UK Small Business Cyber Outlook 2027

Three themes will shape cyber risk for small UK firms in 2027, and a fourth development, the rules, will change what customers, insurers, and regulators expect of you. None of them needs a big budget to address. All of them need somebody to decide who owns what.

Theme 1: Other people's problems become yours

The incident most likely to stop a small UK firm trading in 2027 will start at somebody else's business. The Jaguar Land Rover attack hit up to 5,000 organisations, mainly through the supply chain.^[20] In October 2026 ConnectWise, one of the biggest names in IT provider software, suspended its cloud backup service after a breach, leaving its customers to check for gaps in their backups.^[9] Yet only 12% of micro firms and 22% of small ones have reviewed the cyber risks posed by their immediate suppliers.^[1] Start by listing your five most important suppliers and five most important customers, and asking what stops if each one disappears for two weeks.

Theme 2: AI in the back office

By the end of 2027 most small firms will have AI wired into email, documents, and customer chat, and very few will have decided who controls it. 31% of businesses are using, adopting, or considering AI, and only 24% of those have any practice in place to manage the risk.^[1] The NCSC says prompt injection, where an AI tool is tricked by instructions hidden in the content it reads, "may never be totally mitigated".^[5] Write a one-page list of the AI tools your team uses and a one-line rule about client data.

Theme 3: Crime gets cheaper and faster

The gap between a flaw being published and a criminal using it has shrunk to days, and the NCSC expects AI to shrink it further.^[4] Authorised push payment fraud cost UK victims £576.4m in 2025, up 19%.^[21] Doing the basics quickly will beat buying anything clever: multi-factor authentication on every cloud service, automatic updates, a call-back rule for payment changes, and a backup that ransomware can't reach.

The rules change

Cyber Essentials now fails any applicant without multi-factor authentication on cloud services where it's available.^[19] The Cyber Security and Resilience Bill will bring medium and large IT providers into regulation, with 24-hour incident reporting.^[15] On 26 October 2026 the government lost two votes on it in the House of Lords.^[17] Lords Third Reading was set for 2 November, the day this report was published, so its outcome isn't covered here.^[14] Expect both to turn up in your customers' supplier questionnaires during 2027.

If you do five things before January

1. Switch on multi-factor authentication for every cloud service, starting with email.
2. Agree a call-back rule: no change to bank details or urgent payment goes through without a phone call to a number you already hold.
3. Send your IT provider the four questions in Theme 1.
4. List your five key suppliers, five key customers, and the AI tools your staff use.
5. Fill in the one-page plan in section nine and print it.

Most of these figures come from the government's Cyber Security Breaches Survey 2025/26, published on 30 April 2026, with fieldwork carried out between August and December 2025.^[1] It's the best national picture we have of how small UK firms actually behave. It relies on what owners report, so read it as a careful self-portrait.

Two numbers to read carefully

The median cost of £0 doesn't mean breaches are free. It means at least half of owners put no cost they could count on their worst one. The 95th percentile of £4,000 sounds survivable. Ask a Jaguar Land Rover supplier who couldn't invoice for weeks whether they'd sign off on it. Owners' estimates rarely include lost orders, staff time, or the customer who quietly went elsewhere.

The ransomware figure needs the same care. 1% sounds tiny. For the firm in that 1%, it is often the event that decides whether the business survives, and the NCSC describes ransomware as "one of the most acute and pervasive cyber threats to UK organisations".^[2] Low frequency, high consequence: exactly the sort of risk a printed plan exists for.

How firms are preparing

The preparation figures are the ones that worry me most. Only 21% of micro firms have a formal incident response plan, and just 29% have a board member or owner with named responsibility for cyber security.^[1] Formal cyber security policies have slipped too: 52% of small businesses have one, down from 59% the year before.^[1] When I talk about a "low bar" later in this report, these are the figures I mean.

Small firms have spent a decade being told to protect themselves. Fair enough. But the way most small businesses work in 2026 means their real perimeter runs through other people's offices: the IT provider who holds the admin passwords, the bookkeeper with access to the bank, the software firm that pushes updates every week, and the big customer whose purchase orders keep the lights on. When any of those go down, you go down with them, and none of your own controls will help.

