Phishing Is Still the Biggest Cyber Threat to UK Businesses – Would Your Team Spot One?

Cyber attacks are becoming an everyday risk for businesses, but one of the most common threats doesn’t necessarily involve a sophisticated attempt to break through complex security systems.

It can begin with an email.

As part of Cybersecurity Awareness Month, we’re looking at phishing and why employee awareness remains an important part of protecting a business from cyber threats.

According to the UK Government’s latest Cyber Security Breaches Survey, phishing remains by far the most common type of cyber breach or attack identified by UK businesses.

Would everyone in your organisation know what to look for?

What Is a Phishing Attack?

Phishing typically involves a fraudulent message designed to persuade someone to take an action that could compromise security.

An attacker might attempt to convince the recipient to:

• Click a malicious link
• Visit a fraudulent website
• Open an infected attachment
• Provide login details
• Share sensitive information
• Respond to a fraudulent payment request

The message may appear to come from a legitimate organisation, supplier, customer or even another member of staff.

How Common Is Phishing?

The Government’s 2025/2026 Cyber Security Breaches Survey found that 38% of UK businesses had experienced phishing attacks during the previous 12 months.

Among businesses that had experienced any cyber breach or attack, phishing was also identified as the most disruptive type by a significant proportion of respondents.

The problem isn’t restricted to large organisations either. Cyber criminals can target businesses of every size, and a smaller organisation may have fewer dedicated cyber security resources available to identify and respond to an attack.

Why Can Phishing Be Difficult to Spot?

Many people associate phishing with badly written emails, suspicious attachments and obviously fraudulent requests.

However, employees should not assume every malicious message will be immediately obvious.

Attackers can attempt to imitate legitimate organisations and individuals, using familiar branding, convincing language or information designed to make the request appear genuine.

Messages may also create a sense of urgency. An employee might be told that an account will be suspended, an invoice requires immediate attention or a senior colleague needs something completed urgently.

This pressure can encourage someone to act before stopping to question the request.

Create a Culture Where Employees Can Question Requests

Technology can play an important role in filtering suspicious emails, but employees remain an important line of defence.

Staff should feel comfortable questioning unusual requests, even when they appear to have come from someone senior within the organisation.

Businesses can establish clear processes for verifying sensitive requests through another communication method, particularly where money, passwords or confidential information are involved.

Regular awareness training can also help keep cyber risks visible rather than treating cyber security as something discussed only during an employee’s induction.

Make Reporting Suspicious Messages Simple

Employees should know exactly what to do when they receive something suspicious.

The National Cyber Security Centre recommends ensuring users know in advance how to report incidents. Businesses should also consider that their normal communication methods may not always be available if a device or account has been compromised.

An employee who realises they have clicked something suspicious should also feel able to report it quickly.

Trying to hide a mistake can delay the response and potentially give an attacker more time to cause harm.

What If Someone Does Click?

Even with training and technical security measures in place, no business can completely remove cyber risk.

Having an incident response process means employees know who to contact and the organisation can begin investigating and containing a suspected incident quickly.

Depending on what has happened, this could involve securing compromised accounts, changing passwords, isolating affected devices, involving cyber security specialists and assessing whether any sensitive information has been accessed.

Where Can Cyber Insurance Help?

Cyber Insurance can provide another layer of financial protection and specialist support following certain insured cyber incidents.

The protection available will depend on the individual policy, but cover may include access to specialist incident response services and protection against certain costs or liabilities arising from a cyber event.

Insurance should sit alongside strong cyber security practices, employee awareness and appropriate technical controls.

Would Your Team Spot a Phishing Email?

Cybersecurity Awareness Month is a good opportunity to ask that question across your organisation.

A suspicious email might only take seconds to open, but the consequences of a successful cyber attack could last considerably longer.

At W B Baxter, we help businesses understand their cyber risks and arrange Cyber Insurance suited to their individual requirements.

Contact our experienced team to find out more.

The cover available and policy features will vary between insurers and policy wordings. Specific terms, conditions, limits, exclusions and eligibility criteria apply. Businesses should seek advice regarding their individual requirements.