97% of UK FS firms surveyed faced cyber incidents in the past year, but up to £456m of losses weren’t potentially covered by cyber insurance
ESET, a global leader in cybersecurity, today released a reportfinding that cyber incidents cost UK small-to-large sized FS firms surveyed an average of £726k in the past 12 months, this could mean up to an estimated £1.01 Billion[i] in losses for the FS industry.
The 2026 ESET UK Financial Services Security Report surveyed 500 UK small-to-large sized FS firms, finding that the vast majority of FS organisations experienced at least one cyber incident in the past year:
- 97%[ii] have been hit by cyberattacks in the past year, with 62% facing multiple attacks
- Of the FS firms surveyed who experienced a cyber incident in the past 12 months, it took 7 days on average to recover critical business operations after a security incident
- Just 11% of consumers would continue to use their FS provider as normal after a major breach exposed customer data
- Nearly six-in-ten (58%xi) say it’s possible that their organisation could have been breached, and it’s not been discovered yet
“With almost every FS firm experiencing recent security incidents and financial losses, we’re well past warning signs,” warns Steve Round, Co-Founder and President at SaaScada, a global fintech headquartered in the UK. “Despite relatively strong cyber maturity, organisations urgently need to move beyond the basics. If not, they will continue to face serious financial losses, customer churn, and damaged reputations.”
Insurance softens the blow, but leaves FS firms paying out
While the FS industry has seen widespread cyber insurance adoption, on average, firms could be paying out for 44%iv of the cost of cyber incidents:
- 99%[iii] of FS firms surveyed have a cyber insurance policy in place, with 41% taking out a policy in the past 12 months
- However, on average, 44%[iv] of the cost of a cyber incident was not recovered through cyber insurance for UK FS organisations surveyed
- This potentially could have left the FS industry to absorb up to £456 million[v] of annual cybersecurity losses** in the past year
Security basics aren’t enough in the AI era
While FS firms have nailed the essentials, there are still advanced security gaps which are increasingly letting threat actors into systems, especially with the rise of AI-powered threats:
- The biggest cybersecurity challenges FS firms surveyed face are talent shortages (38%), delivering 24/7/365 security operations (33%), and securing legacy technology (32%)
- 65%[vi] don’t have a 24/7/365 managed detection and response service (outsourced to a vendor, insurer, MSP, or MSSP)
- 57%[vii] say they don’t have comprehensive incident response plans in place
- 60%[viii] say they don’t have comprehensive endpoint security
These potential security gaps stand out as the spectre of AI-powered threats and security gaps in AI tools looms. Financial Services firms’ top priority for the next 12 months is securing AI adoption (46%), while 86%[ix] have increased investment in cybersecurity due to AI. However, 62%[x] of FS firms do not have an up-to-date AI security policy.
“The British FS industry must continue adapting to keep pace with cybercriminals,” argues Matt Knell, UK Country Manager at ESET. “That means bolstering their cyber resilience, delivering always-on protection that can keep up with increasingly dangerous cyber threat actors, and taking steps to protect against a rising AI attack surface and AI-powered threats.”
You can read the full report here.
About ESET®
ESET protects organisations, critical infrastructure, and individuals, helping them build digital resilience and confidence in an increasingly AI-driven world. With more than 35 years of cybersecurity expertise, over 25 years of AI innovation, and 11 global R&D centres, ESET develops proprietary technologies designed to protect against evolving cyber threats and secure the broader AI ecosystem. Grounded in scientific rigor and taking a preemptive approach to security, ESET delivers effortless protection that remains under expert human oversight. Headquartered in the European Union and privately owned, ESET protects millions of users and more than 500,000 organisations across 178 countries. Committed to responsible AI and customer trust, ESET protects the progress that technology enables.
For more information, visit www.eset.com
This research was commissioned by ESET.
The Financial Services research was carried out by independent research firm Opinion Matters in between 25.09.2026 – 05.10.2026, surveying 500 Senior decision-makers responsible for cybersecurity in Financial Services organisations in the UK employing 50+ people and with an annual revenue of between £500k and £500m, ensuring at least 100 respondents were drawn from each of the following company size bands: Small: £500k to £10m, Medium: £11m to £100m, Large: £101m to £500m (aged 25+). Opinion Matters abides by and employs members of the Market Research Society and follows the MRS code of conduct and ESOMAR principles. Opinion Matters is also a member of the British Polling Council.
The consumer research was carried out by independent research firm Opinium in September 2026, surveying 2,000 UK consumers.
