Or as it’s known amongst cyber security sales teams, FUD.  It’s a tried and tested method of trying to hook new sales and is often used by sales teams at, shall we say, a slightly lower level than the top end enterprise sales teams who, like me, don’t like it and stay shy of it.

OK, so now I’ve established my ethical credentials, how do I let my clients and potential clients, know what the threats are and how vulnerable to them, they are.  There’s a fine line between FUD and education.  People don’t need to be scared into doing things, they need to be educated into it and they have every right to know what the threat landscape looks like, and how vulnerable they are to it.

What’s the Threat in 2025?

It is expected that in 2025, organisations can expect to face a variety of cyber threats, including AI-powered attacks (see https://hah2.co.uk/?s=Artificial+Intelligence), ransomware with complex extortion tactics (https://hah2.co.uk/?s=Ransomware), supply chain attacks (https://hah2.co.uk/?s=Supply+Chain), vulnerabilities in IoT and 5G networks, and the rise of deepfake technology. Cybercriminals are leveraging AI to automate attacks, develop advanced malware, and bypass traditional security measures. Additionally, ransomware attacks are becoming more sophisticated, with some now stealing data alongside encryption, increasing the pressure on victims to pay. Supply chain vulnerabilities are also a major concern, as attackers can target third-party vendors to gain access to larger networks. The increasing number of IoT devices (see https://hah2.co.uk/?s=IOT) many of which lack robust security, also presents a significant challenge, as they can be easily exploited for attacks that disrupt critical infrastructure. Deepfake technology is also becoming more accessible, making it easier for attackers to create realistic fake content for various malicious purposes. 

How Does This Impact SMEs?

So where do SMEs sit in this space?  There is still the perception amongst them that they are too small to be worth attacking, that the rewards for the cybercriminals aren’t enough and they won’t bother.  Well, let’s debunk that.  SMEs are seen as low hanging fruit.  They will have much smaller budgets than the bigger players, they will almost certainly outsource their IT and as I’ve said often, you can outsource your IT, but not your responsibility.  There is a dearth of cyber security expertise, not just within the SMEs themselves, but also amongst the IT outsourcers they use.

In 2025, it is anticipated that SMEs will face evolving cyber threats, including AI-powered phishing, ransomware, and supply chain vulnerabilities, along with insider threats and IoT exploits. AI is going to have a very real impact on the attacks designed against SMEs.  Why?  Because AI provides automation, and automation is the key to making real money when attacking SMEs.  Think it through.  If a criminal organisation can attack hundreds, if not thousands of targets using one automated attack, with an expectation of say 50% success, with extremely little effort using AI, then that’s good business for them.  AI-driven attacks are predicted to be a top concern, with sophisticated phishing campaigns and deepfake fraud attempts on the rise. Ransomware continues to pose a significant risk, especially for SMEs with limited cybersecurity resources. 

Supply Chain Security

Supply chain vulnerabilities are also a growing concern, as hackers can exploit connections with external vendors to breach multiple businesses.  This latter should be a very real concern for any SME that is in the supply chain of a major organisation.  Just imagine the consequences for that SME if their customer is attacked, losing money and reputation, and can pinpoint the attack as coming via the SME.  How would that impact the SME?  Well, the financial and reputational consequences would probably kill their business.

Ramsac, in their 2025 SME threat report, tells us that a mid-sized UK logistics company fell victim to a ransomware attack in June 2023. They infiltrated the company’s network and left a note on screens: “If you’re reading this, it means the internal infrastructure of your company is fully or partially dead.” The attackers had encrypted the firm’s files and threatened to leak confidential data, essentially holding the business hostage.  They also reported that a large retail breach occurred when attackers compromised a small HVAC subcontractor (with far weaker IT security) and used those credentials to penetrate the larger corporate network. That attack led to the theft of millions of customer card details and tens of millions of dollars in damages – all traced back to a third-party SME vendor being hacked via a phishing email.

In Summary

We published a piece recently about cyber security and the SME and rather than repeat it here, we’ll simply give you the link – https://hah2.co.uk/cyber-security-and-the-sme/.  It reiterates some of my hobby horses, chief amongst them being cyber awareness training.  I’ve said before, but it bears repeating, that your staff are your first line of defence and are either your greatest asset, or your greatest risk.  The actions you take as an owner/director/manager, will decide which.

SMEs are facing increased pressures on their resources and the temptation to park cyber security until times are better, increases alongside those pressures, but avoid complacency, let’s discuss what you might be able to do procedurally and at low cost. If you have invested in tech, is it the right tech and is it doing what you think it’s doing? That’s never a given.