Company Directors Urged to Make Identifying Cyber Vulnerabilities an Urgent Priority
ESSEX, UK. September 14th, 2026 – UK company directors are being urged to take a closer look at cyber and physical security as criminals find new ways to exploit weaknesses in systems, people and premises.
The Government’s Cyber Security Breaches Survey 2025/26 found that 43% of participating UK businesses identified a cyber breach or attack in the previous 12 months — equal to around 612,000 businesses.
Yet only 41% of small businesses carried out a cyber-security risk assessment. 52% had a formal cyber-security policy, and only 44% had a business-continuity plan covering cyber risk.
Under the Companies Act 2006, company directors must exercise reasonable care, skill and diligence to manage risk (including cyber security).
A small UK power plant was recently shut down following a cyber-attack. While the Government said the UK’s energy system was never at risk, the Department for Energy Security and Net Zero contacted power companies to warn them about cyber-attack risks.
Steve Cross, Group Technical Director at PIB Insurance Brokers, said: “Over the last few years PIB have found that many organisations simply don’t know what ‘good’ looks like when it comes to fundamental cyber-security and controls.
“At the same time, small and medium-sized enterprises continue to emerge as the hidden victims of cyber-crime – often targeted by opportunistic hackers but ill-prepared to defend against or recover from attacks.”
Cyber criminals are becoming increasingly sophisticated and bold. Threat actors are leveraging more advanced tools and techniques to breach defences. Stolen data now fuels a whole criminal ecosystem, powering everything from online fraud to ransomware extortion. Organised criminal groups trade in stolen personal information and network access on the dark web.
Experts claim that emerging technologies, such as artificial intelligence (AI), will further accelerate cyber-crime and provide criminal networks with entirely new capabilities. For example, Generative AI is already being used as a tool, with criminals using AI-driven chatbots to craft highly convincing phishing lures and social engineering scams.
Mark McSweeney, Director of Security Operations at risk and security specialists R5 Global, said: “We provide intelligence-led physical penetration testing that assesses how security measures perform against real-world threats, not just compliance standards. By replicating attacker tactics, techniques and behaviours, we identify vulnerabilities before they can be exploited and give organisations practical recommendations to reduce risk.”
R5 Global’s work can include intelligence-led physical penetration testing and wider response testing. This reviews physical security, the immediate response of security personnel and how the wider business detects, escalates, communicates and coordinates during a realistic incident. The aim is to find gaps across the full response process before a real incident exposes them.
Cyber insurance, D&O insurance and commercial property policies cover different risks and include different terms and conditions. Companies must understand and comply with these requirements to ensure cover is available when needed.
Leading insurance agency Bespoke Risk Solutions is urging directors to check what their existing insurance actually covers.
Peter Collins, Director of Bespoke Risk Solutions, said: “On several occasions, we have carried out audits and found that directors had not read the small print in their policy wordings. In some cases, that left the company’s financial future at risk because there was no effective insurance protection.
“Insurance is important and should form part of every company’s disaster planning. If a major cyber incident, theft or security failure occurs, directors may need to explain what protections were reviewed, what vulnerabilities were identified and what action was taken. Using the excuse of “We assumed someone else had it covered” may be a difficult answer for shareholders to accept.
