Cybersecurity risk explained for A-Level Business

Short answer: cybersecurity risk is the chance that a cyber attack or data breach damages a business, for example by stopping sales, leaking customer data or causing fines. For A-Level Business 7138 it is one of six types of business risk, with financial, strategic, operational, compliance and reputational risk. You must judge which cybersecurity measures are worth their cost.

What the 7138 specification asks

Section 3.3.4 covers managing change, and it is examined on Paper 3. It is in the full A-level only, not the AS. It asks you to know the types of risk a business faces, including cybersecurity risk, and how to manage risk, including cybersecurity measures [1]. It also asks how firms manage uncertainty, for example through scenario planning [1].

Cybersecurity risk is new. It does not appear in the old 7132 course. For the wider changes, read AQA A-Level Business is changing.

Risk or uncertainty?

The economist Frank Knight set out the difference in 1921 [2]. Risk can be measured: you can put a rough probability on it from past data. Uncertainty cannot be measured, because the event is new or unique [2].

This matters for managers. A risk can be priced, insured and planned for. Uncertainty needs flexible plans instead, such as scenario planning (preparing for several possible futures). Cyber attacks sit on the line between the two. A survey can tell a firm how likely an attack is. It cannot tell the firm when it will come, or how much it will cost.

The six types of business risk

The key exam point: cybersecurity risk rarely stays in its own box. One attack can stop operations, cut cash flow, damage the brand and trigger legal problems at the same time. Use that chain in your answers.

How common is cybersecurity risk in the UK?

The UK government's Cyber Security Breaches Survey 2025 was published on 10 April 2025, with fieldwork from August to December 2024 [3]. It found that 43% of UK businesses, about 612,000 firms, identified a breach or attack in the previous 12 months [3]. The figure rose to 67% of medium businesses and 74% of large ones [3].

Phishing (fake emails or messages that trick staff into giving away passwords) was the most common type. It affected 85% of the businesses that reported a breach [3]. So people are often the weak point, not only the technology. A newer 2025/26 edition was published on 30 April 2026 [9].

Three UK cyber attacks in 2025

Marks & Spencer (M&S). M&S was hit by what it called a "sophisticated cyber incident" in April 2025 [5]. It paused online ordering from late April to early June [5]. On 21 May 2025 it estimated a cost of around £300m to 2025/26 operating profit, before savings and insurance [4]. Its half-year results on 5 November 2025 showed £101.6m of one-off costs, with about £136m expected in total, and £100.0m of insurance income [5]. In that half year, online sales of clothing, home and beauty fell 42.9% [5].

Co-operative Group. The Co-op, a consumer co-operative (read co-operatives explained), restricted its own systems in 2025 to contain an attack [6]. In its trading update on 26 March 2026, it estimated the attack cut revenue by £285m and profit by £107m [6]. Of that, £86m was lost margin and £21m was one-off costs. The Group made an underlying operating loss of £35m for 2025 [6].

Jaguar Land Rover (JLR). JLR announced a cyber incident on 2 September 2025 and shut down its global systems [7]. Production paused, and a phased restart began on 8 October 2025 [7]. JLR booked £196m of one-off cyber costs in the three months to 30 September 2025 [7]. It also fast-tracked a £500m financing scheme so that its suppliers could be paid [7]. So cyber risk spreads through a supply chain.

Notice the pattern. The M&S estimate changed as facts came in. That is uncertainty at work: nobody could measure the full cost on day one.

Cybersecurity measures to manage risk

Firms can cut the chance of an attack, cut the damage, or pass some cost to an insurer. The main measures are:

• Cyber Essentials. A scheme from the NCSC (National Cyber Security Centre, the UK's cyber security agency). The NCSC calls it the government's recommended "minimum standard of cyber security" [8]. It covers five controls: firewalls, secure configuration, security updates, user access control and malware protection [8]. Cyber Essentials Plus adds independent technical testing [8].
• Staff training. Because phishing is so common, training staff to spot fake messages targets the main threat [3].
• Incident response plan. A written plan for what to do in an attack. 75% of large businesses had one, but only 53% of medium ones [3].
• Cyber insurance. This passes part of the cost to an insurer. 45% of businesses had some cover [3]. M&S received £100.0m of insurance income [5].
• Supplier checks. Only 14% of businesses reviewed the cyber risks from their immediate suppliers [3].

Take-up is low. Only 12% of businesses had heard of Cyber Essentials, and 3% held it, rising to 21% of large firms [3]. That is a strong evaluation point: the measures exist, but many firms judge the cost too high until an attack happens.

Exam application

Practice question, in our own words: A UK clothing retailer makes 30% of its sales online. Assess whether it should spend heavily on cybersecurity measures. (9 marks)

Notice the structure. The analysis is one chain joined by "because" and "so", with a real figure. The evaluation weighs a certain cost against an uncertain loss, then says what the answer depends on.