A staggering 74% of mid-to-large UK businesses have experienced cybercrime, yet many business leaders lack a clear understanding of cyber risks as financial threats, reveals a new survey by cyber risk solutions provider Resilience in partnership with YouGov.

The survey, which polled 206 financial and IT decision-makers at UK firms with annual turnovers above £100m, highlights a disconnect between perceived and actual drivers of financial loss. Data breaches sswere the top concern for 72% of respondents, far outpacing ransomware (47%), despite ransomware causing over 80% of financial losses among Resilience clients in 2023-24.

Data Breaches Take the Spotlight

The prominence of data breaches reflects the regulatory pressures under General Data Protection Regulations (GDPR), which require incidents to be reported within 72 hours. This scrutiny overshadows ransomware, despite its greater financial impact.

“Cyber risk has become an undeniable reality for businesses of all sizes,” said Vishaal ‘V8’ Hariprasad, CEO of Resilience. “Traditional approaches are no longer enough. Organisations must embrace a financial lens to improve cyber business decision-making and achieve resilience.”

Vendor Oversight: A Key Blind Spot

Another area of concern is third-party vendor risk. While 83% of respondents claimed familiarity with their vendor systems, nearly half (47%) experienced disruptions lasting over 12 hours due to vendor breaches in the past year. Notably, only 35% of leaders found vendor due diligence to be effective in mitigating risks.

Larger businesses displayed slightly more awareness, with 44% identifying vendor outages as a key concern compared to 40% overall. Among firms with annual turnovers exceeding £750m, 43% viewed vendor due diligence as effective, compared to just 24% of those below £250m.

Mid-Sized Firms: A Growing Target

As cybercriminals shift focus to “big-game hunting,” mid-sized firms face heightened risks. These businesses often lack the resources to mitigate third-party attacks effectively. By contrast, 34% of companies with turnovers above £1bn avoided vendor-related outages altogether.

Resource constraints also hinder mid-sized firms’ ability to quantify risks. While 54% of businesses surveyed maintained quantitative risk registries, this shortfall limits their ability to manage the financial implications of cyber incidents.

Cyber Insurance: Underused and Undervalued

Although 93% of businesses reported having cyber insurance, only 45% of leaders believed it effectively reduced losses. Furthermore, 30% of businesses with cyber insurance failed to file any claims, suggesting a gap in awareness or utilisation of coverage.

A Call for Financially Focused Cyber Strategies

The findings underscore the need for businesses to approach cyber risks with a financial lens. Quantifying risks and investing in targeted mitigation strategies can enable companies to minimise losses and optimise returns on cybersecurity investments.

“By modelling potential impacts and ensuring returns on cyber insurance, leaders can counter cybercrime more effectively,” said Hariprasad. “Bridging these gaps is crucial for businesses to remain resilient in an era of escalating threats.”

As the cyber landscape grows increasingly complex, UK business leaders face a pressing need to realign their risk management strategies, recognising the financial stakes at hand.