UK SMBs ramp up cybersecurity budgets as AI threats rise

UK small and medium-sized businesses (SMBs) are facing a growing wave of cybersecurity threats, with nearly half reporting incidents in the past year. A new report highlights AI-powered malware as a top concern, while budget increases signal a push to bolster defenses—though gaps in basic security practices remain.

Rising Threats and Vulnerabilities

A report highlighted by TechRadar found that 49% of UK small and medium-sized businesses (SMBs) experienced at least one cybersecurity incident in the past year. Of those affected, 13% reported multiple incidents, indicating persistent vulnerabilities.

The report, authored by cybersecurity firm ESET, identifies AI-powered malware as the top concern for SMBs. This reflects a broader shift in the threat landscape, where attackers are increasingly leveraging AI to enhance the sophistication and scale of their campaigns.

Budget Increases and Investment Priorities

The most common causes of cyberattacks on SMBs remain familiar but preventable: phishing, unpatched software vulnerabilities, weak passwords, and a lack of continuous monitoring. These gaps suggest that many businesses are still struggling with basic security hygiene, even as threats evolve.

Despite these challenges, SMBs are not standing still. According to the report, 55% of UK SMBs plan to increase their cybersecurity budgets over the next 12 months. The primary investment priorities include employee training and awareness programs, as well as cloud security—areas that directly address both human and technical vulnerabilities.

Why This Matters for the Broader Economy

SMBs play a critical role in the UK economy, contributing over £2.8 trillion to private sector turnover. Their security is not just a business issue but a national one, given the potential for widespread economic disruption from large-scale cyberattacks.

Context: The Changing Threat Landscape

Cybersecurity threats are evolving rapidly, with AI-driven attacks becoming more accessible to cybercriminals. This shift has forced businesses of all sizes to rethink their defenses, as traditional security measures may no longer suffice.

For SMBs, the challenge is compounded by limited resources and expertise. Many lack dedicated security teams, making them attractive targets for attackers who exploit gaps in basic protections like patch management and employee awareness.

What this means

LazyFounders analysis — our interpretation, not reported fact.

For founders and operators, this report underscores the growing cybersecurity risks facing SMBs—especially as AI-powered threats become more prevalent. The fact that nearly half of UK SMBs experienced an incident in the past year is a wake-up call: cybersecurity is no longer optional, even for smaller businesses.

The planned budget increases reflect a recognition that traditional defenses are no longer sufficient. However, throwing money at the problem without a clear strategy—such as prioritizing employee training and cloud security—won’t guarantee safety. Founders should assess their own vulnerability management practices, particularly around patching and monitoring, and consider whether their current tools can handle AI-assisted attacks.

This trend also highlights an opportunity for startups building security solutions tailored to SMBs, who often lack the resources of larger enterprises but face similar threats.

Key takeaways

• Nearly half of UK SMBs experienced a cybersecurity incident in the past year, with 13% facing multiple incidents.
• AI-powered malware is the top security concern for SMBs, reflecting broader industry trends.
• Phishing, unpatched vulnerabilities, and weak passwords remain the most common attack vectors.
• Over half of UK SMBs plan to increase cybersecurity budgets, focusing on employee training and cloud security.
• SMBs contribute over £2.8 trillion to the UK private sector, making their security a critical economic issue.

FAQ

Why are SMBs particularly vulnerable to cyberattacks?

SMBs often lack dedicated security teams, robust monitoring, and resources to address vulnerabilities like unpatched software or weak passwords. This makes them attractive targets for cybercriminals exploiting basic gaps in defenses.

How can SMBs improve their cybersecurity without large budgets?

Prioritizing employee training, enforcing strong password policies, and ensuring software is regularly updated can significantly reduce risks. Cloud security tools and automated monitoring can also help without requiring large upfront investments.

What makes AI-powered malware a significant threat?

AI-powered malware can adapt to defenses, evade detection, and scale attacks more efficiently than traditional methods. This increases the likelihood of successful breaches, especially against under-resourced SMBs.

Related on LazyFounders

• How to Self-Host Apps with Docker: A Guide for Founders
• Why Purpose-Built AI is the Future of Fraud Prevention
• More technology news