Cybersecurity opinions unveiled in coalition research
====================================================================================
Many small businesses across Canada and the UK underestimate their cybersecurity risk, according to a new study conducted by Coalition. Despite experiencing cyber attacks and investing less in prevention, a significant number of small businesses believe they are too small to be attractive targets for threat actors.
The study, which can be found at Coalition's blog, shows that around 77-86% of small businesses have experienced at least one cyberattack in the past five years. However, approximately 70% of Canadian small businesses and 61% of UK small businesses believe they are too small to be targeted.
This misperception leads to underinvestment in cybersecurity measures. About three-quarters of Canadian small businesses allocate 10% or less of their budget to cybersecurity, including cyber insurance, and a majority spend less than 10 hours weekly on cybersecurity activities. Despite growing concerns about cyber threats and increased time spent on cybersecurity tasks, these businesses still view cybersecurity tools and insurance as optional rather than essential investments.
The study explains that threat actors often target not just valuable companies but also vulnerable small businesses. However, many decision-makers underestimate their exposure and the potential serious impact that cyberattacks could have on their operations. This disconnect between increasing risk awareness and actual preparedness or budget allocation results in small businesses remaining underinsured and vulnerable to cyber threats.
Coalition's cybersecurity insurance offerings are designed to help businesses manage cyber risks and respond to cyber incidents. The offerings for large enterprise businesses include coverage for businesses with revenues up to $5 billion. For middle market businesses, Coalition offers enhanced coverage and free access to state-of-the-art cybersecurity capabilities, including attack surface monitoring, an in-house response team of security experts, and a suite of unspecified tools.
The study also highlights that 86% of small business leaders are very or somewhat concerned about cyber threats over the next 12 months. As the number of cyberattacks continues to rise, it is crucial for small businesses to invest in comprehensive cybersecurity measures to protect their operations.
In summary, the key reasons small businesses underestimate their cyber risk despite attacks and some effort in prevention are:
- False belief of being 'too small' to be targeted by hackers
- Viewing cybersecurity tools and insurance as elective rather than necessary
- Underinvesting both time and financial resources in comprehensive cybersecurity measures
- A gap between awareness of increasing risks and translating that into effective risk management strategies
Small businesses must address these issues to protect themselves from the growing threat of cyberattacks.
[1] Coalition, Small Business Cybersecurity Study, June 2023, https://www.coalitioninc.com/blog/small-business-cybersecurity-study-june [2] Canadian Federation of Independent Business, Cybersecurity for Small Businesses, 2023, https://www.cfib-fcei.ca/en/cybersecurity-for-small-businesses [3] National Cyber Security Centre, Small Business Cybersecurity, 2023, https://www.ncsc.gov.uk/businesses/small-businesses [4] Cyber Essentials, Small Business Cybersecurity Guide, 2023, https://www.cyberessentials.ncsc.uk/businesses/small-businesses
Events such as cyberattacks on small businesses are increasingly common, yet many underestimate their cyber risk due to misperceptions of their size or the optional nature of cybersecurity tools and insurance. To manage cyber risks and respond to cyber incidents, small businesses should invest in comprehensive cybersecurity measures, including technology like attack surface monitoring, expert response teams, and cyber insurance. This is crucial as the number of cyberattacks continues to rise, and 86% of small business leaders are very or somewhat concerned about cyber threats over the next 12 months.
