Nearly one in three organisations globally have been hit by a successful cyber attack in the past year, as cyber incidents shift from an occasional threat to a routine cost of doing business in the digital economy, according to new research from Hiscox.

The 10th annual Hiscox Cyber Readiness Report, based on a survey of 6,800 cyber security decision-makers across the UK, Europe and the US, found that, on average, cyber incidents now cost organisations around $52,000 annually, in addition to approximately 32 hours of operational disruption.

The persistence of cyber attacks continues to shape business strategy. One in three say it delayed growth and expansion plans (32%), with similar numbers reporting increased staffing costs (31%), financial damage (30%) and lost opportunities (29%).

At the same time, companies are also concerned by the longer-term consequences of cyber incidents. Reputation and customer trust now rank as the most significant risk for half of businesses (48%), ahead of operational downtime or business interruption (46%) and supply chain or third-party disruptions (44%).

This reflects the true cost of a hack on business performance. Among organisations that have experienced an incident, over a quarter were impacted by financial penalties (28%) or bad publicity (26%).

Recommended reading

• Are You Ready for a Dark Web Data Leak?
• Revolut Posts Record £1.7Bn Profit As Retail Customers Soar
• Report: Phishing Clicks Surged 190% in 2024
• How Worried Are Brits About AI-Fuelled Phishing?
  

However, companies are responding by increasing investment in cyber resilience, with average spend on resilience measures being $51,000. For more than half, this includes investing in new technology (51%) and hiring specialist staff (55%), and for nearly two-thirds it means updating employee training (62%).

Eddie Lamb, Global Head of Cyber at Hiscox, said the findings highlight how the nature of cyber risk has evolved over the past decade. “During our 20+ years of insuring cyber risks and our decade of Cyber Readiness research, we’ve seen a clear shift in the cyber threat and how businesses respond to it. Cyber risk has become a recurring cost, not an exceptional event, so the investment we’re seeing in cyber resilience is good news as businesses start to take back control.”