Cyber risk: from defence to resilience

For years, cyber-attacks were treated as rare, headline-grabbing events. Something that happened to someone else.

Today, nearly one in three SMEs has experienced a cyber-attack. And when attacks happen, they cost businesses an average of $52,000 and around 32 hours of disruption.

Not anymore.

But the real story isn't the financial loss. It's what comes next.

Growth plans get delayed. Customer trust takes a hit. Opportunities are missed. Teams are pulled away from the work that matters most to deal with recovery and disruption. In fact, almost a third of businesses say cyber-attacks have slowed growth or expansion plans.

For SMEs in particular, those impacts can be significant. Unlike larger organisations, smaller businesses often have fewer resources, smaller teams and less room for error when unexpected costs arise.

The shift from recovery to resilience

That's why one of the most interesting findings from this year's Hiscox Cyber Readiness Report isn't about attacks at all.

It's about investment.

Businesses are now spending almost as much on cyber resilience as they're losing to cyber incidents. They're investing in technology, training and expertise because cyber resilience is increasingly being viewed as a business issue rather than an IT issue.

AI is adding a new layer of risk

With AI becoming more embedded in everyday business operations, that challenge is only becoming more complex.

Organisations are already reporting AI-related cyber incidents, while concerns around AI-powered phishing, third-party AI vulnerabilities and manipulated AI data are growing. Yet businesses aren't backing away from AI. Instead, they're investing in the governance, skills and oversight needed to use it safely and effectively.

A business decision, not just a security decision

Perhaps that's the biggest shift we've seen over the past decade.

Cyber security is no longer viewed as protection against a worst-case scenario. It's becoming a core part of how organisations grow, innovate and build trust.

The most resilient businesses aren't necessarily the ones avoiding every cyber threat. They're the ones building cyber resilience into everyday business decisions.

"Cyber resilience protects more than systems. It supports growth, stability and customer trust."

Sources

Hiscox Cyber Readiness Report 2026