When the British Chambers of Commerce start calling crime a “serious barrier” to growth, it’s worth paying attention. That’s not a security consultancy talking its own book; it’s the voice of tens of thousands of UK businesses, and the message is blunt: crime is no longer a background cost. It’s showing up on the balance sheet.
You’re likely feeling some version of this already, whether it’s shrinkage on the shop floor, a phishing email that nearly caught someone out, or simply a nagging sense that the threats your business faces look different than they did three years ago. This guide walks through what’s actually changed in 2026, with a particular look at where static guarding fits into the response.
Physical Crime Is Rising Faster Than Reporting Can Keep Up
According to British Chambers of Commerce research from late 2025, 42% of UK firms experienced some form of crime in the past year. Larger firms are hit hardest, with 58% of businesses with over 250 staff reporting crime, against 32% of micro-businesses, and manufacturing is the worst-affected sector, with half of firms reporting an incident.
Retail has borne a particularly visible share of this. The Metropolitan Police recorded 93,626 shoplifting offences across London in 2024–25, up from 31,008 just four years earlier, a rise of more than 200%. Nationally, offences passed 530,000 in the year to September 2025. There are early signs the trend may be turning, with a small year-on-year drop most recently and a sharp rise in charges and cautions, but the baseline remains far higher than it was.
Violence against staff tells a similarly mixed story. The British Retail Consortium’s 2026 Crime Report recorded around 1,600 incidents of violence and abuse against shopworkers per day, a genuine improvement on the roughly 2,000 a day reported the previous year, but still nearly four times the pre-pandemic level of 455 a day. Progress is real, but the underlying picture is still far from settled.
This is where a visible, trained presence earns its keep. A security guarding course-qualified officer at the door does two jobs at once: deterring casual theft before it starts, and giving staff someone to escalate to when a situation turns confrontational, rather than having to intervene themselves.
Cyber Threats Haven’t Slowed Down; They’ve Just Become Routine
The Department for Science, Innovation and Technology’s Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses reported a breach or attack in the past year, rising to 65% among medium businesses and 69% among large ones. Phishing remains overwhelmingly the most common route in, cited by 38% of businesses, and among firms that were breached, phishing was involved in the large majority of cases.
The financial picture is harder to pin down than headlines suggest. Most individual incidents cost businesses relatively little; the government survey puts the median cost near zero for most firms, but a small share of organisations face genuinely serious losses. KPMG’s widely cited estimate puts the annual cost of significant cyber-attacks to the UK economy at around £14.7 billion, and recent incidents at Marks & Spencer, Co-op and Jaguar Land Rover show how fast a cyber event escalates into an operational and reputational crisis, not just a data problem.
It’s worth being straightforward about something here: static guarding doesn’t stop a phishing email. What it does is protect the physical infrastructure, server rooms, comms cabinets, and access-controlled areas that a lot of cyber resilience quietly depends on. A compromised access reader or an unattended server room is a physical security failure with a cyber consequence, and it’s exactly the kind of thing a trained guard is positioned to notice that a firewall isn’t.
Physical and Digital Security Are No Longer Separate Conversations
Modern buildings run cameras, door controllers, intercoms and sensors on the same network as everything else, which means a compromised camera or access panel isn’t just a physical security issue anymore; it’s a way into the wider network. Ageing kit that’s never had a firmware update, factory-default passwords left in place, and inconsistent network segmentation are the kind of everyday oversights attackers actively look for.
This is genuinely one of the more overlooked risks we come across. We’ve reviewed sites where the access control system itself the thing installed to improve security was running years out of date and still using its default login. A well-briefed static guard trained to notice tampering, an unfamiliar device, or an unlocked comms cabinet is a cheap, human layer of defence against exactly this kind of gap.
Regulation Is Catching Up, and Retail Workers Are Getting Specific Legal Protection
The Cyber Security and Resilience Bill, introduced to Parliament in November 2025, will require organisations in scope to report harmful cyber breaches within 24 hours, with a full report due within 72 hours. It’s still working through Parliament, so details may shift, but the direction faster reporting, tighter obligations is clear.
On the physical side, the Crime and Policing Act 2026 is introducing a specific offence of assaulting a retail worker in England and Wales, removing the previous £200 threshold that had deprioritised lower-value shop theft. Both point the same way: businesses that treat security as a box-ticking exercise are going to find that box getting harder to tick.
Budget Pressure Makes the Cost of Inaction Look Different
Inflation and rising costs remain the top-ranked concern for many UK business leaders, ahead of cyber risk in several recent surveys, which makes security spend an easy target when budgets tighten. But the maths often runs the other way. Retailers have collectively spent close to £5.5 billion on security measures over the past five years, and the BRC’s own data suggests that investment is a meaningful part of why violence and abuse figures have started to fall. The cost of a guard is visible and immediate; the cost of stock loss, staff turnover, and rising premiums is quieter and easier to underestimate until it isn’t.
Police Response Times Are Part of Why Private Security Is Growing
In a few reported cases, retailers provide CCTV evidence, and in many cases, there is an inconsistent police response, leaving retailers to deal with incidents on their own. This disparity has resulted in a constant growth in the demand for private security such as static guards, mobile patrols and CCTV operators, especially in distribution, retail and hospitality. It is not a substitute for policing, but it fills a need for service.
Rising physical crime, sustained cyber breach rates, the blurring line between physical and digital security systems, new regulatory reporting requirements, and budget pressure that makes security spend harder to justify even as risk grows.
42% of UK firms reported experiencing some form of crime in the past year, according to British Chambers of Commerce research, with larger firms and manufacturers most affected.
Both, depending on the measure. Shoplifting offences have risen sharply over the past five years, but violence and abuse against shopworkers has actually fallen from around 2,000 to 1,600 incidents a day year on year, real progress, even though levels remain well above pre-pandemic norms.
Once in force, organisations in scope will need to report harmful cyber breaches within 24 hours and provide a full report within 72 hours. It was introduced to Parliament in November 2025 and is still progressing through the legislative process.
Indirectly, yes. Guards can’t stop a phishing email, but they protect the physical infrastructure server rooms, access panels, network cabinets that cyber resilience often depends on, and can spot tampering that software alone won’t catch.
Largely because of inconsistent police response times and low CCTV evidence submission rates, which have left many businesses managing incidents themselves. Static guards, mobile patrols and CCTV operators help fill that gap.
Where This Leaves You
The security challenges of 2026 aren’t really new categories of risk; they’re familiar risks converging faster than most security arrangements were built to handle. Physical crime, cyber exposure, and regulatory obligations are no longer separate line items you can manage in isolation. A trained, visible presence, backed by staff who understand both the physical and digital sides of your risk, is one of the more direct ways to close that gap.
If it’s been a while since you reviewed your security arrangements against where the risks actually sit today, now’s a reasonable time to do it.