Independent research finds cyberattacks cost the UK £14.7 billion

The Department for Science, Innovation and Technology (DSIT) has published new independent research estimating that the average cost of a significant cyberattack on a UK business now exceeds £190,000. This finding coincides with the introduction of the Cyber Security and Resilience Bill to Parliament (CSR Bill), underscoring the severity of the threat to the UK's national security and economic stability.

As cyberattacks escalate, the National Cyber Security Centre (NCSC) managed 204 significant or highly significant incidents in the year leading up to September 2025, averaging one major incident every two days. Furthermore, 43% of UK businesses reported experiencing a cybersecurity breach or attack last year.

Scaled across the economy, the total annual cost of significant cyberattacks is estimated to be £14.7 billion. Separate research also estimates that the theft of intellectual property and knowledge assets costs the UK between £1 billion and £8.5 billion in 2024. The consistent upward trend in incident costs and frequency confirms that cyber risk is pervasive and significant. The findings are set to boost current resilience measures and support the refresh of the National Cyber Strategy.