There is no single official figure for what a UK SME spends on cybersecurity today, because the UK Government stopped collecting detailed cybersecurity investment figures after its 2019 survey.
The last official benchmark found that micro and small businesses spent an average of £3,490 a year, although the median was only £200 and 33% reported spending nothing. This large gap shows how differently SMEs approach security.
A more useful way to look at the question in 2026 is to consider what an SME needs to protect. Cybersecurity spending can include email security, websites, laptops and mobiles, cloud software, Microsoft 365 or Google Workspace, backups, firewalls, endpoint protection, vulnerability management, staff training, penetration testing, cyber insurance and specialist IT or security services.
How much should a UK SME spend on cybersecurity?
A typical UK SME should consider budgeting around £5,000 to £15,000 a year for cybersecurity, with larger or more digitally dependent businesses potentially needing considerably more.
There is no universal percentage or fixed amount that works for every business. A ten-person consultancy handling limited customer data will have different requirements from a 50-person manufacturer with internet-connected systems, cloud applications and sensitive intellectual property.
The important point is that the budget should cover the whole attack surface rather than simply paying for antivirus software. A business can have excellent endpoint protection but still be vulnerable through a compromised Microsoft 365 account, an unprotected website, an exposed application, weak passwords or an employee falling for a phishing email.
What should that cybersecurity budget cover?
A sensible SME cybersecurity budget should protect people, devices, applications, websites, email and data, rather than focusing on one security product.
For email, this could include strong spam and phishing protection, multi-factor authentication and monitoring for suspicious account activity. For laptops and desktops, businesses should consider endpoint protection, device encryption, patching and secure configuration.
Websites and online applications also need protection. This can include vulnerability scanning, web application security, secure hosting, domain protection, SSL certificates, regular updates and penetration testing where appropriate. Cloud software and business applications should also be reviewed because a security incident affecting a third-party platform can still disrupt the SME.
Backups are another important part of the budget. Businesses should maintain secure, tested backups so that ransomware or accidental deletion does not turn into a major business interruption.
Has UK SME cybersecurity spending increased over the last 5 to 10 years?
UK cybersecurity investment has increased substantially over the last decade, although there is not a continuous official series showing exactly how much the average SME spends each year.
In 2018, the UK Government estimated that micro and small businesses spent an average of around £2,400 a year on cybersecurity. By the 2019 Cyber Security Breaches Survey, the mean annual investment for micro and small businesses had risen to £3,490. However, the Government warned that spending varied considerably between organisations. (GOV.UK)
The wider cybersecurity market has also expanded significantly. UK Government analysis shows that the number of cybersecurity firms increased from 846 in 2017 to 2,091 in 2023, while cybersecurity-related revenue rose from £5.68 billion to £11.86 billion.
Why are SMEs spending more on cybersecurity?
SMEs are facing a broader and more complicated digital threat landscape than they did five or ten years ago – to the point that constant upgrades make it hard to manage cashflow. Businesses now rely heavily on cloud software, remote working, online payments, websites, customer databases and email, creating more potential routes into the organisation.
The latest Government survey found that 43% of UK businesses experienced a cyber breach or attack in the previous 12 months. Among small businesses, the figure was 50%.
Budgets are responding to this pressure. The latest Cyber Security Longitudinal Survey found that 37% of businesses had increased their cybersecurity budget, either somewhat or substantially, while a further 18% had increased it in line with inflation.
What is the right cybersecurity budget for an SME?
The right cybersecurity budget is therefore less about finding one average number and more about making sure the business has enough money to cover its actual exposure.
For many UK SMEs, £5,000 to £15,000 per year is a reasonable starting point, particularly when that budget covers email, endpoints, websites, cloud applications, backups, vulnerability management, employee awareness and external security expertise.
Businesses holding sensitive personal information, processing payments or operating critical systems may need substantially more.
Cybersecurity should be treated as an ongoing business cost rather than a one-off IT purchase. The question is no longer simply whether an SME can afford to spend money on security, but whether it can afford to leave its website, email, software, data and customers inadequately protected.
