Despite 89 per cent of the 1,000 senior leaders of UK businesses admitting that the high-profile attacks against Jaguar Land Rover, Marks and Spencer and Co-op had made them more aware of the increasing threat facing them, only 45 per cent had ensured that their teams had had the required level of cyber awareness training. As a result, 71 per cent believed that at least one of their employees would fall for a phishing email.
Employees have been long considered the weakest link in any company’s defensive strategy. Cyber criminals actively target them and with their attacks becoming increasingly sophisticated it is a real worry that there appears to be a lack of proactivity in attempting to build up their knowledge and ability to spot a suspicious approach.
Even the reuse of passwords across multiple personal and work-related platforms remains an issue. The research showed that staff continued to use the same password on up to 11 different accounts, a huge risk, and one that has continued to blight businesses for years.
With the threat from cybercriminals only increasing in volume and sophistication businesses have to wake up to the reality of the consequences of being breached. Even those who believe they could survive such an attack, the financial, reputational and regulatory consequences would have a severe impact on their business.
As we have seen from the research, the increasing threat has seen many internal IT teams are struggling to implement internal protocols and keep up with the level of sophistication of the attacks. However, there are ways teams can help stop criminals getting in as AJ Thompson, CCO at Northdoor plc explains:
"One the face of it this research is shocking. One in ten companies are likely to go out of business if they are hit by a cyber-attack like theose high-profile breaches we saw in 2025. However, the level of preparation in UK businesses is nowhere near adequate.
"The key stats from this research highlight the lack of training of employees on how to deal with a potentially malicious approach, it what ever form it may come. Every business should now have protocols in place as well as an understanding of what the latest threats look like.
"However, with internal teams struggling with to deal with the number and level of sophistication of attacks, it’s no wonder that they are unable to more adequately help their team to deal with some threats.
"Many are turning to consultancies that can offer a level of expertise not found in internal teams. This means businesses are fully informed about the latest threats, protocols are implemented, staff are fully trained and, if the worst happens are there to help the business deal with the hack and get it back on its feet as soon as possible.
"Businesses in 2026 are likely to see an unprecedented number of cyber-attacks. Strengthening all defences, but particularly employees who remain the weakest link in a company’s defensive strategy. Bringing in a consultancy to add expertise and manpower can make a real difference in a business’s ability to fight off the threat of cybercrime," Thompson concluded.
