Some 25% of UK Businesses Have a Formal Incident Response Plan. You Would Be the Plan.

Interview preparation runs one way. The candidate is assessed in detail and the employer is assessed, if at all, at the end and briefly. The 2025/2026 Cyber Security Breaches Survey, published by the Department for Science, Innovation and Technology and the Home Office on 30 April 2026, shows what that asymmetry costs. Some 72% of UK businesses say cyber security is a high priority for senior management, while 25% hold a formal incident response plan, and in smaller firms the person identified as most responsible for security is most often a chief executive or an office manager. The difference between a role that builds a career and one that ends it is rarely visible in the job specification. It is visible in those numbers, and it can be established in four questions at interview.

Stated priority is not installed capability

The Breaches Survey is the government's annual survey of UK organisational cyber security, conducted by Ipsos, with quantitative fieldwork from August to December 2025 across 2,112 businesses. Read as a market map rather than a risk report, it describes the conditions a security professional is being hired into.

Some 72% of businesses say cyber security is a high priority for senior management, a figure broadly stable for several years. Against that, 25% have a formal incident response plan, 39% have assigned incident roles and responsibilities to individuals, 34% have written guidance on who should be notified during an incident and 32% have guidance on when an incident must be reported externally. DSIT records no meaningful year-on-year movement in any of them.

Size changes the picture substantially. Formal incident response plans sit at 76% of large businesses, 57% of medium, and 21% of micro. Formal cyber security strategies sit at 74% of large and 57% of medium businesses, a question DSIT puts only to medium and large firms. Board-level ownership follows the same curve: 31% of businesses overall have a board member explicitly responsible for cyber security, up from 27%, rising from 29% of micro businesses to 37% of small, 52% of medium and 68% of large.

For a practitioner weighing two offers, this distribution is the one to read closely. It shows how often a candidate joins a function that already exists rather than one they have to build. Neither outcome is wrong. A greenfield mandate at a medium-sized business can reach a leadership title considerably faster than the same effort inside a large enterprise. But the two jobs carry different risk, different evidence value and different pay logic, and they are routinely advertised in identical language.

Stated priority against installed capability. The distribution, rather than the average, is what tells a candidate whether they would inherit a function that already exists or build one. Source: Cyber Security Breaches Survey 2025/2026, DSIT and the Home Office, research by Ipsos, published 30 April 2026.

Who holds security where you would work

In micro businesses, the person identified as most responsible for cyber security is most often the chief executive, at 22%, another senior manager at 18%, or the business owner at 16%. DSIT states that very few micro businesses had anyone in a specifically IT-facing role looking after cyber security matters, at 3%. In small businesses the most common holders are general or office managers at 26%, other senior management at 18% and chief executives at 14%. Only at medium size does an IT-specific title appear with any frequency, with an IT director in 13% of cases and an IT manager, technician or administrator in 14%. In large businesses an IT director holds it in 26% of cases.

DSIT attaches a caveat that matters: these job titles reflect who completed the survey rather than a definitive census of which organisations employ a CIO or CISO. Read as an indication rather than a measurement, the direction is still clear. Below medium size, security accountability usually sits with a generalist executive carrying several other functions.

That shapes what the job is. A practitioner reporting to a chief executive who holds security nominally has unusual access and unusual exposure. Decisions arrive quickly and without technical challenge, which is efficient until something goes wrong and there is no second signature anywhere in the record.

Practitioner work or supplier management

Some 48% of UK businesses use an external cyber security provider. The distribution is counter-intuitive: medium businesses 70% and small businesses 64%, against micro at 44% and large at 42%. Mid-market firms, in other words, are the most likely of all to have an external provider in place.

A candidate joining a medium-sized business should therefore establish, before accepting, how much of the role is practitioner work and how much is supplier management. DSIT reports only that the provider is there, not what the in-house team does alongside it, which is precisely why the question has to be asked rather than inferred. Both are legitimate careers, and managing a detection and response contract is a commercially valuable skill that transfers directly into vendor-side and consulting roles. It is also a different set of evidence to carry into the next interview. Two years of writing and tuning detections is not two years of reviewing a provider's monthly report, and the two are not interchangeable when a later employer asks what you have built.

The adjacent figure is worth holding alongside it. Only 19% of businesses provided cyber security training or awareness raising in the last 12 months. DSIT records signs of an increase among large businesses, from 76% to 84%, while stating that this does not represent a significant change. Development budget is not evenly distributed, and the firms least likely to have the function already built are also the least likely to fund the skills that would build it.

What the gap costs the person holding the seat

The ISC2 2025 Cybersecurity Workforce Study, published on 4 December 2025 and drawn from 16,029 practitioners and decision-makers, reports the internal conditions. Some 36% of respondents saw budget cuts and 24% saw layoffs, both roughly unchanged on the previous year. Some 33% say their organisation lacks the resources to staff teams adequately and 29% say they cannot afford to hire people with the skills they need. ISC2 states that 88% have experienced at least one cyber security incident or operational issue linked to a skills shortage, and 69% more than one. Reported critical or significant skill needs rose to 59% from 44%.

