808,000 UK businesses were not confident at one or more of nine tasks, and that measures confidence, not skill

808,000 is 57 per cent of 1,417,730, and the 57 per cent is a confidence score

The government's cyber security skills survey says about 808,000 UK businesses had a basic technical skills gap. Divide that by the base the report itself uses, 1,417,730 businesses with one or more employees, and it is 57 per cent: 57 per cent of 1,417,730 is 808,106, which the report rounds to 808,000 (derived). A year earlier the figure was 49 per cent, about 699,000. The report, Cyber security skills in the UK labour market 2026, was published on GOV.UK on 29 September 2026 and covered by The Register on 30 September. Its telephone fieldwork ran from 8 August to 27 October 2025, so the figure describes autumn 2025, 337 days before publication (derived).

What that does not establish is that 808,000 businesses are unskilled. A business is counted if the person responsible for cyber security said they were not confident at one or more of nine tasks. Nobody was tested, and nobody checked whether a firewall was switched on. The report says as much itself: the fall in confidence "does not necessarily indicate reduced capability". The Register's figures match the report. This briefing checks how far the number carries, using the full report, the earlier waves and two other government sources.

What was asked, of whom, and how nine answers became one

The survey is a telephone survey run by Ipsos with Perspective Economics for the Department for Science, Innovation and Technology, whose cyber team moved to the Department for Digital, Culture, Media and Sport in July 2026. It interviewed 982 UK private sector businesses, 162 charities and 117 public sector organisations, weighted to represent each population. The findings report refers to a technical report, but the GOV.UK page lists only the findings. Where the 2026 report is silent I have used the 2025 technical report, the latest published, and I say so.

What the questionnaire asked, from the 2025 questionnaire:

• The respondent is the senior person with the most knowledge or responsibility for cyber security at the head office.
• The question asks how confident they would feel about themselves or anyone else directly involved in cyber security being able to do each task. The interviewer note says to answer for the most confident staff member. If the task is not needed today, they answer for the future. The scale runs from very confident to not at all confident. The 2026 text does not restate where not confident begins; the 2024 tables split not very from not at all, and I read both as the gap.
• A task handed to an outside provider is not asked about and counts as no gap.
• The nine tasks are detecting and removing malware; storing or transferring personal data securely; restricting the software that runs on devices; setting up configured firewalls; choosing secure settings; setting up automatic updates; setting up new user accounts and authentications securely; controlling who has admin rights; and creating back-ups. The report says they combine the Cyber Essentials technical areas with other basic aspects, and it leaves out incident response, which it treats separately.
• The 57 per cent is the share of businesses not confident at one or more of the nine.

What the survey states, and what it does not

The 2026 report's claims set against what it leaves open. Sources: the 2026 findings report, and the 2025 technical report where marked. Derived figures are my arithmetic.

Question	Stated in the report	Not stated or not established
How big	About 808,000 businesses, 57% of 1,417,730 employers. Margin of error 4 points: 751,000 to 865,000.	A count of businesses anyone examined. It is an estimate from 982 interviews, worth about 590 after weighting (derived).
What is measured	The confidence of the person responsible, at nine tasks. Outsourced tasks count as no gap.	Whether the tasks are done, or done well. No test, no check of whether a control is on.
Whether the rise is real	49% to 57%. The report's convention is that changes it describes are significant at 95%.	The test for this change is not printed. My calculation from the printed margins gives z of about 2.8.
Why it rose	Possibly greater awareness after high-profile breaches, from interviews.	Any measure of awareness. The 51 interviews are not representative, and 11 were medium and large business and public sector leads.
Which businesses	Large businesses 24%. Small businesses and charities described as hardest hit.	A figure for micro, small or medium businesses. Micro firms are 81% of the base.
Public sector	14% to 27%, from 117 organisations.	Central government departments. The 2025 technical report says they were excluded from the sample.
When	Fieldwork 8 August to 27 October 2025.	How businesses feel now. Publication came 337 days after fieldwork closed.

The base, drawn to scale

The Register's headline says UK businesses. The survey's population is the 1,417,730 businesses with employees, out of 5,690,265 private sector businesses that the Department for Business and Trade counted at the start of 2025. The other 4,272,535 have no employees and are outside the survey. So more than half of UK businesses is, more precisely, more than half of the quarter of businesses that employ someone.

Size decides the number. Micro businesses, one to nine staff, are 1,150,875 of the 1,417,730, or 81.2 per cent; with small firms, 96.7 per cent (derived from the DBT table). Large businesses number 8,335, and the report gives them a gap of 24 per cent. If every large business had a gap, they would still be 1.0 per cent of the 808,106. The report's only size comparison sets large at 24 per cent against 57 per cent for smaller businesses, which is the all-business figure again: with large firms at 0.6 per cent of the base, the two cannot differ by more than rounding (derived). The text prints no separate figure for micro, small or medium businesses, so a reader cannot tell which of them the 57 per cent describes. It is, by construction, mostly a micro business number.

Three tasks rose and six did not

The report prints the nine tasks for both years, and that comparison says more than the total. Detecting and removing malware went from 23 to 38 per cent, restricting software from 19 to 28, and storing or transferring personal data from 25 to 31. The other six were flat or lower: secure settings 15 and 15, back-ups 7 and 7, firewalls 28 to 26, automatic updates 13 to 11, new user accounts 12 to 10 and admin rights 12 to 9. The 2026 text describes only the malware and personal data rises.

