Why Only 1 in 3 UK SMEs Reported a Cyber Incident Last Year

According to the UK Government’s Cyber Security Breaches Survey 2024, only 1 in 3 UK SMEs reported experiencing a cyber incident last year. While this statistic might seem somewhat reassuring at first glance, the reality behind this number is much more concerning.

Here are some key reasons why many businesses, particularly small and medium-sized businesses in the UK may not be reporting cyber incidents, despite the increasing risks posed by cybercrime.

1. Lack of Awareness About Cyber Incidents

One of the main reasons we have seen that some SMEs fail to report cyber incidents is simply that people don’t know they’ve been attacked.

Cyberattacks often go unnoticed, especially if they are subtle or happen over time. For example, phishing emails or small-scale data breaches may not always trigger immediate alarms, and your employees may not recognise the signs of more sophisticated attacks like ransomware or malware infections at first glance.

In some cases, the attack may not have caused significant disruption or visible damage, leading businesses to underestimate the seriousness of the incident.

Many SMEs lack cybersecurity awareness training for their employees, making it harder for them to spot the warning signs of a breach.

2. Fear of Reputational Damage

For some SMEs, reporting a cyber incident could feel like an admission of weakness or incompetence. The fear of reputational damage can lead many businesses to either underreport or avoid reporting cyber incidents.

SMEs, especially those in customer facing industries, may worry that news of a data breach will damage customer trust and brand integrity.

This can be particularly concerning in sectors like finance, healthcare, and retail, where sensitive customer data is handled everyday.

You might feel that acknowledging a breach could cost you future business or lead to legal consequences, bt in actual fact it could get a lot worse if you don’t.

As a result, you may attempt to manage the incident quietly without notifying authorities or regulatory bodies, despite the long-term risks this could pose.

3. Lack of Resources and Expertise to Handle the Incident

Many small businesses simply don’t have the cybersecurity resources in-house needed to properly handle or even fully understand the scope of a cyber attack.

Unlike large corporations, which often have dedicated cybersecurity teams, SMEs oftern have limited IT departments or none at all. As a result, these businesses might not have the expertise to recognise the severity of an incident or to report it effectively.

That’s where we come in! As your trusted outsourced IT partner, we have the skills and expertise to ensure your business is protected just as well as any other for a fraction of the price of an internal cybersecurity team. We work with hundreds of businesses in the UK offering tailored support to fit around your business needs.

Talk to one of our experts today to discover how we can better support your business and give you 100% peace of mind moving forward.

4. Inadequate Legal and Regulatory Understanding

There’s also a knowledge gap when it comes to legal and regulatory obligations surrounding cyber incidents.

While larger businesses are often well-versed in their responsibilities under data protection laws such as the GDPR, many SMEs lack the legal guidance to navigate these rules. They may not be aware that they are legally required to report certain types of cyber incidents, such as data breaches, within a specific time frame.

Even if they are aware of these laws, the reporting process may seem complex or intimidating, especially if they are unsure of the specifics regarding data protection or cyber insurance claims. This lack of clarity can discourage SMEs from taking the necessary steps to formally report an incident.

5. Underreporting and Misclassifying Incidents

In some cases, underreporting of cyber incidents may be an intentional choice, driven by a desire to avoid the hassle or costs associated with investigation and remediation. Some SMEs might opt to fix the issue in-house without reporting it to the relevant authorities or cybersecurity bodies. This is especially true if the attack is perceived as “minor” or the impact is deemed to be limited to a small, isolated portion of the business.

Additionally, businesses may misclassify or downplay incidents, failing to categorise them as cyberattacks. For example, an attack might be categorised as “IT issues” or “network problems” rather than as a cyberattack. This can lead to an underestimation of the overall cybersecurity threat to the business and cause SMEs to overlook the long-term risks posed by unreported or unresolved attacks.

6. Perceived Low Impact of Attacks

In some cases, the immediate impact of a cyber attack may not seem severe enough to warrant reporting. For example, an SME might experience a brief network disruption or mild malware infection, which doesn’t cause any visible damage to operations, finances, or reputation. As a result, they may fail to recognise the importance of reporting the attack, thinking that it’s a one-off occurrence that doesn’t need further attention.

However, even minor incidents can be indicative of larger vulnerabilities, and failing to report them can prevent businesses from addressing underlying weaknesses in their security systems.

The Danger of Underreporting: What’s at Stake for SMEs

The decision to underreport or ignore cyber incidents can have far-reaching consequences for SMEs. Not only does it increase the risk of recurring attacks, but it also undermines trust with clients, suppliers, and other stakeholders. Moreover, unreported incidents can be more difficult to mitigate in the long run, especially if they grow into more significant security breaches.

To better safeguard against cyber threats, SMEs must take proactive steps to improve their cybersecurity posture, educate employees about the risks, and work with cybersecurity experts who can help identify, report, and resolve incidents effectively. Reporting breaches is not just about complying with legal requirements; it’s also about ensuring that businesses stay ahead of the ever-evolving cyber threat landscape.