Who Should Pay for Cyber Security?
Published by
James Naylor
on
Would you leave your office unlocked at night? It may sound extreme, but that’s exactly what many UK businesses are doing digitally - leaving systems wide open to cyber criminals.
This blog explains why cybersecurity is no longer just “an IT thing”, but a core business responsibility. Learn what’s legally required in 2025, how much a breach could cost you, and what practical steps you can take now to protect your business
CASE STUDIES | CYBERSECURITY | LATEST NEWS
Who Should Pay for Cybersecurity? Why Every Business Owner Needs to Rethink Responsibility in the Age of Constant Digital Threat
🔐The Big Question: Who Locks the Digital Doors?
Would you leave your office unlocked at night?
It sounds absurd, but every day, UK business owners are leaving digital doors wide open. Cybercrime is no longer just a “big company” problem - it targets businesses of every size, in every sector, and is accelerating each year.
Many leaders still think, “That’s IT’s job.” But today, cybersecurity is a business risk, not just a technical one. Like any major business risk, the ultimate responsibility falls on you, the business owner or director.
Cybersecurity has become a core business cost, as fundamental as utilities, logistics, or insurance. Every business must now account for it as part of delivering value to customers. 💼
💸 The Real Cost of Doing Nothing
Let’s look at the facts:
💼 Average cost of a data breach in the UK: £3.4 million per incident
⏳ Average downtime after a breach: Over 100 days for many businesses
📋 GDPR fines paid by UK businesses in 2023–2024: Over £15.5 million
🚨 Reported cyber-attacks in 2024: Doubled compared to the previous year
And that’s before you count lost clients, reputational damage, and sleepless nights. The ransom might grab headlines, but operational chaos, legal risk, and customer fallout are what truly hurt. 😓
⛔ If you’ve spent years building your reputation, could you afford to lose it in a weekend?
🤔Whose Responsibility Is It, Really?
Outsourcing IT does not outsource accountability.
Think of cybersecurity like health & safety or fire alarms. You can hire professionals, but if something goes wrong, the responsibility still lands on your desk. 📋
🤝Legal obligations: Regulations such as GDPR, NIS2, Cyber Essentials, and ISO 27001 make it your legal duty to keep systems and data safe.
🛡️Cyber insurance: Insurers increasingly require proof of robust digital controls - no controls, no payout.
⚖️Director liability: UK law allows directors to be held personally liable for negligence in cyber risk management.
✅ Cyber Security: No Longer a “Nice to Have”
Modern businesses treat cybersecurity like electricity or water - essential for staying in business. It’s also:
🤝 A trust signal to customers
👩💻 A requirement for many supply chains
🏢 Non-negotiable in regulated industries
What Does “Good Enough” Look Like in 2025?
🔑 Multi-factor authentication (MFA) and strong passwords
💾 Up-to-date, regularly tested backups
👩💻 Employee security awareness training
📊 Regular risk assessments
🛡️ Compliance with frameworks like Cyber Essentials or ISO 27001
These are not “nice-to-haves”, they’re now expected as part of your service, whether clients ask for them or not.
If your business depends on trust, uptime, or compliance, security is already part of what you sell.
Would you ever skip business insurance or fire safety? Don’t skip this. 🚫
💼 Where Does the Cost Land?
Delivering your product or service securely, reliably, and responsibly costs money. Today:
🧰 Enterprise clients demand proof of your cyber credentials
🛡️ Customers expect their data to be protected
📊 Insurers require evidence of digital controls
📑 Regulators hold you accountable for your systems
All of this increases your cost to serve. The shift? Leading businesses now treat security as a built-in part of their offering, not an afterthought.
Like customer service or quality control, cybersecurity is now baked into how you show up for clients.
📈Handled proactively and transparently, security becomes a value signal - not just a cost burden.
🚨Real-World Example: KNP Logistics Group, A Cautionary Tale
In July 2023, KNP Logistics Group, a well-established UK logistics and transport firm, suffered a catastrophic ransomware attack. The attack:
💾 Encrypted core operational systems and rendered critical data inaccessible
⛔ Paralyzed business operations overnight
👩💻 Forced the company and its historic Knights of Old subsidiary into administration
📦 Resulted in hundreds of redundancies and major disruption to clients and supply chains
Key contributing factors:
NP Logistics lacked robust recovery plans and up-to-date backups, making it impossible to restore operations in time.
The attack’s aftermath showed that investing in proactive cybersecurity measures would have cost a fraction of the losses suffered.
🔧 ITbuilder’s Approach: Practical Cyber Protection for Growing Businesses
We work with SMEs every day, helping them stay secure without drowning in jargon or enterprise-level costs. Our approach:
💬 No-nonsense advice focused on business value
📈 Tiered security plans to match your size, risk, and budget
🗺️ Quarterly risk reviews and clear roadmaps to compliance
📞 Free cyber risk score or 15-minute consultation to get started
🤝We help clients see cybersecurity not just as a cost centre, but as part of how they deliver trust, resilience, and continuity to their own customers.
💷 Pricing for Trust
Just as you plan for delivery or compliance overheads, security should be part of your business model.
The difference? It’s about earning and keeping trust.
💡Businesses that build cybersecurity into their pricing aren’t just covering costs - they’re showing clients that protection is part of their promise.
👜 Final Word: You’re Still Holding the Bag
You can’t outsource this. You can delegate the tools, hire great people, and work with a trusted partner.
But the accountability, financial exposure, and business risk still sit with you.
⏳ So, what’s the smarter move - waiting for a crisis, or acting now while you still have options?
Key Takeaways
🛡️Cybersecurity is a business issue, not just an IT one
📏 Regulations, insurance, and client expectations are raising the bar
💸 Prevention is always cheaper (and less painful) than recovery
🛑 You can outsource IT, but you can’t outsource accountability
💾 Your IT guy can’t protect you from boardroom risk - make cyber security a business decision before someone else makes it a crisis
🚨Take Action Now
Don’t wait for a breach. Contact ITbuilder today for managed IT support, cybersecurity, and compliance services.
📞 Book a Free 15-minute Cyber Risk Call now - no jargon, just actionable insight tailored to accountancy firms.
✅ Download our SME Cyber Readiness Checklist
📩 Get in touch or email us at info@itbuilder.co.uk
CASE STUDIES | CYBERSECURITY | LATEST NEWS
References:
IBM Cost of a Data Breach Report 2023
Hiscox Cyber Readiness Report 2024
Gartner Security Budgets 2024
UK Government Cyber Security Breaches Survey 2024
UK Information Commissioner’s Office (ICO) Enforcement Data 2023–2024
UK National Cyber Security Centre (NCSC) Annual Review 2024
GDPR, NIS2, Cyber Essentials, ISO 27001
Hiscox Cyber Insurance Trends 2024
UK Companies Act and FCA Guidance
ENISA, NCSC, and Gartner SME Security Best Practices 2025
BBC News, "KNP Logistics Group collapse: Ransomware attack forced historic transport firm to close," July 2023
UK Parliament, "Cyber resilience and the collapse of KNP Logistics," 2024
James Naylor
James Naylor is ITbuilder's Managing Director and Founder. He has worked in technology since the early nineties and, after a decade in the corporate world, went into business himself.
James has lead ITbuilder for over two decades, building the business into the force that it is today, but is still a technician at heart and still very hands on with tech.
Despite growing up in Hertfordshire, James lived in the Netherlands for five years as well as London, before returning and setting up the base in Hertford, where he lives today.
More articles from James Naylor