Published on October 7, the 2026 Hiscox Cyber Readiness Report describes a shift from prevention towards resilience: preparing for an attack, responding to it and continuing operations through disruption. In the survey, 29% of the organisations questioned said they had experienced at least one successful cyber attack in the previous 12 months.
The findings come from a June survey of 6,800 cybersecurity decision-makers working at organisations with fewer than 250 employees in eight European countries, the UK and the US. They are not a measure of French small businesses specifically. Hiscox also says the 2017 and 2026 results are not directly comparable because the scope and methodology changed. A 2025 French survey by Cybermalveillance.gouv.fr, conducted among 588 businesses with fewer than 250 employees and representative of that population, speaks more directly to the need: 80% of respondents said they were unprepared for attacks or did not know whether they were, and 58% said they could not assess their consequences. For a small business, the practical question is how work would continue if an essential service stopped working.
From prevention to the ability to keep operating
Firewalls, multi-factor authentication and up-to-date software reduce some risks, but they do not answer every question that comes up during an incident. Who tells customers if email is unavailable? Who can reach the hosting provider or IT supplier? Which activity needs to restart first? Where are the contact details and access information if the usual computer will not start?
The Hiscox report presents resilience as a responsibility involving technology, governance, training and processes. This aligns with small-business guidance: ANSSI recommends preparing for incident response and recovery, while Cybermalveillance.gouv.fr now offers a MalletteCyber Pro to support smaller organisations. Resilience is therefore neither a single tool nor a promise that incidents will not happen.
What the figures show, and what they do not
Alongside the 29% of organisations reporting a successful attack, the report puts average operational disruption at 32.8 hours and the average annual cost of incidents at $52,602 in its sample. These are international averages reported by Hiscox, not a forecast of cost or downtime for any particular French business.
The 2025 French survey identifies a more directly actionable gap: 80% of the surveyed small businesses said they were unprepared for an attack or did not know whether they were, and 58% said they could not assess its consequences. The survey covered 588 businesses with fewer than 250 employees and was representative of that population. These answers do not mean all of those businesses experienced an incident; they point to the value of understanding possible impacts and decisions before an incident occurs.
The report also says 64% of surveyed organisations have cyber insurance and 32% link executive performance or pay to cybersecurity results. These indicators show cybersecurity becoming part of business management; by themselves, they do not prove that an organisation is ready to resume operations. To assess readiness, teams need to test roles, dependencies and procedures.
A 30-minute exercise to find the gaps
Choose a plausible, limited scenario, such as: “Business email is unavailable this morning and the usual administrator cannot be reached.” Bring together the person who makes decisions, the person responsible for IT and an operations lead. Without changing any systems, work through these questions:
- Which activity must continue today, and what can wait?
- How will you reach colleagues, customers or suppliers without the affected email system?
- Who contacts the provider, insurer or incident-response specialist, and where are their details?
- Which accounts can restore the service, who is allowed to use them, and how would you revoke a compromised login?
- Which data or backups are needed, and has anyone confirmed they can be restored?
Record each unanswered question with an owner and a due date. Do not test a production restore or revoke an account without an appropriate procedure: the exercise is first meant to expose decisions and dependencies that still have no answer. The ANSSI small-business guide describes preparation measures and available assistance.
Prepare the access that matters
Recovery can depend on a few important accounts: administrative email, hosting, domain registrar, accounting, backups or a supplier console. For each one, identify an owner, authorised users, authentication method, recovery process and incident contact. Also plan how to replace a secret after a compromise without sending it through a channel that may no longer be trustworthy.
A password vault helps keep credentials distinct and lets a team find the access details it needs. It does not replace named accounts where a service supports them, multi-factor authentication, backups or an incident-response process. For this part of the work, see Soclyde’s small-business password policy guide and guide to sharing passwords with a team.
How Soclyde fits in
Soclyde focuses on password and access management: its encrypted vault stays on authorised devices, and direct synchronisation between authorised devices is a Premium feature. This can help a team organise the secrets needed for its services and reduce their spread across documents or messages.
Soclyde does not monitor systems, restore backups or run a company’s continuity process. Those responsibilities remain with the business and its providers. A password manager is one part of preparation, not a recovery solution on its own.
Takeaway
The Hiscox report brings one practical question back into focus: how will work continue when an incident disrupts the tools people rely on? Its figures provide international context, with comparison limits that should remain clear. To act, choose a simple scenario, involve the people who will need to make decisions, record the gaps and assign each follow-up to an owner.
To start with access management, read Soclyde’s small-business password policy guide. For a broader look at cybersecurity responsibilities and measures, see the Soclyde guide to NIS2.
