Cybersecurity is crucial for small businesses
Small companies tend to neglect the defence of their digital data, but the risks are very high, says David Prosser.


Small and medium-sized businesses (SMEs) are under-protected from cybersecurity risk, while the pandemic has increased their vulnerability to attacks. The European Union Agency for Cybersecurity (ENISA) says a third of SMEs have experienced a cyber incident over the past five years. Half believe that a serious incident could completely sink their company.
Despite this level of risk, most SMEs have only basic protections in place. The majority of smaller firms have taken steps such as installing firewalls and anti-virus software, but only a minority routinely train staff on cybersecurity issues or use more sophisticated protection tools.
ENISA’s data suggests that the five most common threats to SMEs are: phishing attacks; web-based raids; general malware; malicious insiders; and denial-of-service strikes. What’s more, measures introduced by many SMEs during the pandemic, including remote-working practices and contactless-payment options, have given cyberattackers new opportunities.
MoneyWeek
Subscribe to MoneyWeek today and get your first six magazine issues absolutely FREE

Sign up to Money Morning
Don't miss the latest investment and personal finances news, market analysis, plus money-saving tips with our free twice-daily newsletter
Don't miss the latest investment and personal finances news, market analysis, plus money-saving tips with our free twice-daily newsletter
The big challenge, says ENISA, is that managers are not sufficiently focused on the potentially existential threat that cyberattacks pose. As a result, their efforts to counter the threat often fall short of what is required. They don’t invest enough money in cybersecurity, they fail to recruit the right type of cybersecurity expertise, and they favour seemingly quick fixes such as anti-virus software, rather than building a culture of cybersecurity awareness.
Shocking statistics
Such complacency leaves smaller firms exposed. Research published by Vodafone in early 2021 found that 41% of UK SMEs had suffered cyberattacks over the previous 12-month period, with 20% experiencing multiple attacks. It warned that as many as 1.3 million UK SMEs could collapse completely after falling victim to a cyber-attack.
ENISA’s most important recommendation is that SMEs should focus on how to build stronger cultures of cybersecurity, with management working harder to build employees’ awareness. The agency suggests practical steps such as regular cybersecurity audits, training for staff, the development of cybersecurity policies, and work on incident response plans.
More technical steps will also help. Too few SMEs are taking steps to secure their devices, such as installing all software patches and upgrades, encrypting data and focusing on how to manage mobile devices. Network security also needs to be reviewed, particularly as more staff work remotely. Third parties such as suppliers may also be introducing new vulnerabilities.
However, the starting point for many smaller businesses will be to recognise that they represent an attractive target. SMEs are less likely to have robust defences in place than their larger counterparts.
Even simple steps can prove hugely valuable. For example, SMEs that routinely back up their systems and data will be much less vulnerable to ransomware attacks. Firms that introduce multi-factor authentication on remote devices decrease their chances of attackers getting in this way.
Get the latest financial news, insights and expert analysis from our award-winning MoneyWeek team, to help you understand what really matters when it comes to your finances.

David Prosser is a regular MoneyWeek columnist, writing on small business and entrepreneurship, as well as pensions and other forms of tax-efficient savings and investments. David has been a financial journalist for almost 30 years, specialising initially in personal finance, and then in broader business coverage. He has worked for national newspaper groups including The Financial Times, The Guardian and Observer, Express Newspapers and, most recently, The Independent, where he served for more than three years as business editor.
-
Reeves ‘looks at minimum UK shareholding' in ISA reform
On top of a rumoured £10,000 cash ISA limit, chancellor Rachel Reeves is reportedly considering adding a minimum UK shareholding requirement to the stocks and shares ISA
-
Rightmove: Asking prices rise by 0.3%, but increase is lower than typical for October
October saw asking prices grow by £1,165 on average, Rightmove says, but the increase is far below the usual autumn bump as the property market braces for next month’s Budget.
-
Are venture-capital trusts worth investing in?
Venture-capital trusts are a tax-efficient way to invest in early-stage companies. But are they worth the risk?
-
'It’s time to close the British steel industry'
Opinion The price tag on British steel is just too high. It's time for Labour to make a grown-up decision and close down the industry, says Matthew Lynn
-
Last orders: can UK pubs be saved?
Pubs in Britain are closing at the rate of one a day, continuing and accelerating a long-term downward trend. Why? And can anything be done to save them?
-
David Ellison: America's new media mogul
David Ellison is building a mighty new force in old and new media. Critics worry that he will prove to be a Trumpian patsy. Is that fair?
-
How Next defied the odds and positioned itself as a British high-street staple
Next rose from a near-death experience and now thrives as a high-street staple. What's driving its success – and should you invest in the retailer?
-
Why investors should avoid market monomania
Opinion Today’s overwhelming focus on US markets leaves investors guessing about opportunities and risks elsewhere
-
Can Rachel Reeves save the City?
Opinion Chancellor Rachel Reeves is mulling a tax cut, which would be welcome – but it’s nowhere near enough, says Matthew Lynn
-
Global investors have overlooked the top innovators in emerging markets
Opinion Carlos Hardenberg, portfolio manager, Mobius Investment Trust, highlights three emerging market stocks where he’d put his money