Nearly four in 10 UK small firms were hit by a successful cyberattack in the past year, according to the latest Hiscox Cyber Readiness Report. The UK cyberattack rate reached 38%, significantly above the 29% global average recorded among nearly 7,000 smaller businesses surveyed worldwide.

The 10th annual report surveyed cybersecurity decision-makers at smaller firms, including 1,000 respondents in the UK. Britain recorded the highest attack rate among the markets included in the research. Globally, businesses that experienced an incident reported an average of four attacks during the past 12 months.

UK cyberattack Rate Outpaces Global Average

The findings place UK small businesses at greater exposure to successful cyberattacks than their international counterparts. While 29% of organisations globally reported a successful attack, the figure rose to 38% among small UK businesses.

The report also found that cyber incidents are creating measurable financial and operational costs. Globally, each incident cost organisations an average of $52,000 and resulted in around 32 hours of operational disruption.

In the UK, the average cost per cyberattack was $35,908, equivalent to £26,650. Although that figure was below the global average, the higher frequency of attacks means UK firms are more likely to encounter those costs.

The global attack rate also fell from the 59% figure reported in Hiscox's previous annual report. However, the two figures are not directly comparable because last year's research surveyed a broader group of 5,750 businesses across seven markets, while this year's report focuses specifically on almost 7,000 smaller firms.

Cyber Incidents Affect Business Growth

Cyber incidents are also influencing business decisions beyond immediate recovery costs. Globally, 32% of affected firms said cyber incidents delayed growth and expansion plans.

Other reported consequences included higher staffing costs for 31% of businesses, direct financial damage for 30%, and lost business opportunities for 29%.

Reputation and customer trust ranked as the most significant cyber-related risk, cited by 48% of businesses surveyed. Operational downtime or business interruption followed at 46%, while supply chain or third-party disruption was identified by 44%.

Among firms that experienced an incident, 28% faced financial penalties and 26% experienced damaging publicity.

UK Firms Increase Cyber Resilience Spending

Businesses are responding to the continuing threat by increasing spending on cyber resilience. The global average investment reached $51,000, with firms directing spending toward new technology, specialist staff and employee training.

New technology was adopted by 51% of firms, while 55% invested in specialist staff and 62% updated employee training.

UK businesses reported considerably higher spending, averaging $59,700, or £44,294, on cyber resilience. That placed the UK third among the markets surveyed for resilience spending.

The report also identified a growing connection between cybersecurity performance and executive compensation. Globally, 32% of firms said executive pay is now linked to cybersecurity performance. Among UK small firms, the figure was 25%.

Cyber Insurance Gap Remains

The findings also highlight a continuing gap between cybersecurity exposure and insurance uptake in the UK. Government data from the Department for Science, Innovation and Technology shows that 10% of UK businesses and 5% of charities hold a dedicated cyber insurance policy.

Separate research cited in the report found that just over 40% of UK SMEs hold cyber insurance, compared with around 63% of medium-sized firms and approximately 70% of FTSE 100 companies.

The latest Hiscox findings therefore show a combination of high cyberattack exposure, substantial investment in cyber resilience, and relatively limited cyber insurance uptake among UK businesses.

At least 14 people connected to Serbia's student protest movement and opposition politics have been targeted with mercenary spyware since early 2026, the Belgrade-based digital rights organization SHARE Foundation said, in what it called the largest documented wave of such targeting in the country.

The group said the cohort includes student movement members, civil society activists, a member of parliament and a local councilor. Forensic analysis was independently confirmed by the Citizen Lab at the University of Toronto and by Amnesty International's Security Lab.

Citizen Lab, in its own findings, said it verified an infection with NSO Group's Pegasus on the iPhone of a student activist who asked not to be named. High-confidence infection indicators span December 2025 through January 2026, delivered by a zero-click iMessage exploit that required no interaction from the target. Apple has since patched the underlying flaw; the fix shipped in iOS 18.4.1. Pegasus grants an operator access to notes, photographs and messages decrypted on the device, and can silently activate the microphone and camera.

Amnesty's Security Lab confirmed a new variant of NoviSpy, an Android implant first identified in Serbia in 2024, on two additional devices. SHARE said the rebuilt version was designed to evade the detection methods that exposed its predecessor.

Also read: Investigative Journalists in Serbia Hit by Advanced Spyware Attack

The circumstances of two infections are what elevate the findings beyond routine spyware reporting. SHARE said one NoviSpy infection appeared after police seized a student's phone during questioning, and another after private messages from that device were published by a pro-government media outlet. Donncha Ó Cearbhaill, who heads Amnesty's Security Lab, said the evidence suggests "infections are being carried out during detention by Serbian authorities."

Suspicion centers on Serbia's Security Information Agency, or BIA. Amnesty's December 2024 report "A Digital Prison" found earlier NoviSpy samples configured to send collected data to IP addresses associated with BIA servers, and documented the agency's parallel use of Cellebrite extraction tools on journalists and activists. In March 2025, Amnesty reported that two journalists at the Balkan Investigative Reporting Network were targeted with Pegasus.

The current cases surfaced through Apple's threat notification wave of Aug. 13, which reached users in 110 countries. The timing is politically loaded. The targeting overlaps with protests that followed the November 2024 collapse of a railway station canopy in Novi Sad, spans local elections held March 29 in 10 municipalities, and precedes October parliamentary elections widely read as a test of the ruling Serbian Progressive Party.

Ana Toskic Cvetinovic, a legal expert cited in the reporting, noted that deploying intrusive software without judicial authorization is unlawful under Serbian law. SHARE published an analysis of the domestic legal framework in January arguing the same. Criminal complaints filed over the 2024 cases remain pending before Serbian courts, with no resolution.

Also read: 7 New Pegasus Infections Found on Media and Activists’ Devices in the EU

NSO has been on the U.S. Commerce Department's Entity List since 2021.

Serbia is an accession candidate, the European Parliament has previously questioned the Commission over unlawful spyware use in the country, and the Commission published its 2026 enlargement country report in July. Amnesty's submission for that package raised surveillance directly.

Both groups urged at-risk users to enable Lockdown Mode on iOS or Advanced Protection on Android.