Cyber risk: what businesses fear, what happens and what customers do next

How worried are businesses about cyber security?

Moderately. 49% of UK business leaders are concerned about it. That puts it fifth of nine concerns, behind employment costs (75%), energy costs (64%), tax (60%) and weak demand (57%). Read the full list.

How often does it happen?

More than anything else. When we asked which disruption had the greatest impact on their organisation in the past two years, cyber incidents came first on 16%, ahead of IT failure (13%) and staff shortages (12%). Cyber is also among the causes with the longest recovery. Read the disruption data.

Are businesses investing in it?

Few are prioritising it. 11% name cyber security and resilience among their top two investment priorities. Twice as many (22%) name AI and automation. Of those investing in AI, just 9% are also investing in resilience. Read the investment data.

What happens to customers after an attack?

Half step back. 50% of consumers say they would stop using a company that lost customer data: 46% until they felt the issue was resolved and 4% for good. Read the consumer data.

Businesses expect better. 75% of business leaders are confident they could maintain customer trust after a significant cyber incident, though only 10% are very confident.

What brings customers back?

Proof. 57% of consumers say evidence that security has been improved would do most to restore their trust. 1% say an apology from senior leadership. Read what rebuilds trust.

Does security slow down sales too?

Yes, and that is the part of cyber risk businesses feel every week. In B2B purchases, security or procurement review is the biggest single source of delay, named by 45% of buyers. In most deals it starts after the demo. Read the buyer data.

So security shows up three times in a business: as a risk that might stop you, as a review that slows your sales and as the proof customers want after something goes wrong. Only the first is usually on the risk register.

What this means

There is a consistent shortfall at each step.

• Worry is moderate, though cyber is the most common serious disruption.
• Investment is low, and lower still alongside AI.
• Confidence in keeping customers is high, though half of customers say they would pause.
• The recovery playbook leads with an apology, though customers want evidence.

For leadership teams, one exercise covers all four. Assume the incident has happened. Write down how long you would be down, how many customers would pause, and what you would show them to bring them back. If any of the three is a guess, that is where to start.

Frequently asked questions

How many UK businesses are worried about cyber security?

49% of UK business leaders are concerned about cyber security, according to The Reality Department's Business Reality Index.

What is the most common cause of serious business disruption?

Cyber incidents. 16% of UK business leaders say a cyber incident had the greatest impact on their organisation in the past two years.

Are businesses investing enough in cyber security?

11% of UK businesses name cyber security and resilience among their top two investment priorities, half the share prioritising AI and automation (22%).

Methodology

Figures come from three studies by The Reality Department in 2026: the Business Reality Index (500 senior UK decision-makers), the Cyber Trust poll (500 nationally representative UK consumers and 250 business leaders) and the B2B Buyer Journey (250 UK buyers). Fieldwork: August and October 2026.

Want to know how your customers would react? Work with us.