Newsletters
Risk Central
Digital EditionCyber Attacks Top Cause of IT Downtime for UK Businesses
Cyber incidents have overtaken hardware failures as the leading cause of IT downtime and data loss in U.K. businesses, with larger companies experiencing the most significant impact, according to a recent report by Databarracks.
The annual survey, which analyzes organizational resilience for cyber threats, emphasizes the urgent need for organizations to enhance their cybersecurity defenses to protect their operations, data, and workforce.
Cyber threats have become an unfortunate reality for a majority of U.K. organizations, with over 50% impacted in the past 12 months alone. However, the risk is not equal across companies of all sizes. A sizable 62% of medium-sized businesses and 56% of large enterprises reported falling victim to cyber incidents, compared to only 23% of their smaller counterparts.
The consequences have been severe, as cyber events overtook hardware failures in 2024 to become the primary culprit behind IT downtime. Responsible for 24% of incidents, up from just 10% in 2018, cyber attacks have quickly evolved into the most disruptive force for IT operations, the report noted.
For the third consecutive year, cyber attacks and security breaches topped the list of causes for data loss in organizations. In 2024, 46% of data loss incidents stemmed from cyber incidents. Again, company size emerges as a key factor in the impact, with 60% of large businesses, 48% of medium-sized companies, and 12% of small businesses suffering data loss due to cyber events.
The fallout from cyber attacks has extended beyond operational disruptions and data loss to take a human toll as well. Some 37% of cyber attacks resulted in job losses, whether due to employees being held responsible or financial pressures from the incident’s aftermath. The growing impact of cyber threats has made it clear that organizations of all sizes must prioritize cybersecurity to protect their operations, data, and workforce in the digital age.
For large organizations with extensive networks of suppliers, managing supply chain security and resilience is a significant challenge. Nearly one third, or 32%, of both medium and large organizations experienced a cyber attack on their supply chain in the past year, compared to only 16% of small companies.
This disparity is not surprising given the inherently greater complexity of larger organizations’ supplier ecosystems, the report noted.
In 2024, almost nine in 10 organizations (89%) report being fairly or very confident – and ultimately more prepared for – a crisis scenario, up from 82% a year ago. In fact, 38% reported being very confident of crisis response, up from 26% in 2023.
The number of organizations with a business continuity plan increased in 2024 to 82% from 73% in 2023. However, about a quarter continue to report that it is not up to date. Small companies are a notable outlier – with 39% currently lacking a business continuity plan.
The majority of survey respondents report having completed a full disaster recovery test from backups, with 62% having carried out a disaster recovery test in the past 12 months, and an addition 24% reporting a recovery plan that has not been tested in over a year.
However, the report notes this likely reflects overconfidence, as “very few businesses conduct a full DR test from backups” due to the significant time commitment required. The report also noted that 77% said the recovery process would take less than 24 hours, which is “far lower than we would expect for the majority of organizations.”
Three quarters of organizations have a physical, logical or combined solution for air-gapping their backups. However, smaller organizations are much less likely to employ an air gap, with 58% reporting that they have no air gap at all.
The survey for the first time asked respondents their views on artificial intelligence.
Almost two thirds of respondents are optimistic about the potential of AI to enhance their security, with 63% viewing AI as a benefit and 37% viewing it as a threat to IT security. Among small companies, 51% view it as a threat, the report noted.
“While around a third of survey participants have not assessed AI as a risk, the data suggests that it is a growing priority. Before 2019, just two percent of organizations had assessed AI as a risk. Within the past five years, that figure has grown to 65%,” the report noted.
“As with any technology, AI can be used for good or nefarious purposes. From bespoke phishing emails to convincing deepfake videos, the potential criminal applications of the technology are becoming increasingly clear,” stated Chris Butler, Resilience Director at Databarracks. “But we can also benefit from rapid advances in the field to protect ourselves. Whether it is used to streamline the workflows of cybersecurity teams or to independently detect potential threats – AI is an invaluable defensive tool,” he added.
The survey also tracked growing number of organizations with cyber insurance.
Cyber insurance is gaining among U.K. organizations, with two-thirds, or 66%, or organizations reporting having cyber insurance in 2024, up from 57% in 2023 and 51% in 2022, according to the survey.
While the number of organizations with cyber insurance has increased, claims themselves – as well as the amounts for each claim – are down. In 2024, 61% reported having no cyber insurance claims, up from 40% in 2022.
View the full survey here. &