The human cost lands in the same study: 48% report exhaustion from keeping pace with threats and technologies and 47% feel overwhelmed by workload. Retention intention follows, with 75% likely to stay with their employer over the next 12 months and 66% across two years.

Those findings are global rather than UK-specific. Set against the UK governance picture, the logic is the same. An understaffed function inside an organisation with no formal plan, no board owner and no training budget does not fail gradually. It fails on the day of the incident, and the person in the seat is the one asked to account for it. DSIT reports that 43% of UK businesses experienced a breach or attack in the last 12 months, roughly 612,000 organisations, and that 19% of businesses reported a negative outcome following a breach, against a 16% figure for the previous year that covered businesses and charities together, which DSIT describes as consistent rather than a rise.

The Counter Sift

Four tests, each answerable inside a normal interview.

Owner. Who is formally accountable for cyber security, at what level, and is that recorded anywhere? If the answer is a board member, ask which one and how often they are briefed. If the answer is the chief executive, you are the function.

Mandate. What is the security budget, who signs it off, and what was refused last year? If a hiring manager cannot describe a decision they lost, the budget conversation is worth pressing further before the offer stage.

Plan. Does a formal incident response plan exist, when was it last exercised, and are roles assigned to named individuals? Given that 25% of businesses hold the plan and 39% have assigned the roles, the honest answer is often no. No is workable information. A vague yes is not.

Record. What has the organisation actually done, as distinct from what it intends? Certification held, insurance in place, training delivered, assessments completed. DSIT found that 5% of businesses hold Cyber Essentials, up from 3%, that 47% hold some form of cyber insurance, and that 22% do not know whether they hold cover at all.

Used properly, the Counter Sift establishes what you are being asked to carry, and it does so while there is still a negotiation to be had.

The Counter Sift. Four tests, each answerable inside a normal interview, and each anchored to a published figure. The UK figures are from the Cyber Security Breaches Survey 2025/2026, DSIT and the Home Office, research by Ipsos, published 30 April 2026. The practitioner figure is from the ISC2 2025 Cybersecurity Workforce Study, published 4 December 2025, and is global rather than UK only.

Three questions to ask yourself before accepting

1. If an incident happened in my first month, what exactly would I be relying on, and who else would be named in the record alongside me?
2. Does this role generate evidence a future employer will value, or experience only this employer can interpret?
3. Am I being paid for the mandate I have been given, or for the title the mandate came attached to?

The strategic takeaway

A security role is not priced by its title. It is priced by the gap between the accountability it carries and the authority it comes with. The UK data says that gap is widest in exactly the organisations most confident about their commitment to security. Establish it before you accept the offer, because afterwards it stops being a negotiating position and becomes your problem.

Confidence note

Confirmed. The UK figures are published findings of the Cyber Security Breaches Survey 2025/2026, DSIT and the Home Office, research by Ipsos, published 30 April 2026, quantitative fieldwork August to December 2025, across a business sample of 2,112. Some questions, including the senior management priority measure and the cyber insurance measures, were put to a split half-sample of 1,051 businesses; the cyber security strategy question was put only to medium and large businesses. The workforce figures are published findings of the ISC2 2025 Cybersecurity Workforce Study, 16,029 practitioners and decision-makers, published 4 December 2025. Every UK figure in this briefing was re-checked against the published DSIT release on 7 November 2026 and matched it. Of the ISC2 figures, the 36% budget cuts, 24% layoffs, 33% staffing resource, 29% hiring affordability, 88% and 69% skills-shortage consequences and the rise in critical or significant skill needs from 44% to 59% were independently corroborated in trade reporting of the study; the exhaustion, workload and retention figures and the exact sample size come from the study report itself and we have not been able to corroborate them at a second source.

Assessed. Reading the Breaches Survey as a guide to candidate decision-making is our interpretation, not a DSIT conclusion. The inference that high outsourcing rates in mid-market businesses change the balance of a practitioner role is our assessment; DSIT reports the presence of a provider, not the division of work.

Not known. DSIT notes that in smaller organisations the individual responsible for cyber security is often the person who completed the survey, so the 72% priority figure is partly self-assessment. It also notes that not all businesses have a formal management board, which may understate the board-responsibility measure. The job titles reported for security responsibility reflect the survey respondent rather than a census of CISO or CIO appointments. ISC2's own press release and study report give different fieldwork windows for the 2025 study, so we cite the publication date and sample rather than the fieldwork dates. Neither study reports how candidates currently assess employers, and we have not tested whether asking these four questions changes offer outcomes.

Register your interest

Garzon Cyber Solutions runs cybersecurity and technology recruitment on a contingency basis across the UK, EU and Americas. Nothing is payable by a hiring company until a candidate accepts and starts. We are a young firm and the recruitment work is run personally by our founder, so you speak to the person who would run the search rather than a coordinator.

If you work in cyber security, GRC, cloud or technology, register your interest on the Garzon Cyber Solutions Website so you are on the list before a relevant mandate opens. Nothing is shared with any employer without your explicit permission for a specific role.