That’s a really good question and one that’s very difficult to pin down.  There are studies galore, mostly from the cyber security industry, and you might feel a little sceptical about those, but also from Governmental sources, which you might consider hold more weight.  Fear, Uncertainty and Doubt, known as FUD, permeates the airwaves about this and it can be a bit of a nightmare separating fact from exaggeration.  And I get that, I really do.

Aviva, not of course a cyber security company but who nonetheless do sell insurance, carried out some research reported in December 2023, which seems, on the fact of it, to be a little more realistic.  They have said that one in five UK businesses have experienced a cyber-attack or incident, with nearly one in 10 (9%) small businesses experiencing this in the last year. This number rises to 35% of large corporate businesses, showing the increasing risk that cyber presents.  But even this has some problems in that it depends on how many businesses reported such an attack or incident.  There is other research that suggests that many businesses, especially SMEs, keep such things well under wraps.

That’s a really good question and one that’s very difficult to pin down.  There are studies galore, mostly from the cyber security industry, and you might feel a little sceptical about those, but also from Governmental sources, which you might consider hold more weight.  Fear, Uncertainty and Doubt, known as FUD, permeates the airwaves about this and it can be a bit of a nightmare separating fact from exaggeration.  And I get that, I really do.

Small Business Cyber Attack Statistics 2024 (And What You Can Do About Them) says that SMEs account for 43% of cyber-attacks annually, of which 46% were SMEs with 1,000 or fewer employees.

In the 2023 Not (Cyber) Safe for Work Report, there are some alarming statistics.  A staggering 97% of executives use personal devices to access work accounts, and 74% frequently send work-related emails and texts from these devices.  Behaviour which significantly increases the vulnerability of SMEs to cyber-attacks, putting not just operations at risk but also sensitive employee and customer data.

SMEs are often repositories of a considerable amount of personal and financial information, making them lucrative targets for cyber criminals.  The report further indicates that one in three respondents has fallen victim to data theft via scams.  A single can result in identify theft, financial loss, and severe reputational damage.

This is a suggested list of the top 10 Cybersecurity Threats:

• Social Engineering (often a precursor to Phishing).
• Third-Party Exposure.
• Configuration Mistakes.
• Poor Cyber Awareness and Practice.
• Cloud Vulnerabilities.
• Mobile Device Vulnerabilities.
• Internet of Things.
• Ransomware.

Given that many SMEs have now adopted the hybrid working style since COVID, these are not particularly surprising.  Working remotely isolates employees who can be much more easily panicked into doing things that are unsafe, than if they have someone on hand, in the office, they can turn to for advice.  For example, Phishing.  Should I click this, does look a bit iffy?  I’ll ask Fred and see what he thinks.  As opposed to sitting at home, working to a deadline, and getting pressured by well-crafted Phishing emails, and thinking, I’ll just do it, what’s the worst that can happen?

One of the major problems facing all sizes of business is the lack of cyber security skills available for hire, either as an FTE or a contractor.  Shockingly, In September 2023, 50% of all UK businesses had a basic cybersecurity skills gap, while 33% have an advanced cybersecurity skills gap. These figures are consistent with those from 2022 and 2021, highlighting the persistent skills gap issue.

We talked a little bit above, about people using their devices.  This isn’t necessary a major issue, providing the individual is prepared to adhere to some security controls being placed on that device, if it is to be used for work.  It’s a bit of a balancing act.  It is reported that 80% of employees are uncomfortable with the idea of their personal devices being monitored by their companies, yet 73% would consent to having cyber security software installed on their devices.  So, a balanced approach is needed, which respects individual privacy while ensure collective security.  Not easy.

Here are 5 actionable steps we are recommending SMEs take:

• Employee cyber awareness training.  Probably the biggest and cheapest quick win any SME can and should be taking.

• Strong access control using multi factor authentication.  This should be a no brainer.

• Cyber Security audits and monitoring.  Not easy for many SMEs who will be put off by thinking about costs.  However, this has become much more affordable, and all SMEs should be having conversations around this.

• Encryption.  Again, becoming much more affordable and easier to use.  If your sensitive data is encrypted, the chances of falling foul of data protection becomes much less of an issue.

• Supply chain security.  Many SMEs are in the supply chains of the bigger companies, often utilising online processes, connecting direct to the customer.  What would happen if a cyber-criminal gained access to a customer of yours, through your systems?

There is no silver bullet for this.  First and foremost, it must be recognised as a business issue, not an IT issue.  It must be owned from the top, and dealt with by the board, as they would any other business issue.  You can outsource your IT management, but you can’t outsource your responsibility.