What we already know

• Supply chain attacks travel. The Cyber Monitoring Centre estimated the Jaguar Land Rover attack cost the UK economy £1.9bn and affected up to 5,000 organisations, mainly through the supply chain. It classed the incident as a Category 3 systemic event.^[20]
• Retail went dark too. In the Co-op attack, the data of all 6.5 million members was stolen and some customers couldn't pay for their shopping.^[2]
• Serious incidents more than doubled. The NCSC handled 204 nationally significant incidents between September 2024 and August 2025, up from 89, which is about four a week. 18 were "highly significant", up from 12.^[3]
• Hardly anyone checks their suppliers. 12% of micro firms and 22% of small firms reviewed the cyber risks from their immediate suppliers. Only 6% of all businesses looked at the wider supply chain.^[1] Lucy Harper's May 2026 piece on the podcast's blog, "Six Percent", made the case for why that last number should keep owners up at night.^[27]
• More firms depend on an outside provider. 44% of micro businesses now use an external cyber security provider, up from 39%.^[1] That's sensible, and it concentrates risk: one provider's bad day becomes dozens of clients' bad day.
• Fake freelancers are real. The NCSC says UK firms are almost certainly being targeted by IT workers from North Korea (the DPRK) disguised as freelance IT staff from other countries, raising money for the regime.^[2]
• The wider world can arrive at your door. At CYBER UK 2026 in Glasgow, the NCSC's chief executive warned that if the UK were in or near a conflict, it would likely face hacktivist attacks at scale, similar in effect to today's ransomware, with no option to pay a ransom to recover.^[6] At the same event the Security Minister announced £90m over three years, including support for small and medium-sized firms.^[7]

The threats

What to do

The four questions for your IT provider, in one email:

1. Do you use multi-factor authentication on every tool that can reach our systems, including your remote management tools?
2. Who on your team can get into our systems, and from where?
3. How quickly will you tell us if you, or one of your own suppliers, are breached?
4. Do you hold Cyber Essentials Plus, and can we see the certificate?

I'd add a fifth for 2027 after the ConnectWise incident: where are our backups held, by whom, and is there a copy with a different supplier?

On the podcast: episode 1, "Knocked over by somebody else's breach" (2 November), and episode 2, "Four questions for your IT provider" (9 November).

AI arrived in small businesses the way the smartphone did: through the staff, before anyone wrote a policy. Somebody uses a chatbot to tidy up a quote. Somebody else connects an assistant to their inbox to draft replies. The bookkeeper finds a tool that reads receipts. Each choice makes sense on its own. Added together, they mean a growing share of your business data is flowing through tools nobody chose, under terms nobody read, with settings nobody checked.

That's shadow IT with better marketing, a point we made in late May 2026 in "Shadow AI Is Just Shadow IT Wearing a Cape".^[33] The difference in 2027 is that AI tools increasingly act. They send emails, update records, and book appointments. And they can be talked into doing things by the content they read.

What we already know

• Adoption is outrunning control. 31% of businesses are using, adopting, or considering AI. Of those, only 24% have any practices in place to manage AI risk.^[1]
• The core flaw may never go away. The NCSC warned in December 2025 that prompt injection "may never be totally mitigated", because large language models are "inherently confusable": they can't reliably tell an instruction from the data they're processing.^[5]
• More AI means more ways in. The NCSC's assessment of AI and the cyber threat to 2027 says that putting AI into more systems will almost certainly enlarge the attack surface, and it expects a digital divide between organisations that keep up and those that don't.^[4]
• Prompt injection has grown up. Researchers including Bruce Schneier mapped 36 studies and real-world incidents against a seven-stage attack chain and found attacks covering four or more stages becoming steadily more common since 2023, behaving like malware delivered through ordinary content.^[23]
• Parliament is paying attention. During Lords Report Stage on 26 October 2026, the government accepted amendments to the Cyber Security and Resilience Bill covering loss-of-control incidents involving AI agents.^[17]

The threats

What to do

On the podcast: episode 3, "Shadow AI and the poisoned inbox" (16 November), and episode 4, "The weekend-built tool, and Dave with a subscription" (23 November).

Cyber crime is a business, with suppliers, service levels, and a keen eye on costs. AI has cut two of its biggest costs: the time it takes to write a convincing scam, and the time it takes to turn a published flaw into a working attack. A fraudster who used to need good English and an afternoon of research now needs neither. A criminal group that used to wait weeks for a usable exploit now waits days.

For a small firm that means two things. The emails, calls, and video meetings you receive will look more convincing. And the window between "update available" and "update urgently needed" is now measured in days.

