Most UK Small Businesses Are One Cyberattack Away from Catastrophe

If you run a small business in the UK and your cybersecurity strategy amounts to "it probably won't happen to us," you might want to sit down for this one. A recent survey suggests that one in five SME owners would have to shut up shop within three months of a serious data breach. That is not a typo. Twenty per cent. Gone. Lights off, doors locked, LinkedIn updated.

The Numbers Paint a Grim Picture

The survey, commissioned by Samsung to coincide with the launch of its Galaxy S26 Ultra Enterprise Edition (more on that in a moment), polled 1,000 UK SME owners and found some properly alarming figures. Businesses reported estimated losses of up to £100,000 annually from unbudgeted security fixes and malware recovery. That said, it is worth noting that the independent AMVIA UK SME Cybersecurity Report 2026 puts the average cost per breach at a rather more modest £6,400. The gap between those figures is significant, and the Samsung number likely reflects total annual security-related spending rather than a single incident.

What is not in dispute is the trend. According to AMVIA's independent study of 1,200 SMEs, 67% of UK small businesses experienced at least one cyberattack in 2025, up from 50% in 2024. The UK Government's own Cyber Security Breaches Survey 2025 found that 43% of businesses identified a breach or attack in the past year. However you slice it, attacks are becoming more frequent, and small businesses are squarely in the crosshairs.

Uninsured, Untrained, Unprotected

Here is where it gets truly uncomfortable. The Samsung survey found that 69% of SMEs have no allocated funds or insurance to cover a cyber incident. Nearly half (45%) provide zero cybersecurity training for staff. And 67% have not introduced any new security measures in the past twelve months.

Meanwhile, 58% of business owners happily connect to free public Wi-Fi, with 15% accessing sensitive work documents while doing so. That is the digital equivalent of leaving your office keys under the doormat and posting the location on social media.

Phishing remains the weapon of choice for attackers. AMVIA's report found it was implicated in a staggering 83% of SME cyber incidents in 2025. The Samsung poll noted that 88% of owners are at least aware of phishing threats, which is encouraging right up until you realise awareness clearly is not translating into action.

A Word on the Source

Transparency matters, so let us be upfront: the headline statistics here come from a Samsung-commissioned survey, released as part of a promotional push for the Galaxy S26 Ultra Enterprise Edition. The awareness campaign features cybersecurity consultant Stephen Libby, who many will recognise as the winner of The Traitors UK Series 4. The story was widely syndicated across regional outlets with near-identical wording, which is the hallmark of a PR wire piece rather than independent reporting.

None of that means the underlying problem is fabricated. Independent data from AMVIA and the UK Government corroborates the core message: small businesses are woefully underprepared for cyber threats. But you should weigh the specific figures with the knowledge that Samsung had a product to sell.

What Should SMEs Actually Do?

• Get staff trained. If nearly half your workforce has never had cybersecurity training, you are rolling the dice every time someone opens an email.
• Budget for it. Cybersecurity is not an optional extra. Treat it like insurance, because actual cyber insurance is something you should also look into.
• Stop using public Wi-Fi for sensitive work. Use a VPN or your mobile data. It is not difficult.
• Update your defences regularly. If nothing has changed in your security setup for over a year, something needs to change now.

Small businesses are the backbone of the UK economy, employing millions and generating billions. The idea that a fifth of them could collapse within weeks of a breach should be a wake-up call. The threat is real, even if the messenger has a phone to flog.

Read the original article at source.