Summary

• The ONS found that 21% of businesses with at least ten employees were concerned about cyberattacks affecting supply chains over the next year, up five percentage points from September.
• Concern about artificial intelligence increased from 5% to 12%, the highest level since the relevant survey question began in September 2024.
• International conflict remained the most frequently selected concern at 31%, while 36% of larger businesses reported no concern about the listed disruption factors.

Concern about cyberattacks disrupting supply chains has reached its highest recorded level among UK businesses with at least ten employees, according to new figures showing that technology risks are becoming a more prominent part of companies’ expectations for the coming year.

The Office for National Statistics found that 21% of businesses in this size category were concerned about cyberattacks affecting their supply chains over the next 12 months. The proportion increased from 16% in September 2026 and 12% a year earlier.

Concerns about artificial intelligence also rose, with 12% identifying it as a possible source of supply chain disruption, compared with 5% in September. Both figures are the highest recorded since the ONS introduced these questions in September 2024.

The findings appear in the Business Insights and Conditions Survey published on 5 November, covering responses collected between 19 October and 1 November. They measure anticipated risks rather than the frequency of cyber incidents or evidence that AI systems have already disrupted the businesses surveyed.

Technology joins established supply pressures

International conflict remains the most frequently selected source of concern, cited by 31% of businesses with ten or more employees. Shipping disruption followed at 21%, equal to the proportion concerned about cyberattacks, while 15% identified increased barriers to trade.

Although international conflict remains the leading concern, the longer-term survey results show a broadening range of perceived threats. In September 2024, 57% of larger businesses reported no concern about the listed supply chain factors. That proportion had fallen to 36% by October 2026.

Cyber incidents can interrupt supply chains even where the affected organisation has not suffered a direct compromise. A logistics provider losing access to scheduling software may delay deliveries, while an attack affecting a software supplier can disrupt ordering, stock management, or communications for several customers simultaneously.

Digital dependencies also extend beyond the suppliers named in procurement contracts. A business may deal directly with a distributor or transport operator whose systems rely on a separate cloud platform, communications provider, or managed technology service.

Those indirect relationships can make operational exposure difficult to assess. A supplier may appear commercially independent while depending on infrastructure shared with other organisations in the same supply chain.

However, the ONS figures do not establish whether these dependencies have become more vulnerable. The increase could reflect heightened awareness of cybersecurity problems, changes in business operations, direct experience of disruption, or a combination of factors.

AI concerns rise more sharply

The seven percentage point increase in concern about artificial intelligence was greater than the monthly movement recorded for cyberattacks. Yet the survey does not identify which aspects of AI respondents considered threatening.

Artificial intelligence can influence supply chains through several routes. Businesses increasingly use predictive systems to estimate demand, optimise inventories, support procurement, and coordinate logistics, while attackers may use AI tools to assist phishing, vulnerability discovery, or other malicious activities.

These are different categories of risk. An automated purchasing system could make inappropriate recommendations because of unreliable data or unsuitable assumptions, while a cyberattack could interrupt the infrastructure supporting otherwise legitimate supply chain activities.

The survey’s AI response should therefore not be interpreted as a measure of concern specifically about AI-enabled cyberattacks. Nor does it establish how many businesses have experienced operational problems caused by AI.

Nevertheless, the movement suggests that respondents are increasingly including AI when assessing possible future disruption. Its commercial consequences will depend on how widely these technologies are incorporated into critical workflows and the controls organisations apply to their use.

Automated decisions can affect purchasing volumes, stock availability, delivery planning, and other activities with direct financial consequences. Organisations introducing such systems need ways to identify errors, investigate unexpected outputs, and maintain suitable human control over decisions that could interrupt operations.

The same principle applies where AI is used to support security operations. Automation may improve threat detection and response, but its effectiveness depends on the quality of underlying information, the accuracy of decisions, and the ability to investigate actions taken by the system.

Cost expectations remain significant

Among larger businesses responding about their supply chain concerns, 64% expected sourcing costs to be affected, an increase of nine percentage points from September. Another 60% expected transportation costs to be affected, also nine percentage points higher than the previous month.

The transport figure was 27 percentage points above September 2025, indicating that cost pressures associated with potential disruption remain prominent even where the underlying concerns involve different external events.

These cost expectations cover supply chain disruption broadly. They cannot be attributed specifically to cyberattacks or AI, since respondents were considering several possible causes, including international conflict, shipping difficulties, and trade restrictions.

The relationship between technological disruption and expenditure can nevertheless be substantial. A failed ordering system may force a business to use manual processes, while delayed deliveries can require additional stock, alternative transport arrangements, or changes to production schedules.

Recovering from a supplier’s technology failure may also involve costs that are difficult to recover contractually, particularly where the resulting disruption affects several businesses and services.

At the same time, higher concern does not necessarily imply higher expected financial losses. The ONS survey does not quantify the potential cost of an individual cyber incident or establish the probability of a particular disruption occurring.

Resilience depends on understanding dependencies

Businesses assessing supply chain security need visibility into the systems supporting essential operations. Such assessments can cover ordering platforms, warehouse management, production planning, transport scheduling, and the information exchanged with external suppliers.

Security questionnaires and contractual assurances provide part of that picture, but they may not reveal the consequences of a supplier losing access to a critical application or hosting environment.

Operational recovery planning can identify where alternative arrangements are available and where disruption would be difficult to contain. In some cases, a business may be able to switch transport providers or use manual processes, while a failure affecting specialised industrial software may leave fewer practical options.

Concentration among technology providers also complicates diversification. Two suppliers may appear independent but rely on the same hosting infrastructure, identity service, or communications network.

The ONS classifies the survey results as official statistics in development and advises caution over their interpretation. The survey is voluntary, and estimates can be affected by sampling variation and respondents’ knowledge of their organisations’ expectations.

Its latest results nevertheless establish a measurable change in business sentiment. Concern about cyberattacks has increased by nine percentage points over the past year, while AI-related concern has reached a new survey high. The next publication, scheduled for 19 November, will show whether those movements persist.