Cybersecurity leaders in the UK are facing a stark reality: managing cyber risk is becoming significantly harder. Not only are threats growing in scale and complexity, but a lack of visibility into digital exposures—both internal and across the supply chain—is compounding the challenge.
These insights come from Bitsight’s 2025 State of Cyber Risk and Exposure report, based on a global survey of 1,000 cyber risk professionals conducted by Sapio Research, including 225 respondents from the UK. The findings underscore a key issue: 89% of UK cybersecurity professionals say their job is more difficult today than it was five years ago.
This isn’t just about volume or velocity of threats—it’s about the clarity and context needed to prioritize what matters most. In this geographic spotlight, we’ll examine highlights from the results of the survey specific to the pool of 225 UK-based respondents.
When asked to identify their top cyber risk challenges, 41% of UK respondents cited the scale and diversity of threats as their primary concern, followed closely by accelerating AI risks and misalignment with business stakeholders. While data breaches and ransomware remain top-of-mind, the broader concern is a lack of actionable insight to inform decision-making.
This growing disconnect between threat awareness and threat prioritization is eroding organizational confidence—and accelerating burnout.
Only 20% of UK organizations rate their cyber risk management practices as “very mature,” while over 1 in 5 admit to being moderately or very immature. Much of this immaturity stems from a lack of exposure visibility: the ability to identify, assess, and act on risk across the digital ecosystem.
Despite recognizing the need for comprehensive risk intelligence—including internal asset visibility, third-party insights, and real-time threat intelligence—many UK organizations still struggle to assemble the full picture. In fact, 1 in 10 report difficulty even discovering most of their assets, and only 20% monitor and map threats on a continuous basis.
This gap doesn’t just impact security outcomes: it affects the wellbeing of cybersecurity teams. Our report found that UK firms are 10 percentage points more likely to report staff burnout compared to the global average. Crucially, the global results showed that companies that use asset monitoring to discover and prioritize exposure mitigation are reportedly 30% less likely to have staff suffering from burnout.
Aside from CVEs, UK companies report that third-party exposures are what their organizations struggle to understand and prioritize the most, above cloud misconfigurations, critical infrastructure exposures, and exposed credentials.
While 43% of UK companies say they continuously monitor all third-party relationships—a higher rate than many global peers—many still struggle to make sense of the data. In today’s post-NIS landscape, continuous monitoring is no longer a competitive edge—it’s a compliance expectation. But without the intelligence to interpret what that data means for the business, it’s just noise. UK security teams need clarity, not complexity, to make confident decisions, and that starts with risk teams turning data into actionable insight.
Continuous monitoring was rated the number one security and risk initiative by the global respondent pool, but in the UK identity and access management and risk assessment topped the list. Continuous monitoring ranks third, while exposure management comes in sixth. Third-party risk management, however, is near the bottom.
This mismatch suggests that while threat awareness is increasing, strategic alignment around exposure visibility is lagging. As adversaries grow more sophisticated, this is a gap UK enterprises can no longer afford.
Which security and risk initiatives do you consider most urgent for the next year (2025)? Select top three |
UK |
Total |
| Identity and access management | 32% | 29% |
| Security and risk assessment | 31% | 30% |
| Continuous monitoring | 29% | 31% |
| Vulnerability management | 28% | 29% |
| Software supply chain security | 26% | 24% |
| Exposure management / attack surface management | 25% | 21% |
| Compliance reporting and auditing | 21% | 18% |
| Endpoint management / endpoint detection and response | 19% | 25% |
| Security training | 19% | 22% |
| Third-party risk management | 19% | 16% |
| Application security | 18% | 16% |
| Incident response planning | 14% | 11% |
Perhaps the clearest indicator of this maturity gap lies in how risk is communicated at the board level. Over half of UK respondents (52%) report struggling to translate technical security data into business risk, far outpacing the global average. An equally common barrier is a lack of cybersecurity fluency among board members themselves.
These communication challenges undermine strategic alignment and weaken support for critical initiatives. To overcome them, organizations need cyber risk intelligence that bridges the gap between security operations and business outcomes.
Improving exposure visibility is not just about identifying more threats—it’s about equipping leaders with the context to act decisively. Cyber risk intelligence, when properly integrated, provides that context. It transforms raw data into prioritized, business-aligned insights that support smarter decisions, faster response, and reduced burnout.
For UK organizations and their global peers, the imperative is clear: move beyond surface-level monitoring and begin to build a comprehensive, context-driven approach to cyber risk.
Read the full 2025 State of Cyber Risk and Exposure report to explore how leading organizations are meeting this challenge—and what steps others can take to follow suit.
report reveals why security leaders are under pressure: AI-driven threats, expanding attack surfaces, and misalignment with business priorities. Based on global survey data, it surfaces the root causes behind today’s risk fatigue—and what mature organizations are doing differently.
