Tom Draper, UK Managing Director at Coalition looks at what is in the horizon when it comes to cyber risk in the year ahead.

The high-profile cyber-attacks on Marks & Spencer, Co-Op, and Jaguar Land Rover earlier this year were not “just another round” of headline-making ransomware attacks. They exposed how a single incident can cascade through complex supply chains and disrupt thousands of businesses. The lesson is a reminder: cyber risk is not an IT issue; it is a fundamental enterprise risk with the potential to impact entire economies. In 2026, organisations cannot afford to treat cyber as an exposure that is outsourced or siloed within the firm’s IT division. They need a standalone cybersecurity strategy to help prevent an attack in the first place.

Three shifts in attacker behaviours and market dynamics will define the year ahead: the targeting of small and midsize enterprises (SMEs), the acceleration of attacks through artificial intelligence, and a sharpened focus on supply chain risk. Together, they demand a more active approach to cyber risk management that continuously identifies, prioritises, and reduces exposure, rather than relying on a policy that sits passively on the shelf.

1. Small businesses become top prey for cyber attackers

While the recent attacks raised the profile of cybersecurity, they also reinforced a dangerous perception among SMEs that cybersecurity is a ‘big company’ problem. While SMEs view themselves as too small to be targets for cyber attackers and therefore not at risk, nearly 80% had experienced an attack in the last five years.

In 2026, the question for business owners and leadership teams must shift from “Are we big enough to be a target?” to “How easy are we to compromise compared to everyone else?”

Attackers are pragmatic. Rather than investing months in breaching a single company, they are increasingly using automation to scan the internet for easy targets, including unpatched servers, exposed remote access, misconfigured cloud services, and other metaphorical “open windows and doors.” We’ve already seen this start to play out, as businesses with internet-exposed technologies are significantly more likely to experience a cyber incident.

By hitting a larger number of SMEs with repeatable playbooks, attackers can compound smaller payouts — often £50,000 to £100,000 — that are paid more quickly and with less scrutiny and lower operational risk than a single £10 million demand from a large multinational.

Attackers already seek the lowest barrier to entry into an organisation. With automation, they can quickly identify the easiest way in, then execute ransomware, funds transfer fraud, or other common attacks. In this environment, smaller organisations can no longer hide in the crowd. Small businesses are more vulnerable than ever before.

1. AI will supercharge the next wave of sophisticated cyber attacks

Artificial intelligence is already changing the economics of cybercrime. Phishing emails that once sounded suspiciously generic or were riddled with spelling and grammar errors are now fine-tuned and tailored to individual recipients. Attackers can ingest massive amounts of email data to accurately mimic the tone and timing of genuine correspondence with suppliers and partners. In 2026, we expect to see this extend into convincing voice and video deepfakes.

AI will also make reconnaissance faster, compressing the time between a vulnerability being disclosed and exploited. Reconnaissance that used to take days or weeks can now be automated. Once attackers gain a foothold, they can move laterally in seconds, while many defenders still measure their response in minutes. In that gap, a small intrusion can escalate into a full‑scale business interruption event.

That’s why SMEs need help spotting and mitigating these vulnerabilities and exposures,  something that is often beyond the capabilities of their internal and external IT teams. Vulnerability alerts and cyber risk management platforms that are supported by an experienced security team can help close down these open windows and doors and reduce the likelihood and impact of a cyber incident. In 2026 and beyond, the contest between attackers and defenders will increasingly be decided by who can spot and stop attackers with better support, not who is spending the most on security.

1. Supply chain and aggregation risk moves to the top of the agenda

The attacks were more impactful not only because of what happened to the directly targeted companies, but because of the downstream exposure. After the attack on JLR, small manufacturers and logistics providers suddenly found their primary customer disrupted, orders halted, and cash flow at risk.

In 2026, we expect businesses, as well as their broker partners and insurers, to scrutinise these interdependencies. That means building more rigorous cyber due diligence and continuous monitoring into vendor management, with clear contractual expectations around security controls and incident response. This also means businesses will need to examine whether their existing insurance meaningfully addresses third-party risk and if their policies cover contingent business interruption when a key partner is taken offline.

Cyber risk must be viewed as a standalone risk and treated seriously

For businesses, the implication of these trends is clear. A passive approach to cyber risk management is no longer sufficient. Cyber risks are sophisticated and evolving; so defences must move as fast as attackers do and be addressed at a speed unlike other insurable risks. Implementing and enforcing proven controls such as multi-factor authentication, identity access management, and managed detection and response can make a meaningful impact, as well as implementing critical cybersecurity best practices, such as maintaining credible backups and having a robust incident response plan in place.

Active risk monitoring and remediating critical vulnerabilities as they arise (and before they’re exploited) can help prevent a claim from happening in the first place. Evaluating cyber risk distinctly from IT can help give your business’s security the attention it deserves. But for the most vulnerable and least resourced SMEs, it is a massive undertaking to do this alone.

Partnering with insurers and brokers can provide support beyond just a policy that sits on a shelf. A more active cyber insurance provider offers access to threat intelligence, security tooling, and expert advice when the worst happens.

If 2025 taught UK firms anything, it’s that when a cyber incident hits, you need technologies and support teams in place to minimise the fallout as much as possible.