“UK organizations are facing one of the most challenging cyber threat environments in Europe, with attacks growing in both volume and sophistication.”
AI-powered attacks: the single biggest short-term risk
ManageEngine’s survey of 1,500 IT and business decision-makers across the UK, Spain, Germany, Italy and the Netherlands found that 43% of UK respondents identified AI-powered attacks as their single biggest risk over the next 12 months. That concern outstripped traditional threats such as ransomware, phishing and data breaches, and ManageEngine reported AI-powered attacks as the top predicted risk in Germany and Spain as well.
Spending priorities and resilience adoption
Respondents in the UK said their top spending commitment over the next 12–24 months will focus on tackling AI and advanced threats, a priority cited by 41% of UK respondents. ManageEngine also reported that UK firms lead the surveyed nations in formal review processes, backup strategies and resilience framework adoption, with 67.9% of UK organisations implementing a formal resilience methodology.
Incidents surge while the skills gap widens
The research found that 77% of UK businesses have suffered a cyber incident in the past year — 11 percentage points higher than the other European nations surveyed. Nearly half of UK respondents (46%) identified a skills gap driven by rapidly evolving threats as their primary operational challenge, a figure the report says is over nine percentage points higher than other countries in the study. ManageEngine’s technical head for UKI, VimalRaj Sampathkumar, described the combination of rising volume and sophistication of attacks as the core source of pressure on UK organisations.
Fatigue, management support and executive engagement
Team fatigue and burnout were named as a key challenge by 29% of UK respondents, the highest rate among the countries surveyed and above the European average of 21%. Insufficient management support was flagged by the same proportion, 29%. While the report notes that UK organisations lead in executive cybersecurity engagement, it also found board involvement remains largely reactive: one in five reported limited or no engagement from leadership, and only a third described leadership as consistently proactive.
Post-incident behaviours were cautious: although most organisations conduct reviews and implement fixes, 13% reported making no strategic changes following incidents, and only 37% said they pursue long-term improvements.
Detection is fast; recovery often lags
ManageEngine’s data shows a pronounced gap between detection and recovery capability. The firm found that 94% of incidents are identified within 24 hours, but recovery timelines are stretched: over a quarter of incidents took more than 10 days to recover from, and some exceeded 20 days. That discrepancy underlines the report’s central tension — strong detection but persistent resilience and recovery challenges.
How technologists, enterprise leaders, and incident responders are positioned
- Technologists and security teams: face pressure to convert planned spending on AI-and-advanced-threat tools into operational readiness by improving visibility and closing the skills gap that 46% of UK respondents cited as their primary operational challenge.
- Enterprise leaders and boards: must weigh the report’s finding that executive engagement is high but board involvement is often reactive — one in five reported limited or no engagement — and reconcile that with the fact that only a third of organisations describe leadership as consistently proactive.
- Incident responders and recovery teams: will need to address the recovery shortfall identified by ManageEngine, where detection is rapid (94% within 24 hours) yet more than a quarter of recoveries exceed 10 days and some pass 20 days.
ManageEngine’s own prescription echoes the survey’s central challenge: “The focus now must be on turning that investment into operational readiness through better visibility, stronger skills, and more integrated resilience strategies,” VimalRaj Sampathkumar said. The numbers in the report show UK organisations are investing and instituting formal resilience practices, but the detection-recovery gap, the high incident rate, and workforce strain leave a clear test: will planned spending and existing governance translate into faster recovery and fewer strategic complacencies after incidents?
