September 16, 2026 | In the News

Average ‌Annual ‌Spending ‌to Defend Against Cyberattacks Balloons as Businesses Invest in Readiness

Cyberattacks have become such a frequent economic occurrence that organizations are having to spend serious money. Now, leaders want to both be ready enough to defend against hackers and prepared to pay for fallout from the aftermath of such attacks when they do happen.

The Times recently looked into this ongoing threat and resulting corporate liability using new data from the Hiscox Cyber Readiness Report, a joint effort with Wakefield Research for which 6,800 cybersecurity decision makers and subject matter experts at businesses with fewer than 250 employees in 10 different global markets were surveyed.

The coverage by The Times highlights the glaring differences in digital vulnerability between regions, particularly noting that small businesses in the U.K. are the most vulnerable in the world, paying on average nearly $36,000 each due to successful cyberattacks over the past year. That type of risk has led to an increase in readiness plans, a development that has cyber experts cheering.

“Cyber-risk has become a recurring cost, not an exceptional event, so the investment we’re seeing in cyber-resilience is good news,” Eddie Lamb, Global Head of Cyber at Hiscox, told The Times while summarizing this new reality.

The wider Hiscox data highlights some of the secondary impacts and resulting strategic shifts that businesses must make to operate in this new reality:

Reputational Damage. The cost of cyberattacks goes far beyond the immediate response and cleanup: 48% of businesses that have suffered an attack report reputational damage or a catastrophic erosion of customer trust as a result.

Financial/Credit Impact: The reputational damage directly impacts the bottom line, with 34% of affected businesses reporting a negative impact on their financial results, corporate valuation, or credit rating because of an attack.

Accountability in the Boardroom: Cybersecurity is no longer just an IT issue. Demonstrating the resulting shift in corporate focus, 36% of affected businesses directly tie executive compensation and performance metrics to cybersecurity objectives.

“Partnering with Hiscox on the Cyber Readiness Report means giving businesses a clear, data-driven picture of a threat that has become a permanent part of doing business,” says Nathan Richter, Senior Partner at Wakefield Research. “Coverage like The Times’ shows how much this research matters, and we’re proud to work alongside Hiscox to help leaders understand the risk and invest with confidence.”