75% of UK businesses have experienced a cyber-attack in the last year, with fraudulent emails or attachments being the biggest culprit, according to the latest UK Government-funded  CSLS survey.

In an effort to enhance security efforts of UK businesses and charities, the Department of Science, Innovation and Technology (DSIT) tracked the cybersecurity advancements of 1,000 organisations in a three-part survey from 2021 to 2023.

The results revealed that although a number of improvements had been made over that timespan, cyber-attacks are on the rise and there’s still work to be done to prevent stagnation.

Lack of adhering to cybersecurity best practices
Cyber-attacks are increasing in the UK, with the most recent stats demonstrating 26% of businesses experience attacks once a month, 12% once a week, 5% daily, and 10% several times a day.

As for types of attack, attempted hacking of websites and social media was the biggest offender, affecting 15% of businesses, compared to malware attacks (12%) and insider incidents (6%), the survey found.

Such incidents have financial implications, with £2,718 found to be the average cost across all businesses, rising significantly to £7,187 for those that identified incidents with an outcome.

The survey suggests the rise could be attributed to lack of proper integration of cybersecurity best practices, such as obtaining key industry certifications and conducting risk assessments.

For example, it uncovered that only a third of businesses are adhering to the three core cybersecurity certifications: Cyber Essentials Standard, Cyber Essentials Plus and ISO 27001, and only half are testing their incident response policies regularly.

Conversely, the majority (62%) of businesses were found to have the five technical controls needed to receive the Cyber Essentials accreditation, a Government-backed scheme from the National Cyber Security Centre (NCSC), used by some 30,000 organisations.

The scheme is important as it has become a prerequisite in securing new projects, highlighting scope for more businesses to become certified.

Why businesses are struggling to adhere
The report also set out to unveil areas of improvement, one being the use of cutting-edge technologies to detect cyber-threats.

For example, just one in four UK businesses (23%) are currently using AI or machine learning to improve their cyber-detection, indicating a reactive attitude to cybersecurity. This was found to be a recurring pattern where such technologies were only implemented after a breach and not as a preventative measure.

The proliferation of remote working since the COVID-19 pandemic has shifted the way that businesses manage their cybersecurity, with one third of employees now accessing work from home.

Not surprisingly, the survey found that businesses who allow staff to access their network via personal devices are at greater risk of a cyber-attack. And although 81% of businesses obligate employees to connect via a VPN for added security, there’s still room for improvement.

The study found that there is a correlation between the size of the business and how developed their approach to cybersecurity is, putting larger businesses at an advantage.

For example, use of AI for threat detection is more common among large businesses at 32%, compared to 20% among medium-sized businesses, which the survey finds is down to budget and resource restraints.

Cybersecurity impacts the whole business, not just IT
The results also verified the importance of cybersecurity being seen not just as an IT issue but as a business one, too.

It found that engaging the board and providing them with cybersecurity training can help improve resilience and minimise the risk of attacks. Illustrating this, data from the survey revealed that 50% of board members in UK businesses are now trained, up from 35% in the first survey, indicating businesses are taking action.

Recommended reading

• UK Gov to Link China to Electoral Commission Cyber-attack
• NCSC Releases Cyber Incident Response Guidance for CEOs
• Over 1 in 10 Business Leaders Don’t Know if They’ve Been Hacked

Looking to Scotland, senior-level engagement of cyber-resilience is already a top priority, with the Scottish Government funding the Cyber and Fraud Centre Scotland to deliver training to 150 Board Members and Senior Managers across the public sector.

This comes after the 2023 report found there was a decrease in members who were appointed to be responsible for cyber resilience, and concerns were raised that this may hinder progress towards a cyber resilient Scotland.