Twelve Years On, 5% of UK Businesses Have Cyber Essentials. That Should Embarrass Every Boardroom in the Country
Cyber Essentials launched in 2014. It is a self-assessed certification against five basic technical controls: firewalls, secure configuration, user access control, malware protection, and patching. It costs a few hundred pounds. It takes a day, maybe two, if your environment is a genuine mess.
Twelve years later, 5% of UK businesses hold it. Five per cent.
I have spent this entire week working through the government’s own Cyber Security Breaches Survey 2025/2026, and that number is the one I keep coming back to, because none of the usual excuses survive contact with the rest of the data.
”It’s Too Expensive”
No, it isn’t. The assessment itself costs a few hundred pounds. What actually costs money, sometimes a great deal of money, is fixing twelve years of deferred maintenance that certification finally forces you to count. That’s not the same thing, and conflating the two is exactly the kind of dishonest framing this platform exists to call out.
The survey shows 24% of UK businesses already have technical controls in place across all five Cyber Essentials areas. They haven’t certified. They’re doing the work and simply not claiming the credit. If cost were the real barrier, that 24% figure wouldn’t exist, because the controls themselves would be missing too, not just the paperwork.
”It’s Just a Certificate, Not Real Security”
Also true, also not an excuse. Nobody serious claims Cyber Essentials makes you invincible. It’s an MOT, not a guarantee. But an MOT still catches the car with no brake pads left, and that’s precisely the point. It’s a baseline, not a ceiling, and refusing to clear a baseline because it isn’t a ceiling is not a principled objection. It’s an excuse dressed up as sophistication.
”Nobody Asks For It”
Increasingly, they do. Small business certification jumped from 5% to 12% in a single year, according to the same survey, driven almost entirely by procurement pressure: insurers, clients, and tender requirements starting to demand evidence instead of assurances. If nobody’s asking you yet, that’s a matter of time, not a permanent exemption.
”We’re Too Small to Be a Target”
This one should have died years ago, and it still hasn’t. The NCSC dealt with 204 nationally significant incidents in the year to August 2025, more than double the year before. Jaguar Land Rover’s disruption alone cascaded across more than 5,000 supply chain organisations, the overwhelming majority of them small and medium businesses that were never the primary target. You’re not too small to be attacked directly. You’re cheap and easy to hit as a route into somebody bigger, which is arguably worse.
The Real Reason
Strip away the excuses and what’s left is priority, not capability. Board-level responsibility for cyber security sits at 31% nationally, up from 27%, which is genuine progress. But it also means 69% of UK businesses have no board member who owns this at all. Cyber security remains, for most companies, something IT handles, rather than something the board is accountable for.
That distinction matters more than any single technical control. A twelve-year-old laptop doesn’t survive in daily use because nobody in IT knew it was old. It survives because nobody with budget authority decided it mattered enough to replace. Shared logins don’t persist because nobody understood the risk. They persist because nobody with authority insisted on the fix. Every one of these failures traces back to a decision, or the absence of one, at board level.
What Actually Needs to Change
This isn’t a call for more spending. It’s a call for boards to treat five basic technical controls as a governance decision they own, rather than a technical detail they’ve delegated and forgotten. Twelve years is long enough to have run out of good excuses. The data this week has made that plain enough. What’s left is a choice.
What This Means for Your Business
-
If cyber security sits entirely with IT and nobody at board level owns it, fix that first. It costs nothing and changes everything about how the rest of this list gets prioritised.
-
Check whether you already meet the five Cyber Essentials technical areas before assuming certification is expensive. A meaningful number of UK businesses already qualify and simply haven’t claimed it.
-
Stop treating “we’re too small to be targeted” as a reason to deprioritise this. Supply chain exposure means size no longer protects you the way it once did.
-
Put certification on the board agenda this quarter, not as an IT line item, but as a governance decision with a named owner and a date.
| Source | Article |
|---|---|
| GOV.UK | Cyber security breaches survey 2025/2026 |
| NCSC | Cyber Essentials overview and requirements |
| iseoblue | Cyber Security Breaches Survey 2026: Small Business Analysis |
| PrivacyEngine | Cybersecurity Statistics UK 2026 |