London, 30 June, 2025 – Cyberattacks have become a pressing issue for businesses, with the potential to cause significant financial losses, operational downtime, and lasting damage. As a result, cybersecurity has become a top priority for CEOs and executives, who face increasing pressure from regulators, investors, and customers to actively manage and mitigate cyber risks.
Recent findings from Horizon3.ai’s Cybersecurity Report UK 2024/25 highlight the impact of cyberattacks on UK organizations. The report, which surveyed 150 companies, found that 62% of those who fell victim to cyberattacks experienced downtime, 54% faced ransom demands, and 35% had their data stolen. These statistics underscore the urgent need for proactive cybersecurity measures to protect against costly breaches.
“Attacks are becoming more relentless, automated, and difficult to detect, and regulatory expectations are intensifying. The responsibility of business leaders to protect sensitive systems and data has never been more pressing,” said Keith Poyser, Vice President for EMEA at cybersecurity company Horizon3.ai.
The Economic Impact of Cyberattacks
The Cybersecurity Report UK 2024/25 also reveals the economic consequences of cyberattacks, with nearly two-thirds of organizations reporting at least one attack in the past year. Among those affected, 62% experienced outages or downtime, highlighting the operational impact of cyber incidents. Additionally, 54% faced ransom demands, 42% experienced disruption to business operations, and 35% had data stolen, emphasizing the financial and reputational consequences of these attacks.
Recent high-profile breaches in the UK retail sector, including Co-op and M&S, have demonstrated the real-world impact of these trends. The UK Cyber Monitoring Centre classified these incidents as “Category 2 systemic events,” with combined losses estimated at up to £440 million. These losses include legal costs, business interruption, incident response, reputational damage, and customer remediation. The incidents have also triggered heightened scrutiny from regulators and renewed calls for businesses to prioritize proactive cyber resilience.
The Growing Importance of Proactive Measures and Testing
As the scale and complexity of cyberattacks continue to grow, even well-resourced organizations are finding it increasingly challenging to defend against evolving threats. This pressure is exposing the limitations of traditional, reactive security approaches, which often rely on scheduled risk assessments and static controls. To address this, organizations must adopt an offensive security approach, using real-world cyberattack techniques to uncover and address weaknesses before they can be exploited.
“Continuous, autonomous penetration testing of IT infrastructures is essential for staying ahead of evolving threats and ensuring defenses can withstand sophisticated attacks,” said security expert Poyser.
Techniques such as penetration testing, red teaming, and autonomous attack emulation allow organizations to assess their systems from an attacker’s perspective. This enables teams to identify critical weaknesses, prioritize remediation efforts, and validate the effectiveness of their defenses under realistic conditions.
Understanding the Growing Liability
The responsibility for cybersecurity cannot rest solely with IT departments but must become a central topic in the boardroom. Cybersecurity is no longer just a technical issue; it is a business-critical concern that impacts revenue, reputation, regulatory compliance, and resilience. Senior leadership must take an active role in shaping and driving the company’s cybersecurity strategy to ensure comprehensive protection across all levels.
Cybersecurity is increasingly viewed as a legal and compliance matter, with frameworks like the Network and Information Systems Directive 2 (NIS2) and the Digital Operational Resilience Act (DORA) introducing stronger expectations for board-level governance. These frameworks emphasize the role of leadership in ensuring adequate security measures are in place and require boards to demonstrate oversight of risk management processes.
“UK companies working with EU partners must recognize that they are bound by these regulations. With the increasing frequency and severity of cyberattacks, it is anticipated that more such legislation will be introduced. Organizations are strongly encouraged to act now, learn from the missteps of others, and take proactive steps to avoid the potentially severe consequences down the line,” Poyser commented.
About Horizon3.ai and NodeZero
Horizon3.ai provides a cloud-based platform, NodeZero, enabling organizations and public authorities to simulate self-attacks on their IT infrastructure to assess their cyber resilience through penetration testing (pentesting). The platform offers affordable, regular pentesting, making it accessible to mid-sized companies. Horizon3.ai continuously monitors the cybercrime landscape to ensure that newly discovered vulnerabilities are swiftly integrated into the cloud system. NodeZero not only identifies security flaws but also offers tailored recommendations for remediation. Through this platform, Horizon3.ai helps organizations meet rising regulatory demands for cyber resilience in Governance, Risk & Compliance (GRC), with guidelines recommending an internal self-attack at least once a week.
Trademark notice: NodeZero is a trademark of Horizon3.ai.
For further information, please contact Horizon3.AI Europe GmbH at Prielmayerstrasse 3, 80335 Munich, or visit their website at www.horizon3
