Nearly four in ten UK businesses (38 %) do not allocate a dedicated cybersecurity budget, even as cybercrime costs hit an estimated £64 billion over three years.
Smaller enterprises are particularly vulnerable, with 15 % reporting breaches linked to underfunding.
Almost half of organisations (45 %) rely solely on in‑house defences, with only 8 % securing standalone cyber insurance, exposing many to evolving threats.
Common attacks include phishing campaigns, AI‑powered malware and DDoS, yet cybersecurity typically receives just 11 % of IT budgets.
Security professionals call for stronger board‑level involvement and increased collaboration with specialists and regulators.
They caution that businesses risk suffering further financial and reputational damage without proactive budgeting and external expertise.
