Cyber resilience is still severely lacking for thousands of businesses as many fear they simply cannot keep up with the changing nature of cyber-attacks.

A new study had found one in eight small businesses have experienced a cyber-attack and more than half fear they would be vulnerable to a critical data breach in the future.

A survey of 500 businesses found that, while many small-and-medium sized enterprises (SMEs) have implemented basic cyber security measures, critical gaps remain in training, incident response planning, and strategic preparedness that could prove catastrophic in the event of a serious breach.

Of those who responded, most said they lacked the resilience to withstand a prolonged operational shutdown, fewer than one in ten provide regular cyber security awareness training for staff, and less than a third have invested more in cyber security in the past two years.

The findings follow a sustained period of heightened cyber security risk for businesses, with the National Cyber Security Centre (NCSC) reporting record levels of ransomware attacks, business email compromise fraud, and supply chain vulnerabilities in recent years.

The study comes following several high-profile attacks reported on UK businesses – including Jaguar Land Rover, Arnold Clark, and major retailers, including Marks and Spencer and the Co-op – and there is evidence that attackers are targeting smaller businesses with weaker security defences.

The online survey – commissioned by IT support specialist Innovec – gathered responses from a randomised sample of SMEs across the country, spanning a range of sectors, from construction and financial services to hospitality and information technology.

Of the businesses that responded, 12.5% said they had experienced a cyber security breach in the past. Incidents included ransomware attacks, compromised email leading to financial loss (phishing), theft of customer and employee data and denial-of-service attacks.

A greater number said they felt their company was vulnerable to a future attack, with most indicating they would face critical financial pressure if they had to close operations.

One in eight respondents said their company would be unable to survive a complete shutdown lasting 48 hours or more, while almost a third estimated their maximum survival window in such circumstances would be three to seven days.

Iain Wham, managing director of Innovec, said the findings serve as a reminder that cyber security remains a significant business resilience challenge to a large proportion of the UK’s SME community.

He said: “As threats continue to evolve, and attackers increasingly target smaller businesses as entry points into larger supply chains, the need to act has never been greater.

“The question for SMEs and business support organisations is whether current levels of awareness, investment, and preparedness are sufficient to combat the next, inevitable wave of attacks.”

He explained for SMEs, which often lack the dedicated IT security teams and financial reserves of larger corporations, the consequences of a successful attack can be existential.

When asked to rate their vulnerability to a cyber-attack on a scale of one to five – where one represents “not at all vulnerable” and five “extremely vulnerable” – more than half of businesses (52%) placed themselves at level three or above.

A significant minority rated their vulnerability at level four or five, indicating a genuine and acknowledged exposure to risk.

Wham said: “The survey results suggest that, even among those who have implemented technical defences such as multi-factor authentication and regular data backups, the capacity to weather a prolonged disruption remains dangerously limited.

“They show that more than three-quarters of SMEs surveyed would face severe financial distress within a month of a complete operational shutdown – and for nearly half, the critical threshold would be reached within just two weeks or less.

“For many small businesses operating on thin margins, such a scenario would likely prove terminal.”

Of the businesses that responded, 12.5% said they had experienced a cyber security breach in the past. Incidents included ransomware attacks, compromised email leading to financial loss (phishing), theft of customer and employee data and denial-of-service attacks.