Aon says just 13.1% of UK organisations have put a number on their cyber exposure, even though roughly a quarter have a formal cyber plan. That gap shapes how much insurance they buy, which controls they fund and how long they could survive a serious outage.
What happened
On 30 October, insurance broker Aon published Navigating Business Disruption in the UK: Strategies for a New Risk Reality 2026. The report argues that business interruption, cyber incidents and supply chain failures are no longer separate problems for UK firms. They increasingly arrive together, and each one makes the others worse and slows recovery.
The numbers come from the UK responses to Aon’s 2025 Global Risk Management Survey, not from new 2026 fieldwork. Aon runs that survey every two years. The latest edition collected answers from 2,941 decision makers in more than 60 countries between April and June 2025. Neither the press release nor the public report page says how many of those respondents were in the UK, so the figures are best read as a broad picture rather than a precise census.
The cyber figures are the most uncomfortable part for our industry. According to Aon, 9.3% of UK organisations reported significant financial losses from cyber incidents. Only 24.6% have a formal cyber plan or review, and just 13.1% have quantified their cyber exposure. Interruption and supply chain risk look similar: 27.3% reported significant interruption losses but only 16% have measured that exposure, while 30.8% suffered supply chain losses and only 12.4% have quantified them.
Rob Kemp, chief executive of commercial risk for the UK at Aon, said firms that “quantify their exposure with precision, challenge assumptions and invest early” will cope better. Insurance Business, which covered the report on 1 November, picked up his suggestion that buyers use today’s lower commercial premiums to pay for better cover rather than simply pocketing the savings.
The detail
Aon’s central point is not that UK businesses ignore cyber risk. It says they are managing it, but without measuring it. The problem is that very few can say what a bad week would cost them, and Aon warns that the estimates that do exist are often based on instinct rather than proper modelling.
That figure drives three decisions: how big an insurance limit to buy, how long an indemnity period to choose, and how much to spend on prevention and recovery. Without it, all three are guesswork.
Convergence makes the gap worse. A ransomware attack on an outsourced provider is a cyber, supply chain and interruption event all at once. Insurance Business pointed to Hiscox research from October that found half of multinational risk managers struggle to co-ordinate their response when several risks hit together, with cyber the risk most likely to trigger the others.
Other data points the same way. Hiscox’s latest Cyber Readiness Report, covered in September, found that 38% of small UK firms had suffered a successful attack in the past year, the highest rate of any market it surveyed. Government figures cited alongside it show that only 10% of UK businesses hold a dedicated cyber policy.
Why it matters for UK organisations
There are three practical consequences.
First, underinsurance. A cyber limit chosen because it “felt about right”, or because a peer bought it, has not been tested against a realistic loss. The same goes for business interruption indemnity periods. If restoring core systems would take six weeks and the policy is built around a much shorter outage, the shortfall lands on the balance sheet.
Second, wasted security spending. Without a model of which systems drive revenue, budgets drift towards whatever is fashionable or whatever the last audit flagged. Money spent on a new tool may do less to cut loss than money spent on reducing recovery time for the two or three platforms the business cannot trade without.
Third, board scrutiny. Directors increasingly want cyber risk expressed in financial terms they can compare with other risks, and an amber square on a heat map does not give them that.
The market conditions Kemp describes will not last forever. Softer pricing makes higher limits and longer indemnity periods cheaper today, but pricing cycles turn.
Expert view
This report matches what I see. When we run incident simulations, the technical questions usually get answered. The one that stalls the room is “what does a day of this cost us?” Finance may have a revenue-per-day figure, but almost nobody has costed overtime, regulatory notification, customer compensation, contract penalties and lost sales in the months after recovery.
Quantification does not have to be elaborate. A few well-built scenarios beat a sophisticated model nobody trusts. Pick the incidents that genuinely threaten the business, such as encryption of the main ERP system, losing a key managed service provider, or data theft with extortion. For each one, estimate a realistic recovery time and what each day and week would cost.
In my experience, an honest recovery time is the most valuable input. Organisations assume they can rebuild from backup in days, then a test shows that identity services or undocumented dependencies stretch it to weeks.
I would also treat the 9.3% loss figure with caution. Firms that have never quantified their exposure may be undercounting what past incidents cost them.
What to do now
- Name your crown-jewel systems. Agree which three to five platforms or suppliers would stop revenue if they failed, and record them in the asset inventory that Cyber Essentials expects you to keep.
- Test recovery, then cost it. Time a real restore of at least one critical system, then combine the result with finance’s daily cost figures to build low, central and high loss scenarios.
- Check insurance against the scenarios. Before renewal, have your broker compare limits, waiting periods, indemnity periods and supplier cover with your modelled losses.
- Reinvest premium savings. If the renewal comes in cheaper, consider putting some of the saving into better cover, as Aon suggests.
- Cut the likelihood too. The five Cyber Essentials controls (firewalls, secure configuration, user access control, malware protection and security update management) remain the cheapest way to make the worst scenarios less likely. Check they are enforced on the systems from step one.
- Report in money. Give the board your scenario ranges and update them every year.
Bottom line
Aon’s numbers are based on 2025 survey data and the UK sample size is not disclosed, but the message is clear. Only about a quarter of UK organisations have a formal cyber plan, and even fewer know what a serious incident would cost them. Until that figure exists, insurance limits, security budgets and board reporting all rest on assumptions. Building a few honest, tested loss scenarios is a modest piece of work, and current market conditions make it a good time to act on the results.
Sources
- Aon: Aon report highlights converging risks, gaps in preparation and the need for quantification at UK businesses
- Aon: Navigating Business Disruption in the UK
- Aon: Findings from Aon’s Global Risk Management Survey, Tenth Edition
- Insurance Business: Few UK firms quantify their disruption risk, Aon finds
- Insurance Business: UK small firms hit hardest by cyber attacks, Hiscox finds
