Cyber incidents cost UK financial services firms an average of £726,000 over the past year, potentially representing total industry losses of more than £1bn, according to research by cybersecurity company ESET.

Its 2026 UK Financial Services Security Report, based on a survey of 500 firms, found that 97% had experienced at least one cyber incident in the previous 12 months, with 62% reporting multiple attacks. Recovery of critical business operations took an average of seven days following an incident.

Although 99% of respondents had cyber insurance, an average of 44% of incident costs was not recovered through policies. ESET estimates this could have left the sector absorbing up to £456m in losses over the year.

The research also identified gaps in organisations’ security arrangements. Some 65% did not have a 24-hour managed detection and response service, while 57% lacked comprehensive incident response plans and 60% said they did not have comprehensive endpoint security.

AI security is becoming a growing priority, with 46% identifying securing AI adoption as a key focus for the next 12 months. However, 62% did not have an up-to-date AI security policy, despite 86% reporting increased cyber security investment in response to AI.

Matt Knell, UK country manager at ESET, said: “The British financial sector must continue adapting to keep pace with cybercriminals. That means bolstering their cyber resilience, delivering always-on protection that can keep up with increasingly dangerous cyber threat actors, and taking steps to protect against a rising AI attack surface and AI-powered threats.”

---