Cyberattacks are a significant challenge for organizations of all sizes, but small and medium-sized enterprises (SMEs) face distinct threats when it comes to cybersecurity. Unlike larger companies, they often lack the resources and expertise to implement extensive security measures or manage complex solutions, making them targets for malicious actors.

To better understand the security needs and trends of SMEs, Microsoft partnered with Bredin, a company specializing in research and insights on SMEs, to conduct a Security research focused on businesses with 25 to 299 employeesBy sharing the insights below and initial actions that can be taken to address them, SMEs can find additional best practices for staying safe in CyberSmart Kit Please provide the text you would like translated from Portuguese to English.

1. One in three SMEs was a victim of a cyberattack.

With the increase in cyberattacks, SMEs are increasingly affected. Research shows that 31% of SMEs have been victims of cyberattacks, such as ransomware, phishing, or data breaches. Despite this, many SMEs still hold misconceptions that increase their risk and vulnerability. Some believe they are too small to be targets for hackers or assume that compliance equals security. It's crucial to understand that malicious actors pose a threat to companies of all sizes, and complacency in cybersecurity can lead to significant risks.

How can SMEs address this?

Microsoft, in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cyber Security Alliance (NCA), outlined four simple best practices to create a strong cybersecurity foundation.

• Use strong passwords and consider a password manager.
• Enable multi-factor authentication.
• Learn to recognize and report phishing.
• Make sure your software is up to date.

2. Cyberattacks cost SMEs over US$250,000 on average, and up to US$7 million.

Unexpected costs from a cyberattack can be devastating for a small and medium-sized enterprise (SME) and hinder its financial recovery. These costs may include expenses incurred for investigation and recovery efforts to resolve the incident, as well as fines associated with data breaches. Cyberattacks not only present an immediate financial strain but can also have long-term impacts on an SME. Diminished customer trust due to a cyberattack can cause broader reputational damage and lead to missed business opportunities in the future.

Predicting the impact of a cyberattack is difficult because recovery time can vary from a day to more than a month. While many SMEs are optimistic about their resilience to cyberattacks, some fail to accurately estimate the time needed to restore operations and resume normal business activities.

How can SMEs address this?

SMEs can conduct a cybersecurity risk assessment to understand security gaps and determine steps to resolve them. These assessments can help SMEs identify vulnerabilities to mitigate them, ensure regulatory compliance, establish incident response plans, and more.

Proactive and effective planning can help minimize the financial, reputational, and operational costs associated with a cyberattack, should one occur. Many organizations provide self-assessment tools, and working with a security specialist or security service provider can bring additional expertise and guidance as needed throughout the process.

3. 81% SMEs believe that AI increases the need for additional security controls.

The rapid advancement of AI technologies and their ease of use through simple interfaces creates significant challenges for SMEs when used by employees. Without the proper tools to protect company data, AI usage can lead to sensitive or confidential information falling into the wrong hands. Fortunately, more than half of the companies currently not using AI security tools intend to implement them within the next six months for more advanced protection.

How can SMEs address this?

Data security and governance play a critical role in the successful adoption and use of AI. Data security, which includes labeling and encrypting documents and information, can mitigate the chance of restricted information being referenced in AI prompts. Data governance, or the process of managing, understanding, and protecting data, can help establish a framework for effectively organizing data.

4. 94% considers cybersecurity critical to their business.

Recognizing the critical importance of cybersecurity, 94% SMEs consider it essential for their operations. While not always prioritized due to limited resources and internal expertise, the rising tide of cyber threats and increasing sophistication of cyberattacks now represent significant risks for SMEs. Managing work data on personal devices, ransomware, and phishing are cited as the primary challenges SMEs are facing.

How can SMEs address this?

For SMEs looking to start leveraging available resources to train and educate employees, safety topics in...  Cybersecurity 101, Phishing and more are provided through the website Cybersecurity Awareness of Microsoft.

5. Fewer than 30% SMEs manage their internal security.

Given the limited resources and expertise within SMEs, many turn to security specialists for assistance. Less than 30% of SMEs manage security internally and typically rely on security consultants or service providers to manage their protection needs. These professionals provide crucial support in researching, selecting, and implementing cybersecurity solutions, ensuring SMEs are protected against emerging threats.

How can SMEs address this?

Engaging a Managed Service Provider (MSP) is commonly used to complement internal business operations. MSPs are organizations that help manage broad IT services, including security, and serve as strategic partners to improve efficiency and oversee daily IT activities. Examples of security support might include researching and identifying suitable security solutions for a business based on specific needs and requirements. Furthermore, MSPs can implement and manage the solution, configuring security policies and responding to incidents on behalf of SMEs. This model allows SMEs more time to focus on core business objectives, while MSPs keep the company protected.

6. 80% intends to increase its cybersecurity spending, with data protection as the primary investment area.

Given the growing importance of security, 80% of SMEs intend to increase cybersecurity spending. The main drivers are protecting against financial losses and safeguarding customer and consumer data. Unsurprisingly, data protection is the primary area of investment, with 65% of SMEs saying this is where increased spending will be allocated, validating the need for additional security with the emergence of AI. Other key areas of spending include firewall services, protection against phishing, ransomware, and device protection, access control, and identity management.

How can SMEs address this?

By prioritizing these investments in the areas mentioned above, SMEs can improve their security posture and reduce the risk of cyberattacks. Solutions like Data Loss Prevention (DLP) help identify suspicious activities and prevent sensitive data from leaving the company. Endpoint Detection and Response (EDR) solutions help protect devices and defend against threats, and Identity and Access Management (IAM) solutions help ensure that only the right people have access to the appropriate information.

7. 68% SMEs consider secure data access a challenge for remote workers.

The transition to hybrid work models has introduced new security challenges for SMEs, and these problems will persist as hybrid work becomes permanent. With 68% of SMEs employing remote or hybrid workers, ensuring secure access for remote employees is increasingly critical. A significant 75% of SMEs are concerned about data loss on personal devices. To protect sensitive information in a hybrid work environment, it is vital to implement security and device management solutions so employees can work securely from anywhere.

How can SMEs address this?

Implement measures to protect data and internet-connected devices, including the immediate installation of software updates, ensuring mobile applications are downloaded from legitimate app stores, and avoiding sharing credentials via email or text message, only doing so via real-time phone calls.

Next steps with Microsoft Security

• Read the full report To learn more about how security continues to play a crucial role for SMEs.
• Get the CyberSmart Kit (in English) to help educate everyone in your organization with cybersecurity awareness resources.

To learn more about Microsoft Security solutions, visit The sitePlease provide the full text you would like translated. ". Favorite o" is incomplete and doesn't make sense. Security Blog to follow specialized coverage on security issues. Also, follow on LinkedIn (Microsoft Security) and no X (@MSFTSecurityFor the latest cybersecurity news and updates.