Why does cyber security matter in 2026?
The impact of a cyber attack is wide-reaching, causing downtime, data loss and recovery work that can run for weeks. Hasbro was largely offline for weeks after hackers were discovered in its systems in late March, and had to delay its quarterly filing. Boston Scientific took two weeks to recover from the immediate outage after an attack disrupted its global operations, which also delayed NHS Supply Chain deliveries.
For many businesses, income depends on sites and applications being live at all times. For an eCommerce business, downtime means customers cannot buy, so losses start immediately and continue afterwards. Our research found that 1/3 of UK consumers would move to a competitor’s website after less than 30 seconds of an outage, overlooking existing brand loyalty (Consumer Tolerance to IT Downtime).
Large incidents also spread through supply chains. The Cyber Monitoring Centre estimated that the Jaguar Land Rover attack cost the UK economy about £1.9 billion and affected more than 5,000 organisations, with many smaller suppliers facing insolvency.
Data loss can bring financial penalties too. If a breach results from insufficient security measures, your company can be held responsible for the data affected. The Information Commissioner’s Office (ICO) can fine organisations that fail to take adequate measures to prevent or contain a serious personal data breach, up to £17.5 million or 4% of total annual worldwide turnover in the preceding financial year, whichever is higher.
Where are attacks starting in 2026?
The incidents of 2026 show four recurring starting points.
Helpdesks and social engineering. Around 607,000 records were taken from the Department for Education’s helpdesk and Turing Scheme systems in July, with the breach reportedly carried out through social engineering of the helpdesk. The ShinyHunters group used voice phishing against organisations including Instructure, the company behind the Canvas learning platform, in a campaign that exposed data on over 30 million students and staff. Even automated support can be fooled: tens of thousands of Instagram accounts were hijacked when people asked Meta’s AI chatbot to send password reset codes to an email address of their choosing.
Suppliers and forgotten credentials. Manchester Airports Group disclosed in August that customer data had been stolen from a database hosted by a third party, and the extortion group involved later published data on around 8.7 million people after its demands were rebuffed. Market research provider Klue was breached through a credential issued in 2022 for a limited pilot and never retired, which exposed keys to its customers’ cloud services and affected close to 200 companies.
Internet-facing gateways. Citrix NetScaler appliances had three zero-day vulnerabilities disclosed in around a fortnight, with exploitation confirmed by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Devices that control access to your network are attractive targets, because a compromise can undermine every control behind them.
Destructive attacks. When a group the U.S. government linked to Iranian intelligence attacked Stryker in March, it remotely wiped tens of thousands of employee devices and disrupted operations for several days. How quickly a business could recover shaped the damage as much as the attack itself.
What is changing in UK regulation?
The Cyber Security and Resilience Bill would bring some medium and large managed service providers into direct regulation, with initial incident notifications to regulators and the National Cyber Security Centre (NCSC) within 24 hours. As of October 2026, it is reported to be in the House of Lords, with Royal Assent expected in late 2026. Separately, the government has written to over 180 business leaders inviting them to sign a Cyber Resilience Pledge, with a formal launch planned later this year. If you use a managed service provider, ask how they will meet these requirements.
Essential 1: Make an emergency plan
Even with a stringent security strategy, incidents can still occur. Only 25% of businesses have a formal incident response plan, so most respond to an attack without a defined process. An incident response plan sets out how everyone in your organisation should act if an attack succeeds, and should cover:
- Identification: how will you detect and verify an incident, and are the right people receiving alerts?
- Containment: how will you respond to the threat and limit its impact?
- Communication: if email or messaging platforms are compromised, how will employees communicate without risking further exposure, and how will leadership tell them an attack has occurred?
- Disaster recovery and failover: what is the process for failing over to your secondary DR site and recovering data from backups?
- Post-incident analysis: how will you investigate the causes and weaknesses, and prevent a repeat?
Include your suppliers in the plan: who to call, what they must tell you and how quickly. Share the plan with everyone involved, make sure each person knows their role, and practise it with a tabletop exercise, a short walk-through of a realistic scenario. Ownership at board level helps, and 31% of businesses now have it, up from 27% last year. Review the plan regularly as the threat landscape changes.
Essential 2: Keep multiple layers of backups
For especially critical documents and systems, maintain multiple layers of backup. In 2025, the UK government wrote to chief executives advising them to keep offline backups of essential documents, including their plan for operating through a successful attack. Attacks that wipe devices, such as the one at Stryker, show why.
The 3-2-1 strategy is a common approach: three copies of your data, on two different types of media, with one stored offsite or offline. This reduces the likelihood of a single point of failure.
