UK Small Businesses Struggle With Basic Cybersecurity Skills

A government skills survey indicates that 57 percent of UK businesses lack confidence in performing at least one basic cybersecurity task, as The Register first reported. This represents approximately 808,000 businesses, an increase from the 699,000 reported last year.

According to The Register, the most significant deficiency is the ability to detect and remove malware, a task 38 percent of businesses lacked confidence in performing. Other identified gaps include configuring firewalls, selecting secure device settings, enabling automatic updates, creating secure user accounts, restricting software, and the secure storage and transfer of personal data.

Sam Thornton, COO at cybersecurity consultancy Bridewell, told The Register that these figures likely reflect the struggles of smaller businesses and charities where security is often a secondary responsibility rather than a dedicated role. Thornton noted that evolving malware and the use of AI by attackers make keeping pace difficult for personnel juggling multiple roles.

Matt Hull, veep of cyber intelligence and response at NCC Group, told The Register that limited resources are further strained by complex IT environments involving SaaS platforms, APIs, and cloud infrastructure. Hull suggested that organizations often chase new updates while neglecting security fundamentals.

While the UK government has introduced a £210 million Cyber Action Plan and the Cyber Security and Resilience Bill to strengthen essential services, Thornton argued that regulation alone is unlikely to close the skills gap for small businesses without practical support tailored to their limited resources.