Marvin OnumonuCyberhackers cost small and medium-sized enterprises (SMEs) £3.4bn annually due to inadequate cybersecurity, research from Vodafone Business has found.
The report, ‘Securing Success: The Role of Cybersecurity in SME Growth’, revealed that individual cyber-attacks cost small businesses £3,398 on average, increasing to £5,001 for firms with 50 or more employees.
The study indicated that 35% of SMEs experienced a cyber incident in 2024.
Among them, 28% suffered between one and five attempted attacks while 6% faced up to 10 incidents in a year.
Vodafone Business also discovered that over half of UK SME employees received no cybersecurity training, and nearly a third of SMEs lacked any cybersecurity protections.
Around 38% invested less than £100 annually in cybersecurity.
Furthermore, 64% of SMEs had staff working remotely regularly, with 60% allowing personal IT equipment use, leading to 19% of remote workers being targeted by cybercriminals.
As a result, 15% of SME employees were banned from working from home.
Nick Gliddon, CEO of Vodafone Business UK, said: “SMEs are the backbone of our economy, yet they are losing a staggering £3.4 billion annually due to inadequate cybersecurity.
“In today’s rapidly evolving digital landscape, cyber threats are becoming more sophisticated, and SMEs are increasingly in the crosshairs of cybercriminals.
“Investing in robust cybersecurity is no longer optional – it is a business imperative for protecting sensitive data, maintaining customer trust, and ensuring long-term resilience.”
Gliddon added: “At Vodafone Business, we understand the critical role SMEs play in driving innovation and growth, and we are committed to equipping them with the right tools and expertise to stay protected.
“However, SMEs cannot tackle this challenge alone. Greater collaboration between businesses, industry leaders, and government authorities is essential to providing these businesses with the resources, education, and support they need to strengthen their cyber defences.
“By working together, we can create a safer, more secure digital environment that empowers SMEs to grow with confidence in an increasingly connected world.”
Matthew Evans, chief operating officer at techUK, said: “Accounting for 99.8% of the UK’s business population and employing two-thirds of the workforce, it’s indisputable that SMEs are the cornerstone of our economy.
“We also know that their digitisation is a key lever for growth and, in order to seize the opportunities that technology offers and unlock productivity, SMEs must take cyber security and resilience seriously.”
Evans added: “Vodafone UK’s report highlights the significant impacts that cyber-attacks are having on the UK’s SMEs, including an estimated £3.4 billion per year in lost revenue and 28% of SMEs saying that a single attack could put them out of business.
“This demonstrates that there is still much to do to build resilience and raise awareness about cyber security as a critical business and growth enabler.
“techUK has called for government’s Industrial Strategy to have a greater focus on raising technology adoption across the UK’s SMEs to increase productivity and to recognise cyber resilience as integral to growth.”
He said: “The findings and recommendations of this report only further underscore the need to give SMEs the attention they deserve, and to support them in implementing robust plans to build and increase their cyber resilience.”
Ibrahim Dogus, co-chair of SME4Labour, said: “We at SME4Labour recognise that SMEs are the lifeblood of the UK economy, generating 25% of GDP and employing over 60% of the UK workforce.
“Integral to the government’s drive for economic growth, this Vodafone UK report demonstrates the importance of SME cybersecurity, and resilience more generally, to be seen as a part of business-critical decision making.
“This report highlights how we need to make sure we protect our growing businesses here in the UK, which in turn will protect the livelihoods of working people.”
Dogus added: “We at SME4Labour call on the government – who have already made productive steps on supporting SMEs – to support the recommendations of this report.”