What we already know

• The patch window is closing. The NCSC says the time from disclosure of a flaw to its exploitation "has shrunk to days" and that AI will almost certainly reduce it further.^[4]
• The front door is still email and impersonation. 38% of businesses identified phishing and 12% identified someone impersonating their organisation or staff.^[1]
• Payment fraud keeps climbing. UK Finance reports payment fraud losses of £1.28bn in 2025, with authorised push payment fraud at £576.4m, up 19%. These figures cover all victims and aren't split out for businesses.^[21]
• Deepfakes already work at scale. In 2024 a finance worker at the engineering firm Arup in Hong Kong was persuaded to make 15 transfers totalling HK$200m, about US$25.6m, after a video call with deepfakes of the chief financial officer and colleagues. He'd initially suspected phishing.^[22]
• Government expects breaches. In October the UK's AI minister said: "It seems likely, if not inevitable, that our own cyber defences will be breached."^[8]
• Quote requests are the new lure. The security vendor Fortra reports that emails mentioning requests for quotation rose twelvefold between October 2025 and September 2026, that nearly 73% led to credential-theft pages, and that they came from 664 sender domains.^[12] Vendor figure These come from Fortra's own customer data, so treat them as direction of travel.
• Criminals are installing "support" tools. The same vendor reports phishing that abuses legitimate remote management tools rose 475% in the first nine months of 2026, aimed mainly at financial firms in North America.^[13] Vendor figure

The threats

What to do

Multi-factor authentication, or MFA, is a second check when you log in, such as a code or an approval on your phone. It's the floor for every account. Phishing-resistant MFA, using passkeys or physical security keys, is stronger than codes sent by text message, so move to it where your services allow. Never switch MFA off because it's inconvenient: fix the inconvenience. We covered why a flood of login prompts is a management problem in "MFA Fatigue Is a Management Failure, Not a User Problem" in May 2026.^[36]

On the podcast: episode 5, "The deepfake director" (30 November), and episode 6, "Exploited within days: the closing patch window" (7 December).

Regulation rarely lands on a five-person firm directly. It lands on your customers and your suppliers, and then it rolls downhill in contracts, questionnaires, and insurance renewals. Two developments matter for 2027. One is already in force. The other was in its final parliamentary stages as this report went to press.

Cyber Essentials, Requirements v3.3 and the Danzell question set

Cyber Essentials is the government-backed certification that shows you have the basic technical controls in place. The latest version applies to assessment accounts created after 26 April 2026.^[19] The changes that matter most to a small firm:

• Multi-factor authentication is mandatory on all cloud services where it's available. Missing it is an automatic fail, whether the service is free or paid.
• Cloud services can't be excluded from scope. Your Microsoft 365, accounting software, and booking system are all in.
• Passwordless sign-in and passkeys are highlighted as good practice.
• At Cyber Essentials Plus, a second failed device sample revokes your verified self-assessment certificate.

We walked through the transition in March 2026 in "Willow vs Danzel".^[35] The NCSC points to the cyber liability insurance that comes with whole-organisation certification, and to its Cyber Action Toolkit for sole traders and small organisations.^[2] Under IASME's current terms the insurance is opt-in, for firms domiciled in the UK or Crown Dependencies with turnover under £20m, with a £25,000 limit and a £1,000 excess.^[32] Check the eligibility details with your certification body.

One in four small firms has heard of Cyber Essentials when prompted, and about one in eight holds it. That gap is the opportunity. If your larger customers start asking for it in 2027, and I think they will, the firms that already hold it will be on the shortlist while everyone else is filling in forms.

The Cyber Security and Resilience Bill

The Cyber Security and Resilience (Network and Information Systems) Bill updates the UK's rules for operators of core public and digital services.^[14] It was introduced on 12 November 2025 and had its Commons second reading on 6 January 2026.^[15] For small firms, the headline is that it brings managed service providers into regulation.

What happened at Report Stage, 26 October 2026

The government was defeated twice in the House of Lords.^[16][17]

• Amendment 163 requires a review within 12 months of Royal Assent, then every year, looking at whether to bring cloud services, frontier AI, democratic processes, and advanced manufacturing into scope. Passed 202 to 155.
• Amendment 164 requires a register of foreign powers that pose cyber threats. Passed 194 to 155.
• Amendment 41, which would have required frontier AI developers to report interference, was rejected 165 to 95.
• The government accepted amendments on loss-of-control incidents involving AI agents, and strengthened the duty on MSPs and others to keep affected customers updated after a reportable incident.

That last change matters to you. If your IT provider is in scope, it'll have a legal duty to keep you informed after a serious incident. You'll still want it in your contract, because the duty depends on the incident being reportable and on secondary legislation still to come.

