Many small companies have a mindset of bad actors and cyber threats only targeting “other” companies, “bigger” companies.  In reality, all it takes is one careless click on a link in an e-mail to bring a whole company to its knees.  Cybersecurity risks for small to medium businesses are genuine. 

Information security statistics published by the Ponemon Institute state that a hacker attack could cost a small business $690.000 on average, enough to put 60% of victims out of business within six months after the breach.1. 

Apart from the obvious financial constraints, many small businesses handle customer data internally and need more resources or knowledge to keep it secure, as larger organizations with a team of IT (Information Technology) workers do. Because of this, they are often at risk of attacks. 

Medium-sized companies could even be at greater risk than small companies.  Mid-size companies have assets more valuable than small-size companies but fewer IT security resources than big companies.

Osterman Research revealed that medium-sized companies received more phishing emails than small companies and, on average, more than large companies.  

It isn’t just businesses targeted by threat actors either; even non-profit organizations like churches deal with ongoing cyber threats, as a U.S.-based church found out after losing almost US$2 million to a phishing scheme.

There are many consequences beyond the obvious financial ones. Many small and midsize companies have business relations with larger organizations, and bad actors can use these relationships to access larger companies’ networks and employees. Therefore, any security incident can have far-reaching effects on clients and partners.

SMBs are more susceptible to cyber-attacks due to a lack of resources in combination with a lack of focus on cybersecurity issues. Many companies rely on self-research for threat information or don’t do any research at all. The lack of skilled employees is another problem small to medium-sized companies must deal with daily. Many SMBs have a small IT team that does everything, from hardware installation to software updates to network maintenance. This causes IT security to be moved to the back burner as operational tasks are given priority. Finding alerts by sifting through a sea of data can be daunting.

SMBs that employ a dedicated IT security person will find attracting security talent challenging. Clearance Jobs showed 166,000 openings for information security analysts between October 2019 and September 2020, but only 125,570 employees working in such positions. This gap can make it difficult for small businesses to find the right employee with the proper compensation as salaries rise to entice candidates into these positions.

Another threat small and medium companies deal with is more directly related to the era of remote and hybrid work environments of today. Employees connecting to small business networks from home are vulnerable, as home Wi-Fi systems may have different safeguards than on-premises networks have. Visibility has grown particularly cumbersome in the remote work era. Identity management becomes critical as businesses must ensure that those who access the network are who they say they are. Due to remote working companies having to make so many IT additions and adjustments, many environments are more complex than ever. This remote working era presents a new opportunity for hackers to dismantle the company system.

Managing what authorized users can access is imperative to keeping data safe. Employees need to work with specific files and applications to do their jobs, but limiting their access to data they do not need is essential. That way, even if they are compromised, critical parts of the infrastructure won’t be breached.

Small and mid-size companies are at considerable risk and face multiple challenges if a successful cyber-attack happens. Protection from bad actors should be a high priority in small and mid-size companies, and having correct measures in place to protect and respond to threats will go a long way in ensuring SMBs can stay in business if an attack should happen.

Employee empowerment and the right security solutions can improve a small business’ security posture. They can also consider prospects of third-party managed security equipped to deal with various threats.