinal Cyber Security Survey found that 82% of medium and large businesses experienced an IT incident in the past year. Several headlines round this to about 80%, but the official release gives the precise figure of 82%. The government’s message is that no organisation, whatever its size, is immune to cyber criminals.
| Indicator | Published figure | Scope |
|---|---|---|
| Annual cost of cyber threats | GBP 14.71bn | United Kingdom |
| Average cost of a significant attack | GBP 195,000 | Targeted businesses |
| IT incident | 82% | Medium and large firms, 12 months |
| Attack or data breach | 50% | Small businesses, 12 months |
| Cyber Essentials uptake | 23% to 30% | Larger firms |
Cyber Essentials: five controls within reach of small firms
Designed with experts from the NCSC and DSIT, Cyber Essentials rests on five control areas: firewalls, secure configuration, software updates, user access control and malware protection. The checklist is built for companies with no dedicated IT department.
The government notes that many incidents exploit precisely these basic weaknesses. Priority actions include regular software updates and controlling who can access accounts and data. These measures are presented as a way to strengthen organisational resilience immediately.
- Cyber Essentials Readiness Tool: an online self-assessment to identify security gaps.
- Free 30-minute consultations with an NCSC-approved cyber adviser for SMEs preparing for certification.
- Cyber Essentials Question Set: free preview access.
- Requirements for IT Infrastructure: a companion document for assessing readiness for certification.
Insurance and public contracts: a claim worth testing
Certification can also ease access to public-sector contracts. Eligible firms may receive free cyber insurance, including a 24/7 emergency helpline provided by the scheme’s delivery partner.
The government says organisations holding Cyber Essentials filed 92% fewer insurance claims last year and presents this as proof the scheme works. The release, however, does not specify the sample size, the exact comparison group or the calculation method. Without these details, the figure should be read as a communication metric rather than a verified result.
“No business is out of reach from cyber criminals. SMEs play a vital role in our economy, but too many still assume criminals only go after big brands.”
Baroness Lloyd, Minister for Cyber Security
The minister’s argument is that cyber risk is business risk, just like fire or theft. NCSC Chief Executive Dr Richard Horne made a similar point, noting that most attackers care little about size, reputation or logos: they are looking for opportunity and weakness.
“Small businesses do not need to go to the ends of the earth to put baseline cyber security measures in place.”
Dr Richard Horne, Chief Executive, NCSC
A broader legislative backdrop
The campaign sits alongside a wider effort. The Cyber Security and Resilience Bill aims to update and strengthen the UK cyber resilience framework for essential and digital services, as well as for major suppliers. Covered sectors include energy, water, healthcare and data centres. The government argues that stronger defences across supply chains will reduce the risk of disruption caused by cyber attacks.
The key point for observers is the measurable effect. Uptake rising from 23% to 30% among larger firms is a modest gain, and the campaign’s explicit aim is to accelerate adoption among SMEs, the principal target of the public messaging.
Conclusion: adoption needs to accelerate
The UK campaign highlights a gap: the risk is well documented and its cost is high, yet certification remains a minority practice. The increase from 23% to 30% reflects genuine momentum, but it is not enough to cover the broader SME base.
Three scenarios stand out. In the base case, the campaign and the insurance incentive gradually widen adoption without a break. In a bullish case, easier access to public contracts accelerates certification sharply. In a bearish case, incidents keep rising faster than basic protections spread, and the annual cost of cyber threats exceeds current estimates. The next DSIT and NCSC surveys will show which path is taking shape.
Sources
- GOV.UK, DSIT and NCSC press release, 17 February 2026
- The Register, 17 February 2026
- The Register (forum), 17 February 2026
- MyCyberWay, 17 February 2026
- Ground News, 17 February 2026
- SME Web, 17 February 2026
Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.
