The ESET 2026 SMB Cyber Risk Report

33% of UK SMBs say they have a dedicated cybersecurity specialist.

32% of UK SMBs say cybersecurity is part of an IT specialist’s broader role.

Among UK SMBs that outsource at least some cybersecurity responsibilities, 57% use an MSP or MSSP to provide security.

49% of UK SMBs report experiencing a cyber incident in the past year.

UK SMBs take just over four weeks on average to identify and recover from a breach.

81% of UK SMBs say cyber warfare and global conflicts are a very real cyber threat that can impact their business.

86% of UK SMBs do not outsource any part of their cybersecurity responsibilities to an MDR service, MSP, or MSSP.

21% of UK SMBs say they have an internal Security Operations Centre (SOC) team.

11% of UK SMBs say they partially outsource cybersecurity responsibilities to a third party.

3% of UK SMBs say they outsource all cybersecurity responsibilities to a third party.

Among UK SMBs that outsource at least some cybersecurity responsibilities, 21% also use their Managed Service Provider for MDR.

Among UK SMBs that outsource at least some cybersecurity responsibilities, 27% outsource security via a cyber insurer offering MDR.

Among UK SMBs that outsource at least some cybersecurity responsibilities, 16% outsource security via a vendor offering MDR.

55% of UK SMBs expect their cybersecurity budgets to increase in the next 12 months.