Cyberattacks are a major challenge for organizations of all sizes, but small and medium-sized enterprises (SMEs) face distinct threats when it comes to cybersecurity.Unlike large enterprises, they often lack the resources and expertise to implement extensive security measures or manage complex solutions, making them targets for malicious actors.
To help us better understand the security needs and trends of SMBs, Microsoft partnered with Bredin, a company that specializes in research and insights into SMBs, to drive a security-focused research for companies with 25 to 299 employeesby sharing the insights below and the initial actions that can be taken to address them, SMEs can find additional best practices to stay safe in the industry Cybersmart Kit Be (in english).
- One in three SMEs has been the victim of a cyberattack
With the rise of cyberattacks, SMEs are increasingly affected.Research shows that 31% of SMEs have been victims of cyberattacks such as ransomware, phishing or data breaches. Despite this, many SMEs still maintain misconceptions that increase their risk and vulnerability. Some believe they are too small to be targeted by hackers or assume that compliance equals security.It is crucial to understand that malicious actors pose a threat to businesses of all sizes, and cybersecurity complacency can lead to significant risks.
How can SMEs address this?
Microsoft, in collaboration with the Cyber Security and Infrastructure Agency (CISA) and the National Cybersecurity Alliance (NCA), outlined four simple best practices for building a strong cybersecurity foundation: security
- Use strong passwords and consider a password manager.
- Enable multi-factor authentication.
- Learn to recognize and report phishing.
- Make sure you keep your software up to date.
- Cyberattacks cost SMEs more than 250 thousand dollars on average and up to US$ 7 million
The unexpected costs of a cyberattack can be devastating for an SME and make financial recovery difficult. These costs can include expenses incurred for investigation and recovery efforts to resolve the incident and fines associated with the data breach. Cyberattacks not only present immediate financial strain, but can also have long-term impacts on an SME. Diminished customer confidence due to a cyberattack can cause wider reputational damage and lead to lost business opportunities in the future.
It is difficult to anticipate the impact of a cyberattack because the time it takes to recover can range from a day to more than a month. Although many SMBs are optimistic about their ability to withstand a cyberattack, some fail to accurately estimate the time it takes to restore operations and resume normal business activities.
How can SMEs address this?
SMBs can conduct a cybersecurity risk assessment to understand security gaps and determine steps to address them. These assessments can help SMEs discover areas open to attack to minimize them, ensure compliance with regulatory requirements, establish incident response plans, and more.
Planning effectively and proactively can help minimize the financial, reputational, and operational costs associated with a cyberattack should it occur. Many organizations provide self-service assessments, and working with a security expert or security service provider can bring additional expertise and guidance during the process as needed.
- 81% of SMEs believe AI increases the need for additional security controls
Rapid advancement of AI technologies and ease of use through simple interfaces create notable challenges for SMBs when used by employees. Without the proper tools to protect company data, the use of AI can lead to sensitive or sensitive information falling into the wrong hands.
How can SMEs address this?
Data security and governance play a critical role in the successful adoption and use of AI. Data security, which includes labeling and encryption of documents and information, can mitigate the chance of restricted information being referenced at AI prompts.
- 94% considers cybersecurity critical to their business
Recognizing the critical importance of cybersecurity, 94% of SMEs consider it essential for their operations. While it has not always been considered a priority, given the limited resources and internal expertise, the rise of cyber threats and the increasing sophistication of cyberattacks now pose significant risks to SMEs. Managing work data on personal devices, ransomware and phishing are cited as the main challenges that SMEs are facing.
How can SMEs address this?
For SMEs who want to get started with the resources available to train and educate employees, safety topics in Cybersecurity 101, Phishing (in English) and more are provided through the website of Cybersecurity Awareness from Microsoft.
- Less than 30% of SMBs manage their security internally
Given the limited resources and expertise within SMEs, many turn to security experts for assistance. Fewer than 30% of SMEs manage security internally and often rely on security consultants or service providers to manage protection needs. These professionals provide crucial support in researching, selecting and implementing cybersecurity solutions, ensuring that SMEs are protected from new threats.
How can SMEs address this?
Hiring a Managed Service Provider (MSP & Managed Service Provider) is commonly used to complement internal business operations. MSPs are organizations that help manage broad IT services, including security, and serve as strategic partners to improve efficiency and oversee daily IT activities. Examples of security support may consist of researching and identifying security solutions tailored to a business based on specific needs and requirements. Additionally, MSPs can implement and manage the solution by setting security policies and responding to incidents on behalf of SMEs. This model allows more time for SMEs to focus on core business objectives and requirements while keeping MSPs protected.
- 80% aims to increase its cybersecurity spending, with data protection as the main area of investment
Given the growing importance of security, 80% of SMEs aim to increase cybersecurity spending. The main drivers are protecting against financial losses and safeguarding customer and consumer data.It is no surprise that data protection is the main area of investment, with 65% of SMEs saying that this is where increased spending will be allocated, validating the need for additional security with the emergence of AI. Other key spending areas include firewall services, phishing protection, ransomware and device protection, access control and identity management.
How can SMEs address this?
Prioritizing these investments in the above areas, SMEs can improve security posture and reduce the risk of cyberattacks. Solutions such as Data Loss Prevention (DLP & Data Loss Prevention) help identify suspicious activity and prevent sensitive data from leaking out of the enterprise, Endpoint Detection and Response (EDR & ENDpoint Detection and Response) help protect devices and defend against threats, and Identity and Access Management (IAM & Identity Management) help ensure that only the right people have access to the right information.
- 68% SMEs consider secure data access a challenge for remote workers
The transition to hybrid work models has brought new security challenges for SMEs, and these problems will continue as hybrid work becomes permanent. With 68% of SMEs employing remote or hybrid workers, ensuring secure access for remote employees is increasingly critical. A significant 75% of SMEs are concerned about data loss on personal devices.To protect sensitive information in a hybrid work environment, it is vital to implement security and device management solutions so that employees can work safely from anywhere.
How can SMEs address this?
Implement measures to protect data and internet-connected devices, including installing software updates immediately, ensuring mobile apps are downloaded from legitimate app stores, and avoiding sharing credentials via email or text message, doing so only by phone in real time.
Next steps with Microsoft Security
- Read the full report to learn more about how security continues to play an important role for SMEs.
- Get the Cybersmart Kit Be (in English) to help educate everyone in your organization with cybersecurity awareness resources.
To learn more about Microsoft Security solutions, visit the site. Favorite or security Blog (in English) to follow up on expert coverage on security issues. Also, follow on LinkedIn (Microsoft Security) and X (@MSFTSecurity) for the latest cybersecurity news and updates.v