British businesses are sharply increasing their cybersecurity budgets in response to a wave of sophisticated ransomware attacks targeting mid-market firms, according to new survey data from the Confederation of British Industry. The findings suggest that cyber risk has moved from an IT concern to a board-level priority for organisations of all sizes.
The CBI”s latest technology survey, which polled 480 UK firms across manufacturing, financial services, and professional services, found that 64 per cent had raised their cybersecurity spending over the past twelve months. The average increase was 18 per cent, with regulated sectors such as finance and legal services posting the largest jumps.
“What has changed is the nature of the threat,” explained Marcus Chen, head of cyber risk at consultancy RSM UK. “Attackers are no longer just encrypting files and demanding bitcoin. They are exfiltrating sensitive data first and threatening to publish it. That dual-extortion model has proven devastatingly effective against firms that thought their backup strategies were sufficient.”
The National Cyber Security Centre recorded 430 significant incidents in the first quarter of 2026, a 15 per cent increase on the same period last year. Ransomware accounted for just over half of those cases, with professional services firms and manufacturers the most frequently targeted sectors.
Small and medium-sized enterprises remain particularly exposed. A separate study by insurer Aviva found that only 38 per cent of SMEs have a formal incident response plan in place, despite nearly half reporting that they had experienced some form of cyber incident in the past two years. Many cite cost and a lack of in-house expertise as barriers to improving their defences.
The spending uplift is going primarily toward three areas: endpoint detection and response tools, staff awareness training, and cyber insurance premiums. Insurance costs alone have risen by an average of 22 per cent year on year, reflecting the growing frequency and severity of claims across the market.
Industry bodies are urging the government to expand the scope of the Cyber Essentials certification scheme and to provide tax incentives for smaller firms investing in security infrastructure. “The economic cost of cyber crime to the UK is now estimated at over £27 billion annually,” said CBI deputy director Sarah Kilpatrick. “We cannot afford to treat this as someone else”s problem. Every business that connects to the internet is a potential target.”