BT warns UK SMEs are primary targets for hackers as only three in five have had cyber security training

• Following a spate of attacks on UK businesses, BT is warning SMEs they are a big target as new research reveals two million have had no cyber security training. 
• Four in ten (42%) small businesses have been victims of an attack or breach in the last 12 months, rising to two-thirds (67%) of medium-sized companies.
• The average cost of the most disruptive cyber breach for small or micro businesses is £7,960 and can take months to recover from.
• Ransomware incidents on businesses have doubled in the space of a year, while QR code (or ‘quishing’) scams have surged by 1,400% in the past five years.
• To tackle the threat, BT has developed a new cyber security training regime specifically for SMEs, and teamed up with Be the Business to guide SMEs on the next generation of threats.

A study by BT in partnership with Be the Business reveals that two in five (39%) SMEs, equivalent to two million businesses, have not arranged cyber security training for their teams¹ – despite four in ten (42%) small businesses having experienced a cyber attack in the last 12 months, increasing to two in three (67%) for medium-sized companies². 

The impact can be severe too, costing companies considerable time and money to recover from an attack. Micro and small businesses have to pay £7,960 on average to cope with their most disruptive breach when it resulted in damage, according to the latest Government survey.

The most common attack SMEs face is phishing, with email scams targeting 85% of UK businesses. Damaging ransomware incidents, meanwhile, have more than doubled in the last 12 months, rising from affecting less than 1 in 200 businesses last year to 1 in 100 in 2025. A separate report by BT has revealed large businesses which are more proactive with their cyber security are more likely to grow that those who aren’t. It showed that these “cyber agile” companies have a 20% higher growth rate on average³.

In response, BT is bolstering its suite of security products with the launch of dedicated security training, to help SMEs understand the practical steps they can take to protect themselves against cyber attacks and potential breaches. The training, unveiled today at an event for SMEs featuring cyber security experts from BT, educates small businesses about next-generation threats, including the role of AI and quantum computing. It also highlights the rise of attacks, including account takeovers, where stolen customer credentials are used to breach systems, as well as QR code scams – or “quishing” attacks – which have surged by 1,400% in the past five years.

Tris Morgan, Managing Director for Security at BT, comments: “At BT, our mission is to enable UK businesses to grow and prosper, and we know the challenges SMEs face protecting themselves from growing cyber threats. These often include budget constraints and the lack of a dedicated cyber team, but for SMEs a cyber attack isn’t just an inconvenience; it poses an existential threat.

The good news is that effective cyber security doesn’t require corporate-grade resources. With the right training, basic security measures, and awareness, SMEs can dramatically reduce their risk profile. The key is recognising that, in today’s digital landscape, cyber security is not a luxury but a foundation that enables companies to face forwards confidently, rather than forever looking over their shoulder.”

Further research findings: 

• 18% of UK SMEs say their biggest cyber concern is the threats posed by AI. Seven in ten business leaders (69%), however, are considering using AI tools to protect themselves.
• About half (46%) of business leaders turn to industry experts for cyber security advice, more than any other source.

¹ Insights from the Be the Business Cyber Security report May 2025 (including a survey of 1,000 SMEs, excluding sole traders)
² Insights from the Government Cybersecurity Breaches Survey 2025
³ Insights from the BT Cyber Agile organisation report January 2025

BT Group is the UK’s leading provider of fixed and mobile telecommunications and related secure digital products, solutions and services. We also provide managed telecommunications, security and network & IT infrastructure services to customers across 180 countries.

BT Group consists of three customer-facing units: Consumer serves individuals and families in the UK; Business covers companies and public services in the UK and internationally; Openreach is an independently governed, wholly owned subsidiary wholesaling fixed access infrastructure services to its customers - over 700 communications providers across the UK.

British Telecommunications plc is a wholly owned subsidiary of BT Group plc and encompasses virtually all businesses and assets of the BT Group. BT Group plc is listed on the London Stock Exchange.

For more information, visit www.bt.com/about