The report suggests the rise may reflect greater awareness after high-profile breaches, on the evidence of interviews. Those interviews are not representative, the report says, and the 57 per cent is dominated by micro firms. If awareness were the whole story I would expect confidence to fall across most of the list; on the published figures it fell in three. That is my inference and rounding could hide small moves, but it points at particular tasks, not a general loss of nerve.

Add the nine shares and you get 154 points in 2025 and 175 in 2026 (derived). Divided by 49 and 57 per cent, the average business with a gap is not confident at about three tasks in both years. On these rounded figures, more businesses have a gap, not more gaps each.

Confidence is not a control

The label skills gap makes a self-rating sound like an audit. Three details show the distance.

• Malware. The largest gap is detecting and removing malware, a response task. The Cyber Essentials control is malware protection, which the NCSC describes as identifying and immobilising malicious software before it causes harm. The NCSC's small organisations guide says modern devices have antivirus and firewall software built in and switched on by default, and tells readers to check nobody has turned them off. A firm can run the control and still tell an interviewer it is not confident cleaning up an infection.
• The same season, another survey. The DSIT and Home Office Cyber Security Breaches Survey 2025/2026, also run by Ipsos over August to December 2025 with 2,112 businesses, found 81 per cent with up-to-date malware protection, up from 77 per cent, and 74 per cent with firewalls covering the network and devices. It asks about controls in place, not confidence, on a different sample, and it is also self-reported. Even so, controls rose while confidence fell, and the share of businesses reporting a breach or attack stayed at 43 per cent.
• The base is all businesses, outsourcers included. The 38 per cent is a share of every business, with outsourcers counted as confident. The report says 35 per cent outsource at least one aspect, and 84 per cent of those outsource malware detection: about 29 per cent of businesses (0.35 times 0.84, derived). On that arithmetic roughly half of the businesses that do the task themselves, 38 of about 71, said they were not confident (derived, approximate). The survey says nothing about how well outsourced providers do it.

Is the rise real? Five reports and one test

Headline basic skills gap in each findings report, 2022 to 2026, with the tasks combined and businesses interviewed. Counts are each report's own extrapolation on its own year's business population. Interview counts: 2025 technical report and 2026 findings.

Report	Not confident at 1 or more tasks	Tasks combined; businesses interviewed
2022	51% (about 697,000)	8 tasks; 947
2023	50% (about 739,000)	10 tasks; 1,006
2024	44% (about 637,000)	10 tasks, including dealing with a breach; 930
2025	49% (about 699,000)	9 tasks; 1,061
2026	57% (about 808,000)	9 tasks; 982

Two things stop the earlier years being read as one line. The task list changed: the 2024 list included dealing with a breach or attack, which the 2025 and 2026 lists leave out. And in the 2025 wave the business sample moved from the government's business register to a commercial list, according to the 2025 technical report, so its response rate could not be compared with earlier years: 9 per cent of the released sample completed, 11 per cent adjusted. That leaves 2025 to 2026, nine tasks in both, as the cleanest comparison. I could not confirm the 2026 sample source.

The report prints margins of error of 4.0 points for 2026 and 3.9 for 2025 (footnotes 22 and 23): 53.0 to 61.0 per cent against 45.1 to 52.9, 0.1 of a point apart, as the first diagram shows. A difference test on those margins, which is my calculation and treats the samples as independent, gives z of about 2.8 and p of about 0.005. Letting the true difference be a point smaller or larger gives z between 2.5 and 3.2. On the report's own numbers the eight point rise is statistically significant. The 4.0 point margin also implies an effective sample of about 590 interviews (derived), against 982 achieved, because of weighting. What no test can supply is the reason.

Who is speaking

The report is government research commissioned by DSIT's cyber team and endorsed, its acknowledgements say, by the NCSC, the UK Cyber Security Council, techUK and others. It reads its own rise as a sign of the continued and increasing need for support and guidance on basic cyber hygiene, and also as possibly an effect of awareness. It cannot separate the two.

The Register's expert comment comes from executives at two security firms, Bridewell and NCC Group. Bridewell's chief operating officer argues that small firms need affordable managed services, simpler tools or insurer incentives more than tighter regulation. That is a position from a firm in the business of providing security services, and it fits one fact in the survey: 35 per cent of businesses outsource something. But outsourcers are counted as having no gap, so the survey cannot show that outsourcing closes one.

What a UK security lead can do with this, in order

The first four items are NCSC guidance for small organisations and the fifth is my suggestion. I read the NCSC pages on 30 September 2026; the Cyber Essentials price and offers can change.

The Breaches Survey found 24 per cent of businesses reporting controls in all five Cyber Essentials areas and 5 per cent adhering to the scheme, so the gap between doing and certifying is large. NCSC pages used: protecting your devices, backing up your data, infected devices and Cyber Essentials.

The question that exposes the gap

The survey could not test capability, and it cannot tell you which of the 808,000 could show a working control. It cannot tell you about yours either. Which of the nine tasks could your own organisation evidence today, with a setting that is switched on and a named person who owns it, whatever your lead says about their confidence?

A related check on a denominator: our briefing on GitGuardian's twice-the-rate claim asks the same question of a different report.

Key facts