Cyber Security Is a People Problem First

38% of UK businesses experienced a phishing attack in the past year. It is still the most common type of attack and the one businesses most often describe as the most disruptive.

For Cyber Security Awareness Month, we look at what the latest UK government data says about where the gaps actually sit. The short answer: not only in technology, but in people, skills and ownership.

The most common attack is still the simplest

Phishing remains the most prevalent type of cyber breach or attack by a wide margin. According to the UK government’s Cyber Security Breaches Survey 2025/2026, among businesses that experienced any breach or attack, 69% said phishing was the most disruptive.

It is also becoming a larger share of the overall picture. Of the businesses that experienced a breach or attack, 51% faced phishing alone, up from 45% the year before. Interviewees in the same research said they believed phishing had become easier for attackers to carry out.

None of this means advanced threats can be ignored. It does mean that for most organisations, the front line is an inbox, a login screen and the judgement of the person in front of it.

Ownership is moving up the organisation

There is good news at the top table. 31% of UK businesses now have a board member responsible for cyber security, up from 27% the previous year. That reverses a downward trend seen earlier in the decade.

Board ownership matters because cyber security decisions are rarely purely technical. Which risks are acceptable? Where does budget go? How quickly should a new AI tool be rolled out, and with what controls? These are business decisions, and they need someone at the top asking the right questions.

Reporting is another area with room to improve. Among businesses that identified a breach or attack, 40% reported their most disruptive incident to someone outside their organisation. That limits what the wider business community can learn from each incident.

The skills gap is widening

Demand for cyber skills keeps growing. The government’s Cyber Security Skills in the UK Labour Market 2026 report, published in September, recorded a 7% increase in core cyber security job postings compared with 2024.

At the same time, 57% of UK businesses now have a basic technical cyber security skills gap, up from 49% the year before. Put simply, more organisations lack confidence in carrying out fundamental tasks such as detecting and removing malware, setting up firewalls or controlling who has admin rights.

That combination is worth noting. Demand for specialists is rising while a growing number of organisations struggle with the basics. Specialist hiring alone won’t close both gaps.

AI is now part of the cyber conversation

AI is changing how cyber security teams work. The same skills report found that 70% of cyber security businesses say their staff use AI in their day-to-day work, up from 53% the year before.

That brings opportunity and new responsibility. AI can help teams analyse threats, review logs and respond faster. It also introduces new tools, data flows and access points that need governing. As AI moves from experiment to everyday dependency, security has to be built into how it is adopted, not added afterwards. (We explored this further in Your Business Is Becoming Reliant on AI. Is Your Organisation Ready?)

That is why the profiles in demand increasingly sit across disciplines: security alongside cloud, data and AI, rather than in a single lane.

What resilient organisations are doing differently

Cyber resilience isn’t a single project or product. Based on what the data shows, a few practical priorities stand out.

• Know what attackers can already see, then close the basic gaps. Many organisations have a clearer view of their internal systems than of their internet-facing footprint. Understanding that external exposure, alongside getting the fundamentals right (access controls, updates, secure configuration and malware protection), is a practical place to start.
• Treat people as part of the security estate. If phishing is the most common and most disruptive attack, awareness, training and simple reporting routes for staff are some of the most valuable controls an organisation has.
• Give cyber security a clear owner at board level. Someone senior should be accountable for cyber risk and able to weigh it against other business priorities.
• Build security into transformation work. Cloud migrations, data platforms, AI rollouts and post-acquisition integration all change an organisation’s attack surface. Security should be part of the plan from the start.
• Resource for the shape of the problem. Whether the need is a specific capability, a defined programme or a point-in-time review, the right model makes a difference to how quickly gaps close.

A people problem with a people solution

Cyber Security Awareness Month is a useful reminder that the most common attacks still target people. The good news is that the answer often starts with people too: the right skills in the right roles, clear ownership at the top and security built into how the organisation changes and grows.

At Synnovate, we work with organisations across Cyber Security, AI, Data, Cloud, M&A and Digital Transformation to provide the specialist talent, delivery teams and project expertise needed to strengthen resilience.

See what attackers can see.

Request a free external exposure analysis scan and find out what your organisation’s internet-facing footprint reveals. Send us a message here.