Why 60% of UK SMEs Close After Cyber Attacks, And How to Avoid It

The frequently cited figure that 60% of SMEs close after a major cyber attack should be treated as a risk warning rather than a prediction. The underlying point is clear: many smaller organisations do not fail because of the breach alone. They fail because the financial and operational impact compounds faster than they can recover.

The cost profile is often wider than expected. Systems may need forensic investigation before they can be trusted again. Staff may be unable to work while revenue-generating processes are offline. Customers may need to be notified. Regulators may require evidence of reasonable controls. Insurers may ask for proof that minimum security obligations were met.

There is also the confidence impact. If clients believe their data, service continuity, or own supply chain has been put at risk, they may move work elsewhere. For SMEs that rely on a small number of high-value accounts, losing one major customer can be more damaging than the technical remediation bill.

The modern cyber threat model has moved beyond simple file encryption. In 2026, many ransomware groups use triple-extortion tactics: they encrypt systems, steal data, and pressure customers, suppliers, or executives to force payment.

SMEs are often targeted because attackers expect weaker identity controls, inconsistent patching, and unmanaged remote access. A compromised mailbox, stolen VPN credential, or unpatched server can become the entry point for a wider incident.

Remote and hybrid work have also expanded the attack surface. Personal networks, unmanaged devices, cloud applications, and shadow IT can create blind spots. Without centralised visibility and consistent policy enforcement, it becomes difficult to detect abnormal behaviour before business-critical systems are affected.

Traditional perimeter security assumes that anything inside the network can be trusted. That model no longer reflects how SMEs operate. Users, devices, applications, and data now sit across offices, homes, cloud platforms, and third-party services.

Zero Trust Architecture changes the assumption. Access is continuously verified based on identity, device health, location, behaviour, and business need. Users receive only the privileges required for their role, and sensitive systems are segmented to reduce the blast radius of a compromise.

AI-driven Managed Detection and Response adds the operational layer. Rather than relying on basic alerts, MDR correlates signals across endpoints, identities, networks, and cloud services. Suspicious activity can be triaged, escalated, and isolated before it becomes a full-scale outage.

For SMEs without an internal security operations centre, this is where a managed service model becomes critical. Contrac can act as an agile extension of the internal IT team, providing the monitoring, escalation, and response capability needed to reduce risk around the clock.

Backups are essential, but ordinary backups are no longer enough. Attackers actively search for backup repositories and attempt to delete, encrypt, or corrupt them before launching ransomware. If the backup is compromised, recovery options narrow dramatically.

Immutable backups are designed so that protected data cannot be altered or deleted for a defined retention period. This gives the business a trusted recovery point even if production systems are compromised.

However, resilience is not just about having a backup. It is about knowing how quickly systems can be restored and how much data the business can afford to lose. That is where Recovery Time Objective and Recovery Point Objective become board-level metrics.

If your RTO is 24 hours but cash collection, fulfilment, or client support stops after two, the SLA is not protecting the business.

RTO defines the maximum acceptable time to restore a service. RPO defines the maximum acceptable data loss measured in time. A practical cyber resilience plan maps these targets to specific systems, such as finance, CRM, ERP, file storage, communications, and customer portals.

For many SMEs, cyber security is no longer only an internal risk issue. It is a condition of doing business with larger customers. Enterprise clients increasingly ask suppliers to demonstrate security maturity before awarding or renewing contracts.

Cyber Essentials Plus provides externally validated assurance that core technical controls are in place. It is especially important for organisations that handle sensitive data, bid for public sector work, or operate as part of a larger supply chain.

The EU's NIS2 directive also raises expectations around cyber risk management and supplier assurance. Even where a UK SME is not directly regulated by NIS2, it may feel the commercial impact if customers or partners require stronger evidence of operational resilience.

This means SMEs need more than policy documents. They need auditable controls, documented incident response procedures, asset visibility, access governance, vulnerability management, and evidence that critical systems are protected and tested.

During a cyber incident, confusion increases cost. If responsibilities are unclear, decisions are delayed. If communication is inconsistent, customers and staff lose confidence. If recovery steps are untested, technical teams may restore systems in the wrong order.

ITIL 4 provides a structured approach to incident management, major incident handling, change enablement, problem management, and continual improvement. Applied to cyber resilience, it helps define how incidents are logged, prioritised, escalated, communicated, resolved, and reviewed.

A strong response plan should identify who has decision authority, which systems must be restored first, how evidence is preserved, when legal or regulatory advice is required, and how communications are managed. It should also include regular testing so the plan is proven before a real incident occurs.

Post-incident review is equally important. The objective is not only to restore service. It is to identify root causes, improve controls, update runbooks, and reduce the probability or impact of recurrence.

Contrac's approach follows a practical Consult, Transform, Support model for SME cyber resilience and business continuity.

Consult: We assess your current exposure, review identity and access controls, evaluate backup integrity, map critical business services, and identify gaps against frameworks such as Cyber Essentials Plus, ITIL 4, and supply chain assurance requirements.

Transform: We help implement the controls that reduce the likelihood and impact of attack. This can include Zero Trust principles, endpoint protection, MFA, conditional access, vulnerability remediation, immutable backups, cloud security hardening, and defined RTO/RPO targets.

Support: We provide ongoing managed IT support, monitoring, incident escalation, backup checks, service reviews, and continual improvement so resilience remains aligned with business change.

For SMEs, the objective is not to build enterprise complexity for its own sake. It is to apply the right enterprise disciplines in a practical, cost-controlled way so the business can withstand disruption and keep serving customers.