New Business Reality Index data reveals a stark attention gap: the risks UK leaders worry about most are not the risks actually disrupting their businesses.
Ask a UK business leader what keeps them awake at night, and you'll hear a fast answer: costs, tax, demand. Ask the same person what actually stopped their firm from running in the last two years, and the answer changes.
That gap has a name in our data: the attention gap. This B2B research is the first wave of the Business Reality Index, a study of 500 senior decision-makers at UK firms with 50 or more staff. It gives business leaders clear business insights because risk work only helps when it tracks the right risks.
When we asked leaders to name their two biggest risks for the year ahead, the answers were mostly about cost and demand. Eighty-eight per cent named a cost or demand risk in their top two. Employment costs and National Insurance led the list at 75%, then energy costs at 64%, the tax burden at 60%, and weak customer demand at 57%.
Operating risks were on the list too, but much lower. Forty-nine per cent said they were worried about cyber security, 44% about skilled people, and 41% about supply chain reliability. The concern is real. It is just ranked lower.
This is not carelessness. It is a fair response to what is in front of leaders each month. Employment costs and tax policy show up on every P&L. A cyber incident or a supplier failure usually does not. Our data shows that when leaders can pick only two areas to focus on, visible monthly costs beat rare, hidden ones almost every time. Employment costs keep 39% of leaders' concern in that forced choice, cyber drops to 24%, and supply chain to 16%.
Over the 24 months before fieldwork, 91% of the firms we surveyed had faced a major disruption. Cyber incidents were the biggest single cause, named by 16% of firms. Then came IT or software failure at 13%, staff shortages or the loss of key people at 12%, and supply chain disruption at 11%.
Put the two sets of data side by side and the gap is clear. Twenty per cent of leaders named anything operating as a top-two risk for the year ahead. Yet operating failures — the cyber incident, the software outage, the supplier that did not deliver — caused 56% of the biggest impacts firms actually felt. The thing leaders give the least attention to is the thing most likely to stop them.
The hit is not small. Of the firms that were badly affected, nearly four in ten lost more than a week of operating time. The causes with the longest average recovery times were equipment breakdown, supply chain disruption and cyber incidents — the same issues sitting near the bottom of many risk lists.
It would be easy to say leaders simply get it wrong. Our data points to something more precise. The gap is not caused by leaders not caring about operating risk. It is caused by a trade-off system that always loses to cost pressure when the two compete for attention.
When we asked leaders what would most shape their long-term planning, UK tax policy came top at 64%. After that came skilled labour at 49%, interest rates at 48%, and political stability at 46%. Technology and AI disruption and energy costs both sat in the low forties. This is a leadership group that is thinking hard about the future, just through a cost-and-policy lens rather than an operating one.
That is the point worth naming for any risk team, insight team or comms lead trying to get operating risk taken seriously inside the firm. You are not fighting indifference. You are fighting a forced-choice ranking system where cost pressure wins by default. Naming that system is more useful than treating it like an attitude problem.
The wider market context shows why this attention gap matters. Independent UK cyber security research this year found that 43% of UK firms had a breach or attack in the past 12 months. Third-party involvement showed up in 48% of breaches, a 60% year-on-year rise. In manufacturing, 78% of firms reported a cyber security incident in the past year, and 95% of those incidents caused operating disruption.
The headline incidents from the past year show the far end of that curve.
The cyberattack on Jaguar Land Rover shut production for around five weeks. It was put at an economic hit of £1.9 billion. The disruption spread across more than 5,000 supply-chain firms. Marks & Spencer's cyber incident is thought to have cost the firm about £136 million.
These are not outlier firms with very poor controls. They are large, well-funded organisations, which is the point. If operating risk can do that much damage at that scale, the attention gap is not a rounding error in a risk register. It is a structural blind spot.
UK supply chain resilience data backs that up. Only 3% of firms say their supply chains are 'very resilient'. Just 15% review the risks from their immediate suppliers, and only 6% extend that review to the wider supply chain. Concern is broad. Scrutiny is narrow. That is the attention gap in miniature.
None of this means cost and tax risk should be pushed down. Seventy-five per cent concern about employment costs reflects a real, current pressure, not a distraction. The finding adds risk, it does not swap it out. Operating risk needs a seat at the table it does not have, without cost risk losing its own.
Three shifts follow straight from the data:
If your firm's risk register looks like the leadership view in this study — cost and tax at the top, operating risk further down — that is not always wrong. It may just be incomplete. The Business Reality Index was built to separate what leaders say worries them from what the evidence shows actually stops them, because the two data sets tell different stories. A risk function with only one of them has half the picture.
The full Business Reality Index report goes deeper, including how the attention gap changes by firm size, sector and disruption history. If you are building or reviewing B2B research that needs business insights like these, that is the kind of work we do.
Question: What is the attention gap?
Short answer: The attention gap is the mismatch between the risks UK business leaders focus on and the risks that have actually hit their firms. In the Business Reality Index, leaders most often pointed to cost and demand pressures, while operating issues such as cyber incidents, IT failures, staff shortages and supply chain disruption made up a much larger share of real disruption.
Question: Does the article say cost and tax risks are unimportant?
Short answer: No. The article is clear that employment costs, tax and demand are real and current business concerns. The point is not to ignore them, but to give operating risk more steady attention too. The finding is additive, not a swap.
Question: Why do operating risks get less attention if they cause so much disruption?
Short answer: The article says leaders are not blind to operating risk. They work inside a forced-choice system. Visible, repeat pressures such as employment costs and tax appear on the P&L each month, while cyber, supplier and systems risks stay hidden until they hit. Cost pressure wins by default.
Question: What practical steps can firms take to close the attention gap?
Short answer: The article recommends three main shifts: separate the risk register from the worry list, make operating risk visible on the same regular schedule as cost risk, and treat supplier and systems review as core governance rather than a compliance afterthought. Together, these steps help firms build risk planning around evidence of exposure, not sentiment alone.
Question: Why is supplier risk such an important part of the attention gap?
Short answer: Supplier risk matters because disruption often moves through links outside the firm's direct control. The article notes that only 15% of firms review risks from immediate suppliers, and just 6% extend that review to the wider supply chain. That narrow check contrasts with the damage supplier failures can do to recovery time and service uptime.