Awareness is useful.
Evidence is better.

This is not a representative measure of every UK SME. The business sample covers organisations with at least 50 employees; the charity population has annual income above £1 million. Smaller organisations may recognise the problems, but should not borrow these percentages as their own predicted likelihood of an incident.

The contrast is nevertheless useful for management. Incidents and impersonation were widely reported, while formal supplier assessments were much less common. That does not prove that an individual supplier caused an incident. It suggests a question worth asking: does the attention given to external dependencies match their importance to the business?

Survey evidence is self-reported. It can show patterns and associations; it cannot tell your board which control prevented a particular loss, or establish that every organisation with few reported incidents is unaware of an intrusion.

“Nothing happened” can mean several things. Controls may have worked. Staff may have recognised and rejected a suspicious approach. An incident may have been small enough to handle locally. Or the organisation may not have the logging, reporting culture or investigation capacity to recognise what happened.

Board reporting should make that distinction visible. A count without a scope can reward blindness: the team with fewer sensors or a higher escalation threshold may look safer than one that investigates honestly. Ask which information sources support the incident count and which services remain uncertain.

The same applies to successful control tests. A result should include the situation tested, the systems covered, the evidence observed and the limits of the conclusion. A carefully bounded finding is more useful than a broad assurance statement that nobody can trace back to a test.

More spending is not automatically better spending. A nominally flat budget can buy less capacity as costs rise, but an increase can also disappear into overlapping products or unfunded implementation. Review the work the business needs, the capacity available and the consequences of leaving a gap.

Be explicit about operating costs after procurement. Somebody must review exceptions, maintain detection rules, remove dormant access, check recovery evidence and follow up supplier changes. A tool that is installed but not maintained can create confidence without the intended protection.

A useful budget conversation therefore connects a business outcome to a specific improvement: reduce time to revoke dangerous access, restore a customer-facing service within an agreed limit, or prevent an unauthorised payment change. Track whether the improvement actually happens.

These six contributors work together; they do not form a mathematical formula. A strong policy cannot compensate for an unowned administrative account; a capable technical team cannot approve a payment on behalf of finance. The business needs the handoffs between them to work.

Named board responsibility is a starting point. Effective oversight also requires enough understanding to question the evidence, recognise uncertainty and decide between competing priorities. A senior owner who receives only green dashboards may lack the information needed to discharge that responsibility.

Certification can establish that particular requirements were assessed within a stated scope. It cannot establish that every current control works, that new suppliers are covered or that an incident will be contained. Monitor material changes between assessments and keep any lapse or exception visible.

Supplier review should be proportionate. Prioritise providers with privileged access, sensitive information or a critical service dependency. A questionnaire sent to every supplier is less useful than evidence about the small number whose failure or compromise could seriously interrupt the business.

Insurance can provide financial protection and access to specialist assistance under the policy terms. It does not make a backup restorable, determine whether a suspicious login is investigated or ensure that somebody can isolate a compromised account overnight.

Check that the incident plan can actually reach the insurer’s approved response route and that notification, consent and supplier conditions are understood. Keep those contacts available independently of an affected account or system. Discuss coverage with the insurer or broker rather than assuming a cyber label settles the detail.