Offline or “air-gapped” backups cannot be reached via the internet, so they are immune to most forms of cyber attack. They can be external hard drives, encrypted USB devices, or printed copies of key records and contact details. Immutable backups, which cannot be changed or deleted after creation, add another layer of resilience and provide a trusted recovery point.
Built-in redundancy from a cloud provider does not replace a backup. Keep an independent copy in a separate account, region or provider. Whatever you choose, make sure that:
- Backups are tested regularly: confirm the data can be restored quickly and accurately.
- Backups are encrypted and stored securely: limit access to authorised personnel.
- Essential data is clearly defined: decide which systems and files are truly mission-critical, such as financial records, customer databases and operational documentation.
Essential 3: Secure identity and access
Many 2026 incidents began with someone being persuaded to hand over access, or with access that should have been removed. Four steps reduce the risk:
- Use multi-factor authentication (MFA) on all systems, particularly email, remote access and administrator accounts.
- Verify requests before acting: helpdesk and password-reset requests should follow a callback or approval process, since attackers impersonate staff and IT support.
- Remove access you no longer need: review user, service and supplier accounts regularly, and retire credentials issued for pilots and projects.
- Apply least privilege: give people and systems only the access they need.
Identity underpins most other controls, so its configuration deserves close attention and monitoring.
Essential 4: Patch quickly and reduce exposure
Prioritise internet-facing systems such as gateways, VPNs, remote access and collaboration tools, because attackers often exploit new flaws within days and sometimes before a patch exists. Patch by potential impact, including what the system protects, as well as by severity score. When a zero-day has already been exploited, assume compromise, preserve forensic evidence and then patch. Keep a tested plan for taking exposed services offline quickly, and remove internet access from internal tools that do not need it.
Essential 5: Review your security stack
Cybersecurity tools and tactics evolve rapidly, so what protected your business two years ago may no longer be enough. Map your existing tools and services, and look for overlaps, gaps and legacy solutions. Many businesses rely on a patchwork of antivirus, endpoint protection and cloud security controls that do not share threat intelligence. Key areas to assess include:
- Endpoint security: monitor and protect every device that connects to your network, particularly with remote and hybrid working.
- Network security: check that firewalls, VPNs and intrusion detection systems are correctly configured and up to date.
- Application security: patch and update software regularly, and use vulnerability scanning or penetration testing to find weaknesses before attackers do.
- Monitoring and detection: continuous monitoring helps identify suspicious activity before it becomes an incident.
Partnering with a managed service provider can simplify this, providing expert oversight, continuous monitoring and threat detection around the clock.
Essential 6: Know your suppliers
Only 15% of businesses have reviewed the cyber security risks posed by their immediate suppliers. The incidents at Manchester Airports Group, Klue and Boston Scientific show how a supplier’s problem can become yours. Ask which suppliers can access your systems or data, how quickly they must tell you about an incident, where your data is hosted and what certifications they hold, such as ISO 27001 or Cyber Essentials Plus.
Essential 7: People matter as much as technology
Phishing remains the most common type of attack, affecting 38% of businesses. Combine technical controls with regular staff training, simulated phishing exercises, clear security policies and a no-blame way to report mistakes quickly. Include helpdesk staff and anyone who can reset access or approve payments, as they were targeted in several of this year’s incidents.
Your weekly checklist
- Week one: review your incident response plan and run a short tabletop exercise.
- Week two: test a restore, and confirm an independent offline or immutable copy exists.
- Week three: check MFA coverage, helpdesk verification and old credentials.
- Week four: list the suppliers with access to your systems, and run a phishing exercise.
How we can help
At Hyve Managed Hosting, we take a proactive approach to security. From 24/7/365 monitoring and managed firewalls to disaster recovery and backup solutions, we help businesses stay protected and operational at all times. Our experts work with you to identify vulnerabilities, put robust defences in place and keep your data secure.
Review your cyber security before the year ends
Speak to one of our experts about your incident plan, backups and security stack. Fill out our contact form and we will be in touch.
FAQs
What should an incident response plan include?
An incident response plan should cover identification, containment, communication, disaster recovery and failover, and post-incident analysis. It works best when shared with everyone involved and practised through exercises.
What is the 3-2-1 backup rule?
The 3-2-1 rule means keeping three copies of your data, on two different types of media, with one stored offsite or offline.
What is the difference between offline and immutable backups?
Offline, or air-gapped, backups cannot be reached over the internet. Immutable backups cannot be changed or deleted after they are created. Both add resilience, and they can be used together.
