Almost half of the UK's small businesses experienced a cyber security breach or attack in the past year, yet many lack the specialist expertise and practical support needed to protect themselves, a new report warns.
The report, Beyond Policy to Place: Building the Delivery Infrastructure for Cyber Resilient Growth, calls for a more coordinated national approach to helping businesses translate government cyber security guidance into practical action.
Its publication follows the latest Government Cyber Security Breaches Survey, which found that 46% of small businesses and 65% of medium-sized businesses had identified a cyber breach or attack in the previous 12 months.
Despite the risks, just 41% of small businesses reported carrying out a cyber security risk assessment, fewer than last year, highlighting the challenge of turning awareness into action.
Published by De Montfort University Leicester (DMU) Associate Professor, East Midlands Cyber Security Cluster (EMCSC) founder and director Dr Ismini Vasileiou in conjunction with the Research Institute for Sociotechnical Cyber Security (RISCS), the report identifies a "missing middle" between national cyber security policy and its implementation by businesses.
The report argues that while the UK has extensive cyber security strategies, guidance and expertise, smaller businesses can struggle to understand what is relevant to them, decide what to prioritise and put appropriate measures in place.
This is particularly challenging for SMEs, where responsibility for digital security may fall to a managing director, finance lead or general IT provider rather than a cyber security specialist.
Dr Vasileiou said: “Cyber resilience is an essential business capability. It supports secure AI adoption, stronger supply chains and sustainable economic growth.
“Our aim is to start a focused conversation about delivery and build a clearer, trusted route from national policy to the SMEs, sectors and regions it is intended to support.”
The report draws on a strategic roundtable convened by EMCSC and De Montfort University at the UK Global R&D and Science Investment Summit, held at the Royal Society during London Tech Week in June this year.
The invitation-only discussion brought together representatives from government, industry, higher education, professional bodies and regional organisations to explore how national cyber, digital and industrial strategies could be translated into practical support for businesses.
Among its recommendations is the creation of a stronger link between national policy and businesses, providing plain-English guidance, sector-specific examples, practical tools and trusted routes to professional support.
It suggests regional cyber clusters, universities, professional bodies and business networks could play a greater role in helping organisations move from awareness to implementation.
The report also argues that cyber resilience should be recognised as an essential part of economic growth, enabling businesses to adopt new technologies, strengthen supply chains and maintain operations when disruption occurs.
Rather than creating expensive new initiatives, it recommends better coordination of existing expertise, reducing duplication and strengthening regional and sector-based support.
Professor Genevieve Liveley, RISCS Director, said: “RISCS is delighted to see the publication of this report by RISCS Honorary Fellow, Dr Vasileiou, highlighting the 'missing middle' between policy and action, and culminating in robust recommendations and a pathway to delivery that recognises collective cyber resilience.”
Posted on Tuesday 20 October 2026