50% of respondents cited cybersecurity threats as the top threat to business resilience.

The second biggest cybersecurity challenge facing organizations is attacks against organizations' identity infrastructure, most commonly Active Directory (32%).

Almost all UK respondents (98%) stated that cyber readiness and recovery will be a top spending priority.

In real-world situations within the private sector, if a ransom payment ban were to take hold, only 10% of UK business leaders said they would comply if they were attacked.

99% of UK business leaders support limiting ransom payments for private organisations.

94% of UK business leaders support limiting ransom payments for public entities.

In real-world situations within the private sector, if a ransom payment ban were to take hold, 15% of UK business leaders said they would be neither likely nor unlikely to comply with such a ban.

A third (33%) of UK business leaders believe that a ban would decrease the prevalence of ransomware attacks by reducing the incentive for attackers.

More than a third (34%) of UK business leaders who support a proposed ransom payment ban believe it would lead to increased government support and intervention to safeguard cyber resilience.

75% of UK business leaders who believe ransomware payments should be banned admit they would still pay a ransom if it were the only way to save their organisation, even if a ban was extended to the private sector and civil or criminal penalties applied.

The average cost of an extortion or ransomware incident remains high, particularly when disclosed by an attacker ($5.08 million).

Just 17% of UK organisations paid the ransom following a ransomware attack.

96% of surveyed UK business leaders from companies with revenues of £100 million+ believe that ransomware payments should be banned across both public and private sectors.

Double extortion remains the most common approach.

The TrickBot malware family has extorted more than US$724 million in cryptocurrency from victims since 2016.

The Dragon RaaS emerged in 2024.

A new quadruple extortion tactic is being used in ransomware campaigns, which builds on double extortion by using distributed denial-of-service (DDoS) attacks to disrupt business operations and harassing third parties (like customers, partners, and media) to increase the pressure on the victim.

Nearly half the cryptomining attacks analysed by Akamai researchers targeted nonprofit and educational organizations.

Qilin ranked as the third most active threat group in May 2025 with 42 attacks.

The Handala ransomware group, a pro-Palestine group, targeted 17 Israeli organisations between 14th and 30th June 2025. These attacks coincided with the 12-day Iran-Israel war.