Phil Chapman, cybersecurity subject matter expert at Firebrand Training explains that businesses have to be ready for new rules on cyber security as awareness is simply not enough.

The government’s latest Cyber Security Breaches Survey shows cyber security awareness among UK businesses is at its highest recorded level. Yet only 19% of businesses ran any staff training in the past 12 months, a figure that has not moved in years.

Organisations understand, at a senior level, that cyber security is a real threat. They are not consistently translating that understanding into action. The result is a workforce that knows threats exist but has not been properly prepared to deal with them. For risk professionals, this is a familiar pattern. Awareness of a risk and readiness for it are not the same thing.

What “somewhat prepared” actually means

A significant proportion of organisations in the government’s survey describe themselves as “somewhat prepared” for a cyber-attack. In practice, that tends to mean basic perimeter defences, an untested incident response plan and a security team that has not had structured training in the past year.

The difference between an organisation that contains a breach quickly and one that spends weeks in recovery is not the sophistication of their tools. It is almost always the capability of the people handling it.

Research from Firebrand found that only 27% of UK organisations are fully prepared for AI-powered cyber-attacks, with seven in ten operating with partial or no AI-specific readiness. Nearly half had experienced at least one attack in the past 12 months. The financial cost, once recovery, downtime, regulatory exposure and reputational damage are factored in, most commonly landed between £100,000 and £199,999. For many organisations, a single breach costs more than several years of structured training would have.

The boardroom disconnect

The survey suggests that taking cyber security seriously at board level does not reliably translate into investment in the workforce. Security teams that do their jobs well tend to become invisible. Nothing goes wrong and leadership draws the conclusion that the risk is under control.

Harvey Nash data published earlier this year found that 77% of UK security professionals saw no salary increase last year, even as workloads grew. Attrition follows and with it institutional knowledge that takes time to rebuild. Boards that recognise cyber risk but underinvest in the people managing it are still exposed.

Training as a practical lever

The case for treating training as a core part of cyber risk management is well supported. Among organisations that invested in ongoing certification training, 86% reported a measurable reduction in cyber risk, with an average reduction of nearly 48%. Certified teams also recover faster when incidents do occur.

Certification has an internal value too. A team with recognised qualifications is easier to advocate for at board level than one whose expertise is assumed but not demonstrated. In organisations where security competes for budget against other priorities, that visibility makes a practical difference.

AI security standards and regulatory requirements are also still developing. NIS2, the EU AI Act, and sector-specific guidance are all moving targets. Teams that are trained continuously will adapt as requirements evolve. Those that are not will find themselves catching up under pressure.

The practical takeaway

The government survey is useful because it makes the gap visible. Awareness of cyber risk in UK businesses has genuinely improved, and that matters. But organisations that understand the risk and have not invested in preparing their people are still carrying significant exposure.

The evidence for what works is fairly consistent. Organisations that invest inconsistently in training and certification see lower risk, faster recovery and security teams that perform when it counts. The organisations that treat it as a priority before something goes wrong tend to be in a significantly better position than those that do not.