If 2025 has taught us anything, it’s that no one is safe from a cyber-attack. After a tsunami of high-profile network breaches and ransomware incidents, targeting every sector from airlines and telecoms to high-street supermarkets, security leaders are understandably concerned about what the next year will bring.

So concerned that the vast majority (85%) of UK firms are planning to plough significantly more money into their cyber budgets to keep up with adversaries, according to PwC’s latest Global Digital Trust report, with AI-fuelled attacks prompting a security spending spree.

Polling more than 330 British businesses, PwC found more than two-thirds (69%) plan to rethink their cybersecurity investment strategies to keep up with the threat landscape. As part of that, over half (56%) anticipate increasing their spending by more than 6% over the next twelve months, potentially adding up to millions more pouring into enterprise defences.

But while raising cyber budgets is evidently a priority, ensuring resilience is a different, trickier challenge. 

The study found that only about half of UK organisations (51%) believe they are “very capable” of addressing a major cyber-attack targeting network architecture. In contrast, half of all firms say their defences are only ‘somewhat capable’ of beating back attacks targeting specific vulnerabilities. 

Moreover, although half of UK companies intend to focus on building out AI threat hunting capabilities, fewer than 40% have implemented effective AI practices among the teams tasked with data risk management. 

As their needs grow more complex, business and security leaders are recognising that the first line of defence, the workforce, can’t be ignored.

PwC found that 57% of UK orgs plan to ramp up their spending on proactive measures, with employee retraining leading the way – 61% say they will prioritise AI and machine learning upskilling, while 47% will also focus on reskilling current employees to address other cyber skills gaps.

That same forward-looking mindset is driving action in quantum security, with nearly all (94%) UK firms now implementing, testing, or exploring quantum-resistant measures to stay competitive and protected.

For those looking to incorporate quantum-security measures within the next two years, investment priorities include implementing cryptographic discovery (29%), conducting a feasibility analysis (27%), and implementing “trust by design principles” (25%). 

Recommended reading

• Gartner: 40% of Enterprise Apps to Feature AI Agents by 2026
• NCSC Issues Quantum Security Roadmap For Businesses
• Firms Race to Adopt Post-Quantum Encryption As ‘Q-Day’ Fears Grow

With cyber now a defining factor in business resilience and spend climbing higher as the threats surge, PwC reports that the issue is driving deeper collaboration among the leadership.

In the UK, 58% of firms say CISOs are working closely with CIOs/CTOs on security infrastructure, while 56% report regular board-level engagement, outpacing global (48%) and Western European (50%) counterparts.

“Cybersecurity has long been a priority issue for UK boardrooms, and what we’re seeing now is a significant shift from concern to commitment,” said James Rashleigh, PwC UK & EMEA cyber leader.

“Organisations are backing up their awareness with serious investment, embedding security into innovation, and doubling down on preparations around emerging risks related to AI and quantum computing. 

“Those that act decisively will be best positioned to build trust and resilience in an unpredictable world.”