"uncertainty has become the norm," Matt Hammerstein, CEO of Barclays UK Corporate Bank, said — a short sentence that the bank's Q1 2026 Business Prosperity Index treats not as a cliché but as a driver of corporate budgeting and risk decisions.
Barclays Q1 2026 Business Prosperity Index: headline findings
Barclays' Q1 2026 index reports that 68% of UK business leaders expect to increase cybersecurity investment over the next 12 months, while 46% say new technologies are raising their exposure to cybersecurity risks. The index also found that fewer than three in 10 businesses are confident in their ability to respond to a major cyber incident, a vulnerability Barclays links to recent global turmoil and intensifying geopolitical risk.
The research behind the index surveyed 1,000 senior business decision-makers between April 17 and May 5, 2026, conducted by Opinium Research, and includes separate research among 500 B2B leaders conducted by Focaldata between April 27 and May 1, 2026.
Cybersecurity spending: how much firms are committing, by size
Average reported cybersecurity spending among decision-makers has reached £505,000 so far in 2026. The breakdown shows a stark scale effect: large businesses report average cybersecurity spending of £1.3m, small businesses £134,000 and micro businesses £15,000. Investment momentum also varies: more than a third of large firms have increased cybersecurity investment since the start of 2026, compared with 26% of small businesses and 4% of micro businesses.
AI, agentic AI and planned technology budgets
AI and automation are becoming embedded in operations. Barclays reports that 52% of firms say AI and automation have improved productivity, and 61% now proactively use agentic AI. Cloud, cyber and AI together account for 44% of planned technology budgets over the next year.
Looking ahead two years, firms say they plan to use AI for data analysis and forecasting (38%), administrative automation (31%), customer experience (29%) and cybersecurity (29%). Despite adoption, concerns persist: 26% of firms flagged the accuracy and reliability of AI outputs as a worry, and 24% cited data security and cybersecurity risks related to AI.
Abdul Qureshi, head of Barclays Business Banking, described AI as beginning to present "tangible opportunities" for small and medium-sized enterprises, particularly where it can improve productivity and make routine work more efficient.
Top cyber-related worries named by businesses
When asked to rank cyber-related concerns, firms highlighted threats that cut across financial and reputational lines. The percentages reported are: loss of sensitive data or intellectual property (33%), damage to customer trust and confidence (28%), operational disruption or downtime (27%), and loss of revenue (26%). These specific worries mirror the bank's broader finding that resilience has climbed corporate agendas amid geopolitical and technological change.
How technologists and security teams, policymakers, and SMEs are likely to respond
- Technologists and security teams will be watching the confidence gap closely: with fewer than three in 10 businesses confident in their incident response, teams are likely to prioritize incident-readiness, detection tooling and workforce training as firms redirect part of the 44% tech-budget share toward cyber and AI defenses.
- Policymakers and regulators — while not named in the index — will see rising corporate appetite for resilience as a data point when assessing regulatory pressure and guidance. The pronounced scale differences in spending (from £15,000 at micro firms to £1.3m at large firms) highlight potential equity issues in national resilience that can inform policy debates.
- Small and medium-sized enterprises (SMEs) will face a twin challenge and opportunity: 61% adoption of agentic AI and 52% reporting productivity gains signal upside, yet only 26% of small firms have increased cyber budgets since the start of 2026 and many flag accuracy or data-security worries — a combination that keeps cybersecurity high on procurement and operational checklists.
Barclays frames businesses' response as one of tightening discipline rather than retreat. Hammerstein noted that many firms are "prioritizing investment where it strengthens resilience, productivity and long-term competitiveness." That positioning — increased budgets, selective investments in cloud, cyber and AI, and explicit concern about incident-response readiness — crystallizes the central tension in the index: firms are accelerating digital and AI adoption while admitting persistent gaps in their ability to withstand and respond to cyber shocks.
Whether the planned spending increases and the spread of agentic AI will close the confidence gap — and whether small and micro firms can translate AI-driven productivity into secure resilience at the same pace as larger peers — are the practical, immediate questions left by the index.
