ESET, a global cybersecurity leader, has published research showing that cyber incidents cost the UK financial services firms it surveyed an average of £726k each over the last year, a figure that could add up to as much as £1.01bn across the sector.
The 2026 ESET UK Financial Services Security Report draws on responses from 500 UK financial services organisations ranging from small to large. Almost all of them, 97%, suffered a cyberattack during the previous 12 months, and 62% were targeted more than once. Among the firms affected, restoring critical operations took seven days on average.
The consequences for customer loyalty look severe: only 11% of consumers said they would keep using their provider as before if a major breach exposed their data. Concern about undetected intrusions is also high, with 58% of respondents admitting their organisation may already have been compromised without anyone noticing.
Cyber insurance is now close to universal in the sector but does not cover the full cost. Some 99% of the firms surveyed hold a policy, and 41% bought one within the past year. Even so, an average of 44% of incident costs went unrecovered through insurance, which could have left the industry carrying up to £456m in losses over the year.
The report argues that while firms have mastered core defences, more advanced weaknesses are giving attackers a way in, a problem made worse by AI-driven threats. Respondents named talent shortages (38%), running round-the-clock security operations (33%) and protecting legacy technology (32%) as their biggest challenges. In addition, 65% lack a 24/7/365 managed detection and response service, 57% have no comprehensive incident response plan, and 60% lack comprehensive endpoint security.
AI sits at the centre of firms’ plans. Securing AI adoption is the leading priority for the coming 12 months, cited by 46% of respondents, and 86% have raised cybersecurity spending because of AI. Yet 62% still do not have a current AI security policy.
SaaScada, a UK-headquartered global FinTech, also commented on the findings. SaaScada co-founder and president Steve Round said, “With almost every FS firm experiencing recent security incidents and financial losses, we’re well past warning signs. Despite relatively strong cyber maturity, organisations urgently need to move beyond the basics. If not, they will continue to face serious financial losses, customer churn, and damaged reputations.”
ESET UK country manager Matt Knell said, “The British FS industry must continue adapting to keep pace with cybercriminals. That means bolstering their cyber resilience, delivering always-on protection that can keep up with increasingly dangerous cyber threat actors, and taking steps to protect against a rising AI attack surface and AI-powered threats.”
Copyright © 2026 RegTech Analyst
Copyright © 2026 RegTech Analyst
