Cyberattacks are a significant challenge for organizations of all sizes, but small and medium-sized enterprises (SMEs) face unique cybersecurity threats. Unlike larger companies, they often lack the resources and expertise to implement extensive security measures or manage complex solutions, making them vulnerable targets for malicious actors.
To better understand the security needs and trends of SMEs, Microsoft partnered with Bredin, a company specializing in research and insights on SMEs, to conduct a Security-focused research for companies with 25 to 299 employeesBy sharing the insights below and the initial actions that can be taken to address them, SMEs can find additional best practices for staying secure. CyberSmart Kit Please provide the Portuguese text you would like translated.
- One in three SMEs was a victim of a cyberattack.
With the rise in cyberattacks, SMEs are increasingly affected. Research shows that 31% of SMEs have been victims of cyberattacks such as ransomware, phishing, or data breaches. Despite this, many SMEs still hold misconceptions that increase their risk and vulnerability. Some believe they are too small to be a target for hackers, or assume that compliance equals security. It's crucial to understand that malicious actors pose a threat to businesses of all sizes, and complacency in cybersecurity can lead to significant risks.
How can SMEs address this?
Microsoft, in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cyber Security Alliance (NCA), has outlined four simple recommended practices to build a strong cybersecurity foundation.
- Use strong passwords and consider a password manager.
- Enable multi-factor authentication.
- Learn to recognize and report phishing.
- Make sure your software is up to date.
- Cyberattacks cost SMEs over US$250,000 on average, and up to US$7 million.
Unexpected costs from a cyberattack can be devastating for a small and medium-sized enterprise (SME) and hinder financial recovery. These costs can include expenses incurred for investigation and recovery efforts to resolve the incident, and fines associated with data breaches. Cyberattacks not only present immediate financial strain, but can also have long-term impacts on an SME. Diminished customer trust due to a cyberattack can cause wider reputational damage and lead to lost business opportunities in the future.
Predicting the impact of a cyberattack is difficult because recovery time can vary from a day to over a month. While many SMEs are optimistic about their ability to withstand a cyberattack, some fail to accurately estimate the time needed to restore operations and resume normal business activities.
How can SMEs address this?
SMEs can conduct a cybersecurity risk assessment to understand security gaps and determine steps to resolve them. These assessments can help SMEs identify areas vulnerable to attacks to mitigate them, ensure regulatory compliance, establish incident response plans, and more.
Planning proactively and effectively can help minimize the financial, reputational, and operational costs associated with a cyberattack, should one occur. Many organizations offer self-assessment tools, and working with a security specialist or security service provider can bring additional expertise and guidance throughout the process, as needed.
- 81% SMEs believe that AI increases the need for additional security controls.
The rapid advancement of AI technologies and their ease of use through simple interfaces create significant challenges for SMEs when used by employees. Without the proper tools to protect company data, AI use can lead to sensitive or confidential information falling into the wrong hands. Fortunately, more than half of the companies currently not using AI security tools intend to implement them within the next six months for more advanced protection.
How can SMEs address this?
Data security and governance play a critical role in the successful adoption and use of AI. Data security, which includes labeling and encrypting documents and information, can mitigate the chance of restricted information being referenced in AI prompts. Data governance, or the process of managing, understanding, and protecting data, can help establish a framework for effectively organizing data.
- 94% considers cybersecurity critical to their business.
Recognizing the critical importance of cybersecurity, 94% SMEs consider it essential for their operations. While not always a priority due to limited resources and internal expertise, the increasing cyber threats and sophisticated cyberattacks now pose significant risks to SMEs. Managing work data on personal devices, ransomware, and phishing are cited as the main challenges SMEs are facing.
How can SMEs address this?
For SMEs looking to begin utilizing available resources to train and educate employees, topics related to security in... Cybersecurity 101, Phishing and more are provided through the website. Cybersecurity Awareness of Microsoft.
- Fewer than 30% SMEs manage their internal security internally.
Given the limited resources and expertise within SMEs, many turn to security specialists for assistance. Less than 30% of SMEs manage security internally, and typically rely on security consultants or service providers to manage their protection needs. These professionals provide crucial support in researching, selecting, and implementing cybersecurity solutions, ensuring SMEs are protected against emerging threats.
How can SMEs address this?
Engaging a Managed Service Provider (MSP) is commonly used to supplement internal business operations. MSPs are organizations that help manage broad IT services, including security, and serve as strategic partners to improve efficiency and oversee daily IT activities. Examples of security support may include researching and identifying suitable security solutions for a business based on specific needs and requirements. Furthermore, MSPs can implement and manage the solution by configuring security policies and responding to incidents on behalf of SMEs. This model allows SMEs more time to focus on core business objectives, while MSPs keep the company protected.
- 80% aims to increase its cybersecurity spending, with data protection as the primary investment area.
Given the growing importance of security, 80% of SMEs intend to increase spending on cybersecurity. The main motivators are protection against financial losses and safeguarding customer and consumer data. Unsurprisingly, data protection is the primary area of investment, with 65% of SMEs stating it's where increased spending will be allocated, validating the need for enhanced security with the emergence of AI. Other key spending areas include firewall services, protection against phishing, ransomware, and device protection, access control, and identity management.
How can SMEs address this?
By prioritizing these investments in the areas above, SMEs can improve their security posture and reduce the risk of cyberattacks. Solutions like Data Loss Prevention (DLP) help identify suspicious activities and prevent sensitive data from leaking outside the company. Endpoint Detection and Response (EDR) helps protect devices and defend against threats, and Identity and Access Management (IAM) helps ensure that only the right people have access to the appropriate information.
- 68% SMEs consider secure data access a challenge for remote workers
The transition to hybrid work models has introduced new security challenges for SMEs, and these problems will persist as hybrid work becomes permanent. With 68% of SMEs employing remote or hybrid workers, ensuring secure access for remote employees is increasingly critical. A significant 75% of SMEs are concerned about data loss on personal devices. To protect sensitive information in a hybrid work environment, it is vital to implement security and device management solutions so employees can work securely from anywhere.
How can SMEs address this?
Implement measures to protect data and internet-connected devices, including the immediate installation of software updates, ensuring that mobile applications are downloaded from legitimate app stores, and avoiding sharing credentials via email or text message, only performing this action via real-time phone calls.
Next steps with Microsoft Security
- Read the full report To learn more about how security continues to play an important role for SMEs.
- Get the CyberSmart Kit (in English) to help educate everyone in your organization with cybersecurity awareness resources.
To learn more about Microsoft Security solutions, visit The sitePlease provide the full text you would like translated. "Favorite o" is incomplete and doesn't make sense. Security Blog (in English) to follow specialized coverage on security issues. Also, follow on LinkedInMicrosoft Security) and no X (@MSFTSecurity) for the latest cybersecurity news and updates.