Large UK businesses are more likely to report a cyber breach than small ones. 69 percent of large businesses identified an attack in the last year, compared with 46 percent of small businesses and 42 percent of micro businesses, according to the government’s Cyber Security Breaches Survey 2025/2026. Medium sized businesses sit at 65 percent.
That gap looks like good news if you run a smaller business. It probably means the opposite.
| Business size | Identified a breach or attack in the last 12 months |
|---|---|
| Micro (fewer than 10 employees) | 42% |
| Small (10 to 49 employees) | 46% |
| Medium (50 to 249 employees) | 65% |
| Large (250+ employees) | 69% |
A large business reports more breaches for the same reason a hospital reports more diagnoses than a GP surgery with no equipment. It’s looking harder. Bigger companies run proper monitoring, employ people whose job is to watch for intrusions, and have enough systems that something eventually trips an alarm. A ten person manufacturer in Ellesmere Port with no dedicated IT monitoring can be sitting on a problem for months and have no way of knowing. Lower detection isn’t the same as lower risk. It’s often the opposite of visibility, not the opposite of danger.
The survey itself points to this, once you read past the headline numbers. It measures what businesses noticed and reported, not what actually happened to them. A business running logging, a managed firewall and someone checking alerts will spot things a business with none of that infrastructure simply can’t. The 23 point gap between large and micro businesses tracks fairly closely with the gap in who can afford to monitor properly, which is a different claim to the one the raw percentages seem to make.
Automated attacks don’t check your head count
Most cyber attacks aren’t a person deciding your business looks interesting. They’re software scanning the entire internet for one specific unpatched vulnerability, a particular version of a particular piece of software with a known flaw, and then working through whatever it finds. That software has no idea whether it’s hit a five person supplier in Chester or a national retailer. It just checks whether the door’s open.
In practice that means automated tools sweeping ranges of IP addresses for an exposed remote desktop port, an out of date VPN appliance or an unpatched web server, and phishing campaigns going out to thousands of inboxes in one send rather than being written for any one target. None of that costs an attacker more to point at a small business than a large one. The targeting happens at the scale of the internet, not the scale of the company.
This is the part most business owners get backwards. The old assumption was that criminals go where the money is, so a small business could reasonably expect to be left alone. Automation removed that logic. Scanning the whole internet costs almost nothing, so the criminal’s sorting happens after the fact, not before it. Size stopped being a filter years ago.
The supply chain angle, which matters more for manufacturers specifically
Larger companies have spent the last decade hardening their own networks. Attackers responded by going around them instead of through them, and a manufacturer or supplier with weaker defences sitting inside a bigger client’s supply chain is now a more useful route in than attacking that client directly. The National Cyber Security Centre has treated this pattern seriously enough to publish dedicated supply chain security guidance, and it’s worth knowing what that guidance actually tells your customers to do, because it shapes what they’ll start asking of you.
The guidance tells larger buyers to map their full supply chain rather than just their direct suppliers, to set minimum security requirements in contracts based on the risk each supplier carries, and to ask suppliers to report upward on an ongoing basis rather than taking security on trust until something goes wrong. It also pushes them towards independent assurance, things like Cyber Essentials Plus, audits or penetration tests, rather than accepting a supplier’s word for it.
For a manufacturing SME supplying parts, components or services to a larger business, this changes the calculation twice over. First, the question isn’t whether your business holds anything valuable on its own. It’s whether compromising your systems gets someone closer to a client who does. Second, it’s increasingly not your decision whether to prove your security, it’s a condition your customers are starting to set. A supplier who can produce Cyber Essentials Plus certification or a clean audit on request is in a different negotiating position to one who gets asked for the first time mid contract renewal and has nothing to show.
The distinction between the two Cyber Essentials tiers matters here. Standard Cyber Essentials is self assessed, you complete a questionnaire about your own systems and it gets checked, which makes it quick and inexpensive to put in place. Cyber Essentials Plus adds an external audit of what you’ve actually got running, not just what you’ve declared, which is why it carries more weight with a customer doing genuine due diligence on a supplier. If a larger client has started asking what you hold, Plus is usually what they mean, even when the request just says “Cyber Essentials.”
What this changes for day to day decisions
None of this is abstract once a customer actually asks. A manufacturer that’s never been asked for proof of its security can go a long time assuming the subject won’t come up, right until a procurement team sends a supplier security questionnaire with a deadline attached. Getting caught out at that point costs more than the certification itself, it costs the time pressure of doing properly in two weeks what should have been done over two months, and the risk of a client relationship souring over something that had nothing to do with the quality of the work.
What actually reduces the risk
None of this calls for a different scale of response just because the business is small. It calls for the same basics most of the advice in this area keeps repeating, applied consistently rather than occasionally.
Patch known vulnerabilities promptly rather than waiting for a convenient window, since that’s specifically what automated scanning is hunting for. Use multi factor authentication on anything reachable from outside the office, since that’s what stops a leaked password turning into a full breach rather than a minor inconvenience. Have someone actually looking at what your systems are doing, rather than assuming silence means nothing’s wrong, because the survey above suggests plenty of businesses are currently in that position without knowing it. And if you supply a larger business, find out what that relationship’s contract actually requires of you on security, and be able to show you’re meeting it, because that’s being checked rather than assumed more often than it used to be.
Frequently asked questions
Does this mean small businesses are now bigger targets than large companies?
Not in the sense of being singled out specifically. It means the old reason for assuming you’d be left alone, being too small to be worth the effort, no longer applies, because most attacks don’t involve anyone deciding you’re worth the effort in the first place.
What can a small business actually do differently?
Patch software promptly rather than waiting, since automated scanning specifically targets known, unpatched flaws. Monitor for problems rather than waiting to notice them the hard way. And if you supply a larger business, assume that relationship is part of what makes you worth targeting, not incidental to it.
Is this just a reason to sell cyber security services?
It’s a fair question to ask of anyone making this argument, us included. The Cyber Security Breaches Survey is a government statistic, not ours, and the detection gap between business sizes is in the report for anyone to read. What you do about it is a separate decision from whether the pattern is real.
What’s the quickest way to find out where we actually stand?
An outside look at what’s currently running, patched and accessible tends to surface more than an internal checklist does, mainly because it’s done by someone without the daily familiarity that makes a gap easy to stop noticing. That’s the gap a short audit is designed to close before a customer’s questionnaire does it for you.
127 Solutions runs a free 20 minute IT audit for businesses across Cheshire, Wirral, Chester and Liverpool who want a straight answer on where they actually stand, including manufacturers whose exposure often sits one supply chain link away from where they’d expect to look, and anyone who’s been asked by a customer to prove their security and isn’t sure what they could currently show right now, today, without a fortnight’s notice to prepare for it. Book yours here.