THE Hiscox Cyber Readiness Report 2026 found that 29% of organisations worldwide experienced at least one successful cyber-attack in the 12 months covered by the study. Affected organisations reported an average of four incidents, with attacks costing about $52,000 on average and causing 32.8 hours of downtime. UK firms were most likely to report an incident, at 38%, compared with 20% of organisations in the US. Italy recorded the highest average incident cost, at $134,138.
The survey found wider consequences for victims: 32% reported delays to growth or new business initiatives, 31% faced higher staffing or external expertise costs, and 30% saw effects on financial performance, valuation or credit ratings. Nearly seven in 10 victims reported employee burnout, high stress or a toxic workplace culture after an attack. The report, published on 15 September 2026, surveyed 6,800 security decision-makers across the UK, Europe and the US.
Organisations said they were spending an average of about $51,000 a year on cyber resilience, including employee training, additional security staff and new tools. Some were also strengthening controls around artificial intelligence, through staff training, AI audits and reviews of cyber insurance coverage.