The state of security incidents
The incidents causing serious disruption are often familiar rather than sophisticated. From phishing to misconfigurations and supplier weaknesses, this chapter examines what organisations are experiencing, where controls fall short and the operational costs that follow.
The worst incidents are nothing new
As we’ve seen, there’s often a difference between what security leaders worry about and the threats their organisation is actually experiencing.
That’s why we not only ask respondents about their current challenges, and concerns about the future, but also what the most significant security incidents of the past year have been. Their answers tell us that governance is perhaps not as strong as it should be.
The type of security incidents most respondents have suffered over the past 12 months will come as no surprise to many. Phishing/vishing (32%) remains the most common, followed by those other staples: data breaches (25%), malware infections (25%) and cloud breaches (21%). These answers would have been much the same had this question been asked five years ago.
What types of security incidents have you experienced over the past 12 months? (Top responses)
When asked about the most significant incident or near miss over the past year, things get slightly more interesting. Unapproved AI – whether leaking confidential information or accessing a business application – stands neck and neck with phishing on around a quarter of respondents. Supplier weakness (12%), misconfiguration (11%), basic control failures (10%), and insider threats (8%) come next. Only 7% cite a sophisticated attack.
What does this tell us? That the most serious security incidents still come down to basic gaps in governance rather than advanced threat actors wielding AI tools. It illustrates a lack of visibility and control over which tools employees are using and how they are monitored, the quality of security awareness programmes, and how suppliers are assessed and managed. It’s also notable that basic configuration and control errors represent nearly three times more serious incidents than sophisticated attacks.
What does this tell us? That the most serious security incidents still come down to basic gaps in governance rather than advanced threat actors wielding AI tools.
Time and again, data breach post-mortems have shown us that key best practice measures weren’t in place at the time of an incident. Capita’s SecOps team took 58 hours before responding to an intrusion. South Staffordshire Water did not run regular vulnerability scans or enforce least privilege policy. ACRO did not monitor for security updates or alerts. All were compromised, with Capita and South Staffordshire Water fined close to £15m in total by the Information Commission.
Calculating the impact
Our research underscores the potentially serious consequences of security governance oversights like this. The vast majority (83%) of respondents say their worst incident disrupted operations for at least a day. For over two-fifths (42%) the problems lasted for four days or more, and for one in 10, the chaos continued for over a week.
Roughly how long was your business disrupted or unable to operate normally as a result of a security incident in the last 12 months?
This can have a significant impact. For responding organisations that had employee data compromised over the past year, many cite internal audits (30%), disciplinary action or terminations (25%), increased compliance costs (22%), and direct costs such as remediation (22%). Scrutiny from the supply chain (19%), system downtime (18%) and regulatory/legal costs (17%) are also mentioned. Interestingly, the specific consequence of a breach often tracks the type of data lost: customer churn follows 28% of customer-data compromises versus 14-21% for other data types. And breach notifications follow over a quarter (28%) of PII compromises.
All of which can have a crippling financial and reputational impact on a breached organisation, as well as eroding employee morale to a degree which may be hard to recover from.
Regulatory fines are serious, but they’re by no means the only factor to consider. Only 10% of respondents say these accounted for the largest single cost of a recent security incident.
A plurality (25%) of respondents says their most significant security incident of the past year cost between £100,001–£250,000, although for over a fifth (21%) it was between £250,000–£1m. Regulatory fines are serious, but they’re by no means the only factor to consider. Only 10% of respondents say these accounted for the largest single cost of a recent security incident. Remediation (22%), downtime (17%) and insurance premiums (15%) were more common costs. That could indicate to regulators that financial penalties aren’t being calibrated, or wielded, effectively
Roughly what was the total cost to your business of your most significant security incident in the last 12 months?
*Those who have experienced any cyber security/information security incidents in the last 12 months
Which, if any, of these was the largest single component of that cost?
*Those who have experienced any cyber security/information security incidents in the last 12 months
Organisations are usually faced not with novel attacks, but tried-and-tested techniques designed to exploit gaps in security. Cyber-hygiene best practices are one of the best ways to close these gaps and enhance resilience.
For large organisations with a low tolerance for outages, like manufacturers and retailers, the disruption can be intolerable. In an extreme example, Jaguar Land Rover was estimated to have lost £108m in fixed costs and lost profit each week during a ransomware outage in 2025. For Marks & Spencer, the financial impact of having no online sales was calculated at £1.3m per day.
This should reinforce the importance of controls which can prevent incidents in the first place. And in the second instance, enable breached organisations to contain the threat and recover as quickly as possible while maintaining minimum viable operations. Organisations are usually faced not with novel attacks, but tried-and-tested techniques designed to exploit gaps in security. Cyber-hygiene best practices are one of the best ways to close these gaps and enhance resilience.
