Inadequate cybersecurity measures are costing small and medium-sized enterprises (SMEs) in the UK £3.4 billion, according to a new report from Vodafone Business.

The new report, Securing Success: The Role of Cybersecurity in SME Growth, also found that the average cost of a cyber-attack for a small business in £3,398 with the figure rising to £5,001  for those with 50 or more employees.

The findings highlight the necessity for businesses to safeguard against rising cybersecurity threats, which result in financial losses each year due to data breaches, system downtime, and reputational damage.

Cyber-attacks against SMEs have surged in recent years, with studies revealing that more than a third (35%) experienced a cyber incident in 2024 alone. More than a quarter (28%) suffered between one and five attempted attacks, while 6% were targeted up to 10 times a year.

Many SMEs encounter difficulties in addressing these threats due to budget constraints, limited expertise, and competing business priorities, which impact their ability to implement comprehensive cybersecurity strategies.

Vodafone Business’ findings corroborate this, showing that over half (52%) of UK SME employees have received no cybersecurity training, while almost a third (32%) of SMEs had no cybersecurity protections in place at all.

Further, more than a third of SMEs (38%) invest less than £100 a year in cybersecurity, with more than two-thirds (64%) having staff working from home or other off-site locations regularly.

Shockingly, 60% of SMEs allow employees to use their own IT equipment when working from home, with a fifth (19%) of remote workers being targeted by cyber-criminals.

To try and stem the problem, more than one in eight (15%) SME employees have been banned from working from home due to the risk of falling victim to a cyber-attack.

Recommended reading

• 1 in 4 SMEs Find Remote Working A Key Cybersecurity Concern
• Is It AI or Bust for the UK’s SMEs?
• Samsung: Bad Tech Costing UK SMEs £300K Every Year

“SMEs are the backbone of our economy, yet they are losing a staggering £3.4 billion annually due to inadequate cybersecurity,” Nick Gliddon, CEO, Vodafone Business UK, said.

“In today’s rapidly evolving digital landscape, cyber threats are becoming more sophisticated, and SMEs are increasingly in the crosshairs of cybercriminals. Investing in robust cybersecurity is no longer optional – it is a business imperative for protecting sensitive data, maintaining customer trust, and ensuring long-term resilience.

“At Vodafone Business, we understand the critical role SMEs play in driving innovation and growth, and we are committed to equipping them with the right tools and expertise to stay protected. However, SMEs cannot tackle this challenge alone.

“Greater collaboration between businesses, industry leaders, and government authorities is essential to providing these businesses with the resources, education, and support they need to strengthen their cyber defences.

“By working together, we can create a safer, more secure digital environment that empowers SMEs to grow with confidence in an increasingly connected world.”