UK company directors are being urged to take a closer look at cyber and physical security as criminals find new ways to exploit weaknesses in systems, people and premises, amid gears they simply do, not recognise what good looks like.

The Government’s Cyber Security Breaches Survey 2025/26 found that 43% of participating UK businesses identified a cyber breach or attack in the previous 12 months – equal to around 612,000 businesses.

However, only 41% of small businesses carried out a cyber-security risk assessment. 52% had a formal cyber-security policy, and only 44% had a business-continuity plan covering cyber risk.

Under the Companies Act 2006, company directors must exercise reasonable care, skill and diligence to manage risk – including cyber security.

A small UK power plant was recently shut down following a cyber-attack. While the Government said the UK’s energy system was never at risk, the Department for Energy Security and Net Zero contacted power companies to warn them about cyber-attack risks.

Steve Cross, group technical director at PIB Insurance Brokers, said: “Over the last few years PIB have found that many organisations simply don’t know what ‘good’ looks like when it comes to fundamental cyber-security and controls.

“At the same time, small and medium-sized enterprises continue to emerge as the hidden victims of cyber-crime – often targeted by opportunistic hackers but ill-prepared to defend against or recover from attacks.”

He added cyber criminals are becoming increasingly sophisticated and bold. Threat actors are leveraging more advanced tools and techniques to breach defences. Stolen data now fuels a whole criminal ecosystem, powering everything from online fraud to ransomware extortion. Organised criminal groups trade in stolen personal information and network access on the dark web.
Experts claim that emerging technologies, such as artificial intelligence (AI), will further accelerate cyber-crime and provide criminal networks with entirely new capabilities. For example, Generative AI is already being used as a tool, with criminals using AI-driven chatbots to craft highly convincing phishing lures and social engineering scams.

Mark McSweeney, director of security operations at risk and security specialists R5 Global, said: “We provide intelligence-led physical penetration testing that assesses how security measures perform against real-world threats, not just compliance standards. By replicating attacker tactics, techniques and behaviours, we identify vulnerabilities before they can be exploited and give organisations practical recommendations to reduce risk.”

Cyber insurance, D&O insurance and commercial property policies cover different risks and include different terms and conditions Cross explained. Companies must understand and comply with these requirements to ensure cover is available when needed.

Insurance agency Bespoke Risk Solutions has joined the call for directors to check what their existing insurance actually covers.

Peter Collins, director of Bespoke Risk Solutions, said: “On several occasions, we have carried out audits and found that directors had not read the small print in their policy wordings. In some cases, that left the company’s financial future at risk because there was no effective insurance protection.

“Insurance is important and should form part of every company’s disaster planning. If a major cyber incident, theft or security failure occurs, directors may need to explain what protections were reviewed, what vulnerabilities were identified and what action was taken. Using the excuse of “We assumed someone else had it covered” may be a difficult answer for shareholders to accept.