ESET has found that 97% of 500 surveyed UK financial services firms suffered a cyberattack in the past year, at an average cost of GBP 726,000.
The 2026 ESET UK Financial Services Security Report surveyed senior cybersecurity decision-makers at UK financial services firms with more than 50 employees and annual revenue between GBP 500,000 and GBP 500 million, in September and October 2026. Of respondents, 62% faced multiple attacks, firms took seven days on average to recover critical operations after an incident, and 58% said their organisation could have been breached without detection. ESET estimates that cyber incidents could cost the sector up to GBP 1.01 billion a year.
Insurance leaves a gap
Almost all firms surveyed (99%) have cyber insurance, and 41% took out a policy in the past 12 months. On average, however, 44% of the cost of a cyber incident was not recovered through insurance, which ESET estimates could have left the sector to absorb up to GBP 456 million in the past year. A separate survey of 2,000 UK consumers found that only 11% would keep using their financial provider as normal after a major breach exposed customer data.
Steve Round, Co-Founder and President of UK-based fintech SaaScada, stated that with almost every financial services firm experiencing security incidents and financial losses, the sector is well past the warning stage. According to Round, despite relatively strong cyber maturity, organisations need to move beyond the basics or risk continued financial losses, customer churn, and reputational damage.
Gaps in advanced security and AI
Respondents named talent shortages (38%), delivering round-the-clock security operations (33%), and securing legacy technology (32%) as their biggest cybersecurity challenges. In addition, 65% do not have a 24/7 managed detection and response service, 57% lack comprehensive incident response plans, and 60% do not have comprehensive endpoint security.
Securing AI adoption is the top priority for 46% of firms over the next 12 months, and 86% have increased cybersecurity investment because of AI, but 62% lack an up-to-date AI security policy. Matt Knell, UK Country Manager at ESET, stated that the UK financial services sector must keep adapting to match cybercriminals, by strengthening cyber resilience, providing always-on protection, and guarding against a growing AI attack surface and AI-powered threats.
