The cost of a data breach in the UK reached an average of £3.13 million in 2026. While that figure has fallen slightly compared with last year, the latest IBM Cost of a Data Breach Report 2026: United Kingdom Edition makes one thing clear: cyber incidents continue to carry significant financial, operational and reputational consequences.
The report, based on breaches experienced by 48 UK organisations between March 2025 and February 2026, provides a detailed snapshot of today’s UK cyber security landscape. It explores the financial impact of breaches, how organisations are responding to emerging threats, and the growing influence of artificial intelligence on both attackers and defenders.
For UK CISOs, IT leaders and risk professionals, the findings reinforce several long-term trends while highlighting new challenges around AI, machine identities and supply chain security.
The cost of a data breach in the UK remains stubbornly high
The average UK data breach cost reached £3.13 million in 2026, with an average of 29,870 records compromised and a cost of £123 per record.
Although this represents a modest reduction compared with the previous year’s UK figure, it should not be interpreted as a sign that cyber risk is decreasing. A breach costing more than £3 million remains a major financial event for most organisations, particularly when indirect costs such as operational disruption, reputational damage and regulatory obligations are considered.
The report also highlights significant variation between sectors. Financial services recorded the highest average breach cost at £5.46 million, followed by the services sector at £4.23 million and energy at £4.03 million. These industries continue to face heightened regulatory scrutiny, manage highly sensitive information and operate complex technology environments, all of which contribute to higher recovery costs.
AI has become part of the cyber security landscape
Artificial intelligence is one of the defining themes of this year’s report.
IBM found that 22% of malicious breaches were confirmed as AI-generated, while a further 13% could not determine whether AI had been involved. Although this does not mean AI is responsible for most attacks, it demonstrates that AI-assisted attack techniques are now sufficiently common to be measured within a national study.
This reflects the changing nature of cyber threats. AI can help attackers generate convincing phishing emails, automate reconnaissance, accelerate vulnerability discovery and improve social engineering techniques.
However, the report also shows that AI is becoming equally important on the defensive side.
Security teams are increasingly using security AI and automation to identify suspicious activity, prioritise alerts, investigate incidents and accelerate response. Rather than replacing security professionals, AI is becoming an operational tool that helps organisations respond more quickly to an increasing volume of threats.
Security AI and automation is associated with lower breach costs
One of the strongest findings in the report concerns organisations that have extensively deployed security AI and automation.
These organisations reported average breach costs of £2.26 million, compared with £3.85 million for organisations with no security AI and automation in place.
They also detected and contained breaches considerably faster.
This is worth reading as an association rather than proof that AI directly causes lower breach costs, correlation in a study like this doesn’t establish cause and effect. Even so, the gap is large enough that organisations evaluating future security investment should pay close attention.
As cyber attacks become faster and more sophisticated, technologies that reduce manual effort and improve detection speed are becoming increasingly valuable.
Speed remains one of the biggest cost factors
The report continues to demonstrate a strong relationship between breach lifecycle and financial impact.
The average UK organisation required:
- 165 days to identify a breach
- 60 days to contain it
- 225 days from compromise to full containment
Every additional day gives attackers more opportunity to move through systems, access information and increase business disruption.
The financial impact is substantial.
Breaches taking longer than 200 days to identify and contain cost £3.67 million on average, compared with £2.58 million for those resolved more quickly.
That £1.09 million difference reinforces the importance of continuous monitoring, effective incident response planning and the ability to investigate suspicious activity quickly.
Technology alone is not enough. Organisations also need clearly defined response processes, tested playbooks and skilled people capable of making informed decisions under pressure.
Phishing continues to deliver results for attackers
Despite years of investment in awareness training and email security, phishing remains one of the most expensive attack vectors identified in the report.
IBM found that phishing (including voice and SMS phishing) resulted in an average breach cost of £3.64 million.
Drive-by compromise and attacks exploiting external remote services also ranked among the most costly initial attack methods.
