New Report Looks at the True Cost of Cyber Incidents For SMLs

The latest findings from ESET highlight the costs for many businesses;

ESET, a global leader in cybersecurity, today released a report finding that cyber incidents cost UK small-to-large sized FS firms surveyed an average of £726k in the past 12 months, this could mean up to an estimated £1.01 billion in losses for the FS industry.

The 2026 ESET UK Financial Services Security Report surveyed 500 UK small-to-large sized FS firms, finding that the vast majority of FS organisations experienced at least one cyber incident in the past year:

• 97% have been hit by cyberattacks in the past year, with 62% facing multiple attacks
• Of the FS firms surveyed who experienced a cyber incident in the past 12 months, it took 7 days on average to recover critical business operations after a security incident
• Just 11% of consumers would continue to use their FS provider as normal after a major breach exposed customer data
• Nearly six-in-ten (58%^xi) say it’s possible that their organisation could have been breached, and it’s not been discovered yet

“With almost every FS firm experiencing recent security incidents and financial losses, we’re well past warning signs,” warns Steve Round, Co-Founder and President at SaaScada, a global fintech headquartered in the UK. “Despite relatively strong cyber maturity, organisations urgently need to move beyond the basics. If not, they will continue to face serious financial losses, customer churn, and damaged reputations.”

Insurance softens the blow, but leaves FS firms paying out

While the FS industry has seen widespread cyber insurance adoption, on average, firms could be paying out for 44% of the cost of cyber incidents:

• 99% of FS firms surveyed have a cyber insurance policy in place, with 41% taking out a policy in the past 12 months
• However, on average, 44% of the cost of a cyber incident was not recovered through cyber insurance for UK FS organisations surveyed
• This potentially could have left the FS industry to absorb up to £456 million of annual cybersecurity losses in the past year

Security basics aren’t enough in the AI era

While FS firms have nailed the essentials, there are still advanced security gaps which are increasingly letting threat actors into systems, especially with the rise of AI-powered threats:

• The biggest cybersecurity challenges FS firms surveyed face are talent shortages (38%), delivering 24/7/365 security operations (33%), and securing legacy technology (32%)
• 65% don’t have a 24/7/365 managed detection and response service (outsourced to a vendor, insurer, MSP, or MSSP)
• 57% say they don’t have comprehensive incident response plans in place
• 60% say they don’t have comprehensive endpoint security

These potential security gaps stand out as the spectre of AI-powered threats and security gaps in AI tools looms. Financial Services firms’ top priority for the next 12 months is securing AI adoption (46%), while 86% have increased investment in cybersecurity due to AI. However, 62% of FS firms do not have an up-to-date AI security policy.

“The British FS industry must continue adapting to keep pace with cybercriminals,” argues Matt Knell, UK Country Manager at ESET. “That means bolstering their cyber resilience, delivering always-on protection that can keep up with increasingly dangerous cyber threat actors, and taking steps to protect against a rising AI attack surface and AI-powered threats.”

You can read the full report here.