SME Cybersecurity: What Radware’s 111% Web DDoS Surge Means for UK Businesses
Radware recorded a 110.6% increase in mitigated Web DDoS attacks in H1 2026 compared with H1 2025. For UK SMEs, the priority is protecting online trading and customer access, not buying enterprise tools by default. Check hosting protection, secure critical website functions, and rehearse a simple outage response. The report’s global figures require careful interpretation.
Radware recorded more than twice as many mitigated Web DDoS attacks in the first half of 2026 as a year earlier, a warning for UK SMEs whose sales, bookings or customer services depend on an available website.
Its H1 2026 Global Threat Analysis Report puts the increase at 110.6% against H1 2025, rounded to 111% in the detailed analysis. The practical question is whether your business can keep serving customers when automated traffic overwhelms its online services.
SME Cybersecurity: understanding the Web DDoS surge
The figures indicate rising pressure on websites, but understanding what Radware measured matters before making spending decisions.
What is a Web DDoS attack?
A distributed denial-of-service attack, or DDoS, uses multiple sources to overwhelm a service. Web DDoS targets website or application functions, such as searches, logins and checkout pages, rather than simply filling an internet connection.
Automated requests can resemble genuine visitors while exhausting the server’s processing capacity. A small retailer might lose orders even when its homepage still loads, because checkout no longer responds.
The National Cyber Security Centre (NCSC) explains that successful denial-of-service attacks can disrupt business-critical functions without stealing or changing data. Availability is therefore a Cybersecurity issue, not just a hosting inconvenience.
What does Radware’s evidence establish?
Radware reports these findings in the supplied PDF, pages 5 and 13 to 15:
110.6% growth in mitigated Web DDoS attacks against H1 2025.
36.3% growth against the second half of 2025.
55.3% of observed Web DDoS activity targeting Europe, the Middle East and Africa.
These are provider observations, not a representative survey of UK SMEs. Appendix 2 states that Web DDoS details came from incidents handled through Radware’s protection service. The report does not establish that individual UK businesses became 111% more likely to suffer an outage, nor does it measure successful disruption across the wider market.
One projection also needs correcting. If H1 activity equals approximately 83% of 2025’s total, repeating it in H2 produces approximately 166% of the previous annual total, or 66% growth, not the report’s stated 166% increase. The observed half-year comparison remains the stronger headline.
Why does this matter for UK SMEs?
The business impact depends on what your website does and how quickly someone can intervene.
Could a small business suffer without being the intended target?
Shared hosting, outsourced booking systems and customer portals create supply chain cyber risk: disruption at a provider can affect your business even when attackers target someone else.
Radware separately recorded 285 hacktivist DDoS claims against UK targets in H1 2026, representing 6.1% of recorded claims, on page 32. These are public claims, not proof of sustained downtime, and should not be confused with the Web DDoS mitigation figures.
For an accountancy practice, an unavailable document portal could delay client submissions. An independent hotel could lose direct bookings. Identify those dependencies and establish alternative contact routes before disruption occurs.
Why are ordinary website protections sometimes insufficient?
A web application firewall, or WAF, filters requests for suspicious behaviour. However, a WAF’s presence does not automatically mean that effective Web DDoS mitigation is enabled.
Likewise, Cyber Essentials provides five baseline technical controls against common internet threats. It is valuable, but certification is not a guarantee of website availability. Treat DDoS protection as an additional continuity requirement, not a replacement for those controls.
