Cyber Security Month, The Hidden Costs Your IT Can’t Fix

A fifth of small businesses see cybercrime as the most impactful crime in terms of both cost and disruption to their operations.

We’re glad to see our recommendations to raise small firms’ awareness of cyber security have been taken forward in NCSC’s Cyber Aware campaign.

Equipping small firms with the right tools and tailored guidance could enable them to be more cyber resilient and, in turn, reduce costs in real life.

Every October, Cyber Security Month encourages businesses to think about passwords, phishing emails, software updates and data protection.

Those are all important.

But many small business owners still view cyber security as an IT problem.

The reality is that a cyber incident can quickly become a business problem.

Lost income. Customer disruption. Legal costs. Regulatory concerns. Reputational damage.

38% of the UK’s small businesses suffered a cyber incident over a 12-month period.

Even if your IT provider successfully restores your systems, there may still be significant financial and operational consequences to manage.

As cyber threats continue to evolve, understanding these hidden costs has become just as important as preventing attacks in the first place.

More tools and more spending aren’t making businesses safer.

Cyber Crime Is No Longer Just a Big Business Problem

Cyber threats and cyber crime are on the rise, with cyber criminals increasingly targeting small businesses.

Cyber criminals are increasingly targeting organisations of all sizes.

The UK Government’s Cyber Security Sectoral Analysis 2026 highlights the growing importance of cyber resilience across the economy. The National Cyber Security Centre has also launched additional services aimed specifically at helping smaller organisations improve their cyber security.

For small businesses, the challenge is often not a lack of awareness.

It is finding the time, expertise and resources to manage an increasingly complex threat landscape while continuing to run the business.

When a Cyber Incident Happens, the Costs Multiply

Many people assume that the main cost of a cyber attack is repairing damaged systems.

In practice, restoring technology is often only one part of the recovery process.

Depending on the incident, a business may also face:

• Loss of revenue during downtime
• Emergency IT and forensic investigation costs
• Customer notification expenses
• Legal and professional advice fees
• Regulatory reporting requirements
• Public relations and reputation management costs
• Data recovery expenses
• Credit monitoring services for affected customers
• Third-party claims and compensation costs

For many businesses, these secondary costs can exceed the cost of repairing the original technical problem.

The Biggest Threat Might Already Be Sitting in Your Inbox

Not every cyber attack involves sophisticated malware.

Many start with a simple email.

According to Coalition’s 2026 Cyber Claims Report, business email compromise, or BEC, remained the most common cyber claim type during 2025.

Business email compromise remained the most common event type, representing 31% of all claims in 2025.

Attackers increasingly use social engineering techniques to impersonate suppliers, colleagues, customers or financial institutions.

Their goal is often simple: convince someone to transfer money, reveal sensitive information or grant access to systems.

Business email compromise and funds transfer fraud together accounted for 58% of all cyber claims. Funds transfer fraud occurs when money from a business account or a client’s account is transferred to a fraudulent bank account.

The technology may be working exactly as intended.

The attack succeeds because it targets people.

Ransomware Is About More Than Locked Computers

Ransomware continues to generate headlines, but modern attacks are about far more than encrypting files.

Today’s attackers increasingly combine system disruption with data theft.

Coalition found that 70% of ransomware claims involved both encryption and data exfiltration.

This means businesses may face two separate challenges at the same time:

1. Restoring operations.
2. Managing the consequences of stolen data.

Ransomware may not be the most common cyber event, but it’s undeniably the most costly and complex.

Even after systems are restored, businesses may still need to investigate the breach, notify affected parties, seek legal advice and respond to regulatory enquiries.

These are business continuity issues, not simply IT issues.

Your Suppliers Can Create Cyber Risk Too

Modern businesses rely heavily on third-party providers.

Cloud software platforms, payroll systems, payment processors, website hosts and managed service providers all play an important role in day-to-day operations.

However, they can also introduce new vulnerabilities.

Coalition’s claims data found that third-party breaches accounted for a significant proportion of miscellaneous cyber losses, demonstrating how a problem affecting a supplier can quickly become a problem for its customers.

Even if your own systems remain secure, disruption elsewhere in your supply chain can still affect your ability to operate.

Small Steps Can Make a Big Difference

While no organisation can eliminate cyber risk entirely, there are practical measures that can significantly improve resilience.

The NCSC recommends:

• Using strong passwords and password managers
• Enabling multi-factor authentication
• Installing software updates promptly
• Maintaining and testing back-ups of critical business data
• Training employees regularly to recognise phishing attempts
• Reviewing user access permissions regularly

Many cyber incidents exploit basic weaknesses rather than highly sophisticated technical flaws.

Good cyber hygiene remains one of the most effective forms of defence.

Cyber Security and Cyber Insurance Are Not the Same Thing

Cyber security aims to reduce the likelihood of an incident occurring.

Cyber insurance is designed to help businesses manage the financial and operational consequences when an incident does occur.

Increasingly, cyber insurance is not just about financial protection after an incident. Some insurers also provide proactive cyber risk management tools that may help businesses identify potential vulnerabilities before they are exploited.

For example, FSB members registered with FSB Insurance Service can access a complimentary Cyber Risk Review powered by Coalition Control. It provides insight into potential cyber risks using publicly available information.

As cyber threats continue to evolve, many businesses are recognising that recovery planning is just as important as prevention.

Because when a cyber incident strikes, some of the highest costs are often the ones your IT team cannot fix.

Need Guidance on Cyber Risks?

FSB members can speak to a UK-based adviser about cyber risks and cyber insurance options.

Call 020 3883 7976 to discuss your business and the cover available.

This content is for general information only and is not intended to provide advice or a personal recommendation. Insurance cover is subject to the terms, conditions, and exclusions of the policy. Always consider your individual circumstances and seek professional advice before arranging insurance. External websites are not under our control and we are not responsible for their content.