Cyber-attacks are costing UK businesses about £64 billion annually, with £37.4bn in direct costs and £26.7bn in indirect costs, new research from ESET found.

Their report on the true costs of cyber-attacks found that these remain a significant challenge for businesses, with over half (53%) reporting an attack in the past three years. Looking ahead, 43% of respondents believe their organisation is likely to experience a cyber-attack within the next year.

ESET identified the most common cyber-attack models were phishing, malware, and followed by attacks or attempted attacks on online bank accounts.

Direct and indirect costs were both staggering, with around two thirds of organisations noting the most common direct cost being extra time and staff needed to mitigate the effects of an attack.

Ransom payments, lost or stolen funds, legal costs, operational disruptions, and third-party hiring costs also added up to the high price tag, let along higher cyber insurance costs.

Cyber-attacks often lead to firms needing more robust protections, meaning an increase in cyber budgets hence the mounting indirect costs of an attack. The loss of clients, redirecting resources, and the loss of a competitive advantage due to stolen assets or reputational damage also indirectly negatively impacted organisations.

In the long-term sense, over two in five organisations reported being restricted growth in their business as a result of a cyber-attack, with some (14%) having to even downsize, enter administration (15%), or undergo a merger or acquisition (16%).

Small businesses were hardest hit by these long-term affects (45%), the research found, while larger enterprises were more likely to need more funding to recover (46%).

Recommended reading

• Cybersecurity in 2024 | The High Cost of Innovation
• Identity Fraud Costs Soaring For Many Large Enterprises
• 87% of Firms Hit By AI Cyber-attacks

Still, despite these long-term impacts and expectations that these threats will increase, nearly half (45%) of UK businesses manage cybersecurity fully in-house, while 42% adopt a hybrid model combining in-house and outsourced functions and only 13% fully outsource their cybersecurity functions.

Still, most businesses (77%) plan to increase their budget in the upcoming year, with growing cyber risk concerns (69%), greater financial resources (46%), and recent cyber-attacks (16%) influencing these budget decisions.

The majority of businesses (53%) do note that cybersecurity has a positive impact on turnover beyond just improving security. Cybersecurity investment boosts UK companies revenue by 0.5%, which translates to £27bn. Key channels through which cybersecurity investment positively impacts growth included winning clients (70%), and IT system improvements (68%). The information and communication sector saw the highest positive impact, with an average impact on turnover amounting to 1.2%.