An anonymous survey of 52 security professionals, findings from around 30 ISO 27001 audits and implementations, and the UK government’s national figures, side by side.
Figures cover 2024 to 2026. Next update planned for November 2027.
The short answer
Small organisations take security seriously, but there is a consistent gap between what they say and what an audit finds. Only 15% of the security professionals we surveyed felt fully ready for a ransomware attack, yet in around 90% of the organisations I audited, nobody had ever tested a restore from backup. Around 90% of administrators were working from their everyday accounts, and around 80% of organisations collected logs that nobody routinely reviewed. The fixes are rarely expensive. They are mostly about doing, and evidencing, the things the policies already say.
Key findings at a glance
| Topic | What professionals told us (survey, 2026) | What I find in audits (2024 to 2026) | The national picture (DSIT, 2025/26) |
|---|---|---|---|
| Ransomware and recovery | 15% feel fully ready; 46% “think so, but not fully confirmed” | In around 90%, a restore from backup had never been tested | 25% of businesses have a formal incident response plan |
| Admin accounts | 31% name their own CEO or senior leadership as the person most likely to cause a breach | In around 90%, administrators used their everyday account for admin work | 73% say they restrict admin rights (self-reported) |
| Device configuration | Only 10% feel their posture is genuinely handled | Around 70% had no defined baseline for laptops and phones | 24% report controls in all five Cyber Essentials areas |
| Logging and monitoring | 46% read a breach in the news and think “that could have been us” | In around 80%, logs were collected but not routinely reviewed by anyone, although almost all had some automated alerts | Around 3 in 10 monitor user activity |
| Shared accounts | 27% believe an incident at their company was downplayed or hidden | Around 50% used shared accounts, often to save licence costs | Not measured |
| AI governance | 79% say staff use AI tools without real governance; 15% have a clear policy that is followed | Increasingly, policies that are AI-generated and do not match what actually happens | Of businesses using or considering AI, 24% have practices for managing AI risk |
| Suppliers | 35% have made their security sound better than it is to a client | Weak supplier management is one of the two findings I raise most often | 15% have reviewed risks from immediate suppliers; 6% from the wider supply chain |
| Policy versus practice | 71% say work usually wins when a security policy gets in the way | The management review is the single most commonly missed ISO 27001 requirement | 52% of small businesses have a formal cyber security policy |
Survey and audit figures are rounded. Audit figures are my own estimates from audit notes, not a formal statistical sample. DSIT figures are for all UK businesses unless stated. Sources and method are below.
1. The say-do gap is the real vulnerability
The most striking result of the survey was not a single number but a pattern. Most respondents rated their organisation as taking security seriously, and most of those same people admitted that in practice, getting work done beats the policy. 71% said work usually wins when a policy gets in the way.
Audits show the same thing from the other side. In 2025 I audited a small networking business. Its retention policy was tidy, clearly AI-generated, and nothing in it had ever been carried out. That is not unusual. The documents exist; the behaviour has not caught up. It is why I ask to see evidence of a control working rather than the policy that describes it.
2. Ransomware readiness is mostly untested confidence
Only 15% of survey respondents could say they were fully ready for a ransomware attack tomorrow. The largest group, 46%, chose “I think so, but not fully confirmed”. My audit experience explains why: in around nine organisations in ten, nobody had ever restored anything from backup to prove it worked. Many also assumed their SaaS provider was backing up their data in a way they could recover from, which under the shared responsibility model it usually is not.
The cheapest high-value action in this report is to test a restore, time it, and write down what happened.
3. Administrators work from their everyday accounts
In around 90% of the organisations I audited, the people with admin rights used the same account for email, browsing and administration. Nationally, 73% of businesses say they restrict admin rights, which shows how differently “restricted” can be interpreted. If an account with admin rights opens a malicious attachment, the malware gets admin rights too. Separate admin accounts are the fix, and they cost nothing.
4. Logs everywhere, monitoring nowhere
Almost every organisation I audit has logging switched on and some automated alerts, usually for failed services. In around 80%, nobody reviewed the security logs routinely or recorded that they had. Nationally, only around three businesses in ten monitor user activity at all. Logging records what happened; monitoring means someone is looking.
5. AI has arrived; governance has not
79% of survey respondents said staff use AI tools without real governance. The most common answer was “we have policies, but I know people use AI tools on the side”. In audits, the newer symptom is policies generated by AI that nobody has checked against reality. Both are fixable with a short, usable policy and a list of approved tools.
6. The two ISO 27001 findings I raise most often
- The management review is missing. It is one of the most obvious requirements in the standard and the one most often left out. That can be acceptable if a business wants the internal audit results first, but it needs to happen before certification.
- Supplier management is thin. Suppliers are not properly identified or evaluated. Nationally, only 15% of businesses have reviewed risks from their immediate suppliers, and 6% from their wider supply chain.
More findings from my audits
Beyond the headline figures above, these are the rounded proportions I see across the roughly 30 organisations I have audited or implemented ISO 27001 for since 2024. Each links to the control page where I discuss it.