These findings demonstrate that identity remains central to modern cyber attacks. Rather than attempting to bypass sophisticated perimeter defences, attackers increasingly focus on compromising legitimate user accounts through deception, credential theft and social engineering.
Reducing this risk requires more than awareness training alone. Strong authentication, identity governance, privileged access management and continuous monitoring all have an important role to play.
Supply chain risk continues to grow
Few organisations operate entirely within their own environments.
Cloud platforms, outsourced providers, software suppliers and business partners all form part of today’s digital ecosystem. While these relationships deliver clear business benefits, they also increase organisational exposure.
According to IBM, supply chain compromise increased breach costs by an average of £241,620, making it the largest cost-increasing factor identified in the UK report.
Breaches involving IoT and operational technology environments also resulted in significantly higher costs.
These findings reinforce the importance of understanding third-party risk, reviewing supplier security controls and maintaining visibility across connected environments.
Machine identities deserve the same attention as human users
As organisations adopt more AI systems, automation platforms and cloud-native applications, the number of non-human identities continues to increase rapidly.
Service accounts, API keys, machine identities and automated processes often require privileged access to critical systems.
IBM found organisations are responding by implementing controls such as:
- Machine identity inventory and lifecycle management
- Behavioural monitoring
- Role-based access controls
- Secrets management
- Zero trust architectures
For many organisations, governance of non-human identities is becoming just as important as managing employee accounts.
Nearly half of UK organisations are already using AI agents
The report also highlights growing adoption of agentic AI within Security Operations Centres.
Among organisations operating a Security Operations Centre (SOC), 49% reported they have already deployed AI agents within it.
This reflects a broader industry shift towards augmenting security analysts rather than replacing them. AI agents can support repetitive tasks such as triaging alerts, gathering contextual information and assisting investigations, allowing experienced analysts to focus on higher-value activities.
As skills shortages continue across the cyber security industry, these technologies are likely to become increasingly common.
Encryption gaps remain surprisingly common
One finding that stands out is the continued inconsistency in encryption deployment.
IBM reports that 55% of breached organisations did not have encryption deployed across sensitive data at rest and in transit at the time of the breach.
Only 38% confirmed encryption had been implemented, while 7% were unsure.
Given the maturity of encryption technologies, this represents an opportunity for many organisations to strengthen foundational data protection controls.
Where organisations plan to invest
Following a breach, organisations reported several areas where they intend to increase investment.
The highest priorities were:
- Incident response plans and testing (57%)
- Data loss prevention (51%)
- Quantum security for data and data transfer (45%)
Interestingly, employee training ranked significantly lower at 16%, despite phishing remaining one of the costliest attack vectors identified in the report.
This suggests organisations are placing increasing emphasis on technology and operational resilience alongside traditional awareness programmes.
What should UK organisations do next?
The report highlights several practical priorities for organisations reviewing their cyber security strategy.
Reducing breach detection and containment times should remain a key objective. Faster investigation and response are consistently associated with lower breach costs.
Identity security also deserves continued investment. Phishing remains highly effective, while machine identities are becoming increasingly important as organisations adopt more AI-enabled systems.
Encryption should be reviewed to ensure sensitive information is adequately protected, particularly across hybrid and cloud environments.
Finally, organisations should consider where security AI and automation can improve operational efficiency and strengthen incident response capabilities.
Northdoor’s take
The following is Northdoor’s own commentary, not a finding from the IBM report.
“What stands out in this year’s report is how much time still costs. A UK breach that takes over 200 days to contain costs £1.09 million more than one resolved faster, and that gap is entirely within an organisation’s control. Security AI and automation isn’t a nice to have anymore, it’s what’s buying UK businesses that time back.”
AJ Thompson, Chief Commercial Officer, Northdoor plc
Download the full UK report
The IBM Cost of a Data Breach Report 2026: United Kingdom Edition provides a detailed analysis of UK breach costs, attack methods, AI adoption, breach lifecycles and security investment priorities.
For the complete picture of the cost of a data breach in the UK this year, and what it means for your organisation, download the full report from the Northdoor Resource Centre.