UK organisations hit harder by cyberattacks on operations

Claroty has published research showing that 65% of UK organisations managing cyber-physical systems had operations affected by a cyberattack in the past 12 months. That was higher than the global average of 58% and the EMEA figure of 56%.

The findings come from a survey of 2,000 business and technology leaders at organisations that manage cyber-physical systems, including 200 in the UK. The results suggest UK organisations face heavier exposure, with incidents more likely to lead to financial loss, downtime, reputational damage and regulatory scrutiny.

Among UK respondents that reported an operational cyber incident, 49% said their most significant incident caused operational downtime, compared with 43% globally. Financial loss was cited by 42% of UK organisations, versus 35% globally. Meanwhile, 38% reported reputational damage, above the global average of 30% and the highest level of any market in the survey.

Regulatory scrutiny was also more prominent in the UK results. Some 36% of UK organisations said their most significant incident led to greater regulatory attention, compared with 30% worldwide.

Spillover risk

The threat most often identified by UK leaders was disruption that starts in IT systems and spreads into operational technology. That scenario was named by 44% of UK respondents, compared with 37% globally, highlighting concern about the link between corporate networks and industrial or operational environments.

Ransomware remained a major concern in the UK, with 35% of respondents ranking it among their top threats, above the global figure of 27%. Concern about AI-powered attacks was slightly higher at 36%, suggesting UK organisations see both established and emerging forms of attack as material risks to operations.

The wider global data adds to that picture. Across all surveyed markets, 58% of respondents said they had experienced a cyberattack that affected operations in the previous year. Among those that suffered a compromise, 94% said it had a financial impact, with the average cost reaching nearly USD $1.1 million.

Third-party access emerged as another weak point. Three-quarters of respondents globally said they had suffered at least one incident affecting operations linked to third-party access, while 49% said they had only partial or no monitoring of third-party connections.

Governance gap

The research suggests responsibility for operational security is increasingly concentrated in the office of the Chief Information Officer. In the UK, 48% of organisations said the CIO is ultimately accountable for operational security, compared with 39% globally.

UK CIOs are also more likely than their peers elsewhere to control the budget for operational security, with 36% of respondents assigning budget ownership to the role, against 28% globally. Yet that concentration of responsibility has not been matched by full alignment between IT and operational security structures.

Only 14% of UK organisations said they had fully integrated governance for IT and operational security. This points to a mismatch between senior-level accountability and the operating model used to manage risk across connected systems.

Confidence in recovery arrangements also appeared limited. Most UK leaders said their operations were covered by business continuity and disaster recovery plans, but only 19% said they were very confident in those arrangements, despite the high rate of recent disruption.

Legacy burden

Older systems remain a major obstacle for UK organisations trying to meet compliance demands and reduce exposure. Nearly a third of UK respondents, 31%, said legacy systems were the biggest barrier to full compliance, above the global figure of 26%.

Vulnerable legacy operational technology was also ranked among the top threats by 28% of UK respondents, compared with 21% globally. At the same time, 47% said keeping up with changing regulations, mandates and frameworks was a leading compliance challenge, placing the UK among the most affected markets in the study.

Regulation is also a stronger spending driver in the UK than elsewhere. Some 32% of UK respondents said regulatory demands were a key factor in operational security investment decisions, compared with 26% globally.

AI adoption

Use of AI in operational environments is already widespread among surveyed UK organisations. Claroty found that 74% are using AI in those settings, and the same proportion are investing in AI-based security measures, compared with 68% globally.

More than half, 56%, said AI had improved operational efficiency, above the global average of 48%. At the same time, 41% said AI had introduced new cybersecurity, compliance or operational risks, indicating that adoption is raising a fresh set of governance and risk questions.

Nick Haan, Field CTO at Claroty, said the UK figures show a sharper business impact from operational cyber incidents than in many other markets. "UK organisations are being hit more often than their global peers, and they're feeling it in their reputation, their revenue and their relationship with regulators," Haan said.

He added: "Attacks that start in IT are spilling into the systems that keep production lines, hospitals and utilities running. CIOs have taken on responsibility for protecting those operations, but too few organisations have joined up how they govern IT and operational security. With legacy systems that can't simply be patched and regulation that keeps moving, UK boards need to treat operational resilience as a core business capability - one they own, fund and regularly test."