| What I checked | Share of organisations | Control |
|---|---|---|
| A record that staff have read and accepted the policies | About 2 in 10 | 5.1 |
| A record of who requested each access grant | About 7 in 10 | 5.3, 5.18 |
| Directors who skipped the awareness training they required of staff | About 7 in 10 | 5.4 |
| Any dated record of threat intelligence being reviewed | About 1 in 10 | 5.7 |
| Assets missing from the register when I first review it (mostly shadow IT) | Typically 20% to 50% of assets | 5.9 |
| Acceptable use policies that say nothing about AI tools | About 4 in 10, and falling | 5.10 |
| An active account still open for someone who has left | About 3 in 10 | 5.16 |
| Access reviews actually carried out | About half | 5.18 |
| Staff using personal AI accounts for client work | About half | 5.32 |
| Software clients with at least one high-severity finding in their first external penetration test | All of them | 5.35 |
| New clients who send me their documents unencrypted | About 7 in 10 | 5.36 |
| Carrying out criminal record checks on new starters | About 1 in 10 | 6.1 |
| Contracts that say anything about removing company data from personal devices when someone leaves | About 1 in 4 | 6.2 |
| A solid training plan with records to match | About 1 in 4 | 6.3 |
| Disciplinary policies that mention information security specifically | About 1 in 10 | 6.4 |
| Signed confidentiality agreements for every contractor | About 3 in 10 | 6.6 |
| Actually recording security incidents | About 1 in 5 | 6.8 |
| Holding any assurance evidence from their cloud providers | About 3 in 10 | 5.23, 7.1 |
| Enforcing automatic screen lock | About 1 in 5 | 7.7 |
| Able to confirm encryption is on every laptop | About 3 in 10 | 7.9 |
| Leaving USB storage completely open | About 9 in 10 | 7.10 |
| A written disposal procedure with records | About 3 in 10 | 7.14 |
| Running equipment past its support date | About 1 in 10 | 7.13 |
| HR, finance or board folders open to the wrong people | None found | 8.3 |
| Releases approved by someone other than the developer, with support told first (software businesses) | About 1 in 4 | 8.4 |
| Any alert before storage, licences or certificates run out | About half | 8.6 |
| Endpoint protection managed from a central console | About 1 in 5 | 8.7 |
| Automatic deletion switched on in any system | Very few | 8.10 |
| Real customer data used in test or development (software businesses) | About 1 in 10 | 8.11, 8.33 |
| A current, usable infrastructure or network diagram | About 1 in 5 | 8.14 |
| Organisations where everyday users have local admin rights on their own laptop | About 9 in 10 | 8.18 |
| Separate guest and staff Wi-Fi in small offices | Few | 8.22 |
| Web filtering beyond Microsoft Defender defaults | Few | 8.23 |
| Cryptography rules actually applied in practice | About 2 in 10 | 8.24 |
| Certificates and keys managed with a tool or system | About half | 8.24 |
| Security requirements documented before building (software businesses) | About 1 in 20 | 8.26 |
| Automated code scanning (software businesses) | About 1 in 3 | 8.28 |
| Security testing before release (software businesses) | Almost none | 8.29 |
| Security expectations in outsourced development contracts | About 2 in 10 | 8.30 |
| Any change process, even a simple record | About 1 in 3 | 8.32 |
| Audit and test ground rules documented in advance | None found | 8.34 |
What to do about it
- Test a restore this quarter, and record how long it took. (Control 8.13)
- Give every administrator a separate admin account. (Control 8.2)
- Write down a device baseline, even if it is a one-page checklist. (Control 8.1)
- Review your security logs on a schedule and record that you did, or pay someone to. (Control 8.16)
- Publish a short AI use policy that reflects how people actually work.
- List your suppliers and evaluate the important ones. (Control 5.19)
How these figures were produced
The 2026 Cyber Security Survey
An anonymous online questionnaire run in May and June 2026 and shared through the Iseo Blue mailing list, LinkedIn and Reddit. 52 people responded. About 60% work in security, IT or compliance leadership, and 83% work in organisations with fewer than 250 staff. Responses lean towards the UK and Europe. The sample is self-selected and should be read as directional rather than representative. Full survey results.
Audit and implementation findings
Since starting full-time in 2024 I have worked with around 40 organisations: roughly 8 ISO 27001 implementations, around 24 internal audits and about three dozen coaching engagements, with some overlap. The audit figures in this report come from the roughly 30 organisations I have audited or implemented ISO 27001 for, where I have seen the evidence directly rather than been told about it. Most are technology businesses with fewer than 250 staff; around eight in ten are fully remote and cloud-based; they are spread across the UK, Europe, the US and Australia. Percentages are rounded estimates from my audit notes. No client is identifiable from them.
National figures
From the Department for Science, Innovation and Technology’s Cyber Security Breaches Survey 2025/2026, published 30 April 2026. 2,112 UK businesses were surveyed between August and December 2025, with results weighted to be representative. These figures are self-reported.
Frequently asked questions
What is the most common ISO 27001 audit finding in small businesses?
In my audits, the most common gaps are a missing management review and weak supplier management. On the technical side, untested backups and administrators working from everyday accounts are the most widespread.
How many small businesses have tested their backups?
In around 90% of the small organisations I audited or implemented ISO 27001 for between 2024 and 2026, nobody had ever tested a restore. Only 15% of security professionals in our 2026 survey felt fully ready for ransomware.
Are small businesses targeted by cyber attacks?
Yes. The UK government’s 2025/26 survey found 43% of businesses identified a breach or attack in the previous 12 months, and 71% of our survey respondents said they had never believed they were too small to be a target.
How are these figures different from the government survey?
The government survey asks businesses what they do. Our survey asks security professionals what really happens, anonymously. The audit figures come from evidence seen during audits. Together they show the gap between the three.
About the author
Alan Parker is an ISO/IEC 27001:2022 Lead Auditor and the founder of Iseo Blue. He has around 30 years’ experience in IT service management, governance and security, mostly in technology businesses, and holds CISMP, ITIL Expert and PRINCE2 Practitioner certifications. Since 2024 he has worked full-time helping small organisations implement and audit ISO 27001.
Sources
- Cyber Security Breaches Survey 2025/2026, DSIT, published 30 April 2026.
- The 2026 Cyber Security Survey: The Honesty Gap, Iseo Blue, June 2026.