What happens next

Lords Third Reading was set for 2 November 2026, the day this report was published, so its outcome isn't covered here. The Commons then considers the Lords amendments, and the Bill may pass back and forth between the Houses before agreement. Royal Assent is expected between late 2026 and spring 2027, and most of the detailed duties will arrive through secondary legislation after that.^[18] The amendments carried at Report Stage could still be reversed in the Commons.

Status as at 31 October 2026, when Lords Third Reading was scheduled for 2 November. Check the Bill's page on the UK Parliament website for Third Reading and later stages.^[14]

On the podcast: episode 7, "Cyber Essentials after Danzell" (14 December), and episode 8, "The Bill, your IT provider, and your next contract" (21 December).

The ISF tells large organisations to protect a "minimum viable company": the smallest set of people, systems, and suppliers that keeps the business trading during an attack.^[25] For a small firm, that fits on one sheet of A4.

Most small businesses don't have an incident plan, and the ones that do often keep it somewhere useless. Only 21% of micro firms and 25% of all businesses have a formal incident response plan.^[1]

Answer the five questions on the sheet below, fill in the contact table, print two copies, and keep one somewhere other than the office. A plan stored only on the encrypted server is a plan you don't have.

For Mick at the garage, question one takes a minute: the job card system, the parts supplier's ordering site, and the card machine. Question three is where it gets useful. Can he run on paper job cards and phone orders for a week? He probably can, if he prints the week's bookings every Friday. That one habit is his business continuity plan.

Notes on the contact table

The ICO says that if a personal data breach is likely to risk people's rights and freedoms, you must report it "without undue delay, but not later than 72 hours after becoming aware of it". If the risk is high, you must tell the affected people too.^[24] Report Fraud replaced Action Fraud on 4 December 2025 and covers England, Wales, and Northern Ireland; in Scotland, call Police Scotland on 101.^[31] Call your insurer early: many policies include an incident response line, and some expect you to use their approved responders.

On the podcast: episode 9, "Your plan on one sheet of A4" (28 December). Do it before everyone's back.

Pick the column that matches your budget. Finish the first one before you spend a penny on the others.

If you do only the first column before 2027, you'll have done more on suppliers and incident planning than most firms in the government's own survey. That's a low bar, and it's still well worth clearing.

A word on what's missing. There's no artificial intelligence threat detection platform here, no dark web monitoring subscription, and no "next level" anything. Some of those products have their place in larger organisations. For a firm of 15 people that hasn't switched on MFA, they're a distraction with a monthly fee.

A plan for January to March 2027 that a 20-person firm can run without hiring anyone. Roughly two hours a week from the owner or office manager, plus whatever your IT provider charges for the bits you ask them to do.

By the end of March you'll have an incident plan, named responsibility, a tested backup, and evidence for your next insurance renewal. On the government's own figures, that puts you ahead of roughly three-quarters of UK businesses.

How this report was put together

The structure takes its inspiration from the Information Security Forum's Threat Horizon 2028 Executive View, published in January 2026: three themes, threats under each, and actions for leaders.^[25] The text, the themes as framed here, and every forecast are my own. The ISF has not reviewed or endorsed this report.

Facts were checked between 28 and 31 October 2026, and links between 28 October and 1 November 2026. Each one traces to a named source in section 13. The order of preference was UK government sources first, then named researchers, then reputable journalism. Figures that come only from a security vendor are labelled as vendor figures. Anything I couldn't verify was cut.

What "Our call" means

Each "Our call" panel is a judgement about 2027, based on the evidence in the same section and on what I see in small firms week to week. I haven't attached probabilities, because a number would suggest a precision these forecasts don't have.

Limitations

• Self-reported data. The Cyber Security Breaches Survey relies on what owners and managers tell interviewers. People under-report what they don't detect, and the cost figures are owners' own estimates.
• Size bands. The survey defines micro businesses as one to nine staff and small businesses as ten to 49. This report's audience, five to 50 staff, straddles both. Where a figure is given for all businesses, it includes medium and large firms too.
• A moving Bill. The Cyber Security and Resilience Bill was still before Parliament on 31 October 2026. Its final text, scope, and timetable may change.
• An unfolding incident. The October 2026 ConnectWise incident was still being investigated at the time of writing. Reported figures may be revised.
• Vendor data. Fortra's phishing figures come from its own customers and aren't representative of UK small firms.
• What isn't here yet. At the time of checking I could find no NCSC Annual Review for 2026. The 2025 review is used throughout.
• Geopolitics. This report describes the effects of world events on small firms. It names a country only where a cited source does: the NCSC on North Korean IT workers, and Microsoft on the ConnectWise breach. It names no conflicts.

All links checked between 28 October and 1 November 2026. Dates are publication dates where known.