Cyber Attacks: Cost and Risk to UK Financial Services

UK financial services firms sustained an average loss of £726,000 (US$977,00) from cyber incidents over the past 12 months, according to new research from cybersecurity firm ESET. 

Across the broader sector, these disruptions represent an estimated £1bn (US$1.35bn) in cumulative losses.

The 2026 ESET UK Financial Services Security Report, which surveyed 500 small, medium and large UK financial organisations, revealed that 97%of respondents suffered cyberattacks during the year. 

Furthermore, 62% faced multiple attacks. Beyond the direct monetary drain, operational downtime poses a material challenge for executive leadership: affected organisations took an average of seven days to restore critical operations. 

The reputational stakes remain high, as only 11% of consumers stated they would continue using their financial services provider as normal following a major breach of customer data. 

Meanwhile, 58% of respondents acknowledged that their organisation may have experienced an undetected breach.

Speaking exclusively to Finance Chief, Matt Knell, UK Country Manager at ESET says: “Just yesterday, the NCSC urged organisations of all kinds to strengthen their resilience against AI-powered cyberattacks, and the UK Financial Services industry is no exception. 

“More than half of British Financial Services firms don’t have an up-to-date AI security policy or automated vulnerability management in place, leaving them exposed to threat actors looking to spot and exploit flaws at speed.

“AI doesn’t sleep, especially when it’s in the hands of cybercriminals. 

“If FS firms want to stem the tide of relentless and costly breaches plaguing the industry, they need systems, processes and security capabilities that deliver round the clock protection, including the ability to identify, investigate and respond to cyberattacks at pace.”

Unrecovered costs challenge balance sheets

While risk transfer remains a standard defensive measure across the City, corporate policies are failing to absorb the full financial impact. 

ESET found that 99% of surveyed firms hold cyber insurance – with 41% purchasing cover within the past year – yet on average, 44% of total incident costs were not recovered through insurance claims.

Consequently, the UK financial sector could have absorbed an estimated £456m (US$613m) in unrecovered annual losses over the past 12 months.

“With almost every financial services  firm experiencing recent security incidents and financial losses, we're well past warning signs,” warns Steve Round, Co-Founder and President at SaaScada. 

 “Despite relatively strong cyber maturity, organisations urgently need to move beyond the basics. If not, they will continue to face serious financial losses, customer churn, and damaged reputations.”

Structural gaps and the AI investment mismatch

The shortfall in resilience stems largely from operational capacity constraints. 

Surveyed finance leaders identified skills shortages (38%), providing 24/7/365 coverage (33%) and protecting legacy infrastructure (32%) as their most pressing cybersecurity hurdles.

These operational constraints have left fundamental technical deficits unaddressed across the sector, with 65% of organisations operating without a 24/7/365 managed detection and response service.

Just over half (57%) don’t maintain a comprehensive incident response plan, and 60% report lacking comprehensive endpoint security.

These structural weaknesses coincide with escalating spending on AI. 

Securing AI deployments ranks as the chief objective for 46% of financial institutions over the coming year, and 86% expanded their cybersecurity allocations specifically in response to AI threats. 

Despite that capital commitment, governance continues to lag behind deployment: 62% of financial firms still operate without an up-to-date AI security policy, creating unmonitored attack surfaces across corporate networks.

ESET partners: 

NATO: ESET partnered alongside Microsoft and Palo Alto Networks to strengthen collective cyberspace resilience and protecting critical European infrastructure against emerging Advanced Persistent Threats (APTs). ESET contributes threat intelligence, research, and technical expertise derived from tracking state-sponsored cyberespionage groups. 

Linux Foundation: ESET worked on the collaboration of open standards for safe, human-led agentic AI systems, focusing on AI security architecture, guardrails, and threat modeling for autonomous agents.