Cyber security is keeping UK business leaders awake at night but many organisations are still failing to discuss it regularly at board level, new research has revealed.
A poll commissioned by cyber security specialist DXR Cyber, conducted by British Polling Council accredited pollster Censuswide, surveyed 500 business leaders, including C-suite executives and board members.
It found that cyber security has become one of the biggest concerns facing UK businesses, with leaders ranking it second only to revenue growth as a priority. Despite this, many boardrooms are still failing to give the issue the attention it demands.
The survey found that nearly a third (32%) of business leaders have lost sleep over their organisation’s cyber security preparedness. Cyber security was identified as the third most common cause of sleepless nights among executives, behind cashflow concerns and wider economic volatility.
The findings come against the backdrop of several high-profile cyber incidents affecting major UK retailers in 2025, including Marks & Spencer, Co-op and Harrods, which highlighted the operational, financial and reputational damage that cyber attacks can inflict on organisations of any size. The attacks led to service disruption, data theft and significant financial losses, prompting renewed scrutiny of cyber governance at board level.
While concern is widespread and awareness attacks becomes more prevalent, DXR Cyber’s research suggests many businesses have yet to embed cyber security into routine governance discussions.
Just over a third of organisations (37%) discuss cyber security at every board meeting. However, 13% discuss cyber security in fewer than half of their board meetings, while 6% never discuss the issue at board level.
The findings come despite high levels of confidence among leaders in their board’s understanding of cyber risk. Nine in ten respondents (90%) said they are confident their board understands cyber security risks, although fewer than half (46%) said they are very confident.
Mike Robinson, CEO at DXR Cyber, said: “These findings should be a wake-up call for business leaders and board members. Cyber security is no longer a technology issue that can be delegated to IT teams. It is a core business risk with the potential to impact revenue, operations, reputation and trust.
“I worry about the disconnect between the level of concern that leaders feel and the frequency of this essential topic being discussed in boardrooms across the UK. At every point in the supply chain, leaders need to be taking this very seriously and taking the necessary steps to make sure they are cyber resilient in the truest sense.”
The research follows growing efforts to place greater responsibility for cyber resilience on company boards.In 2025, the UK Government and the National Cyber Security Centre introduced the Cyber Governance Code of Practice, designed specifically to help directors and boards better understand and manage cyber risk.
