More than half of Scotland’s small businesses ‘vulnerable’ to cyber-attack and what needs to be done
The stark findings follow high-profile cyber-attacks on major UK businesses such as Jaguar Land Rover and Marks & Spencer.
One in eight small businesses in Scotland has experienced a cyber-attack and more than half fear they could be vulnerable to a critical data breach, a new study suggests.
The majority of respondents to the poll of 500 businesses said they lacked the resilience to withstand a prolonged operational shutdown, while fewer than one in ten provide regular cyber security awareness training for staff.
The findings come amid a period of heightened cyber security risk for businesses, with the National Cyber Security Centre (NCSC) reporting record levels of ransomware attacks, business email compromise fraud, and supply chain vulnerabilities in recent years. There have been several high-profile cyber-attacks reported on large UK businesses including Jaguar Land Rover, Marks & Spencer and the Co-op.
The online survey - commissioned by Glasgow and Ayrshire-based IT support specialist Innovec - gathered responses from a sample of smaller businesses across Scotland, spanning a range of sectors, including construction, financial services, hospitality and information technology.
Iain Wham, managing director of Innovec, said the findings served as a reminder that cyber security remains a significant business resilience challenge to a large proportion of Scotland’s small business community.
He said: “As threats continue to evolve, and attackers increasingly target smaller businesses as entry points into larger supply chains, the need to act has never been greater.
“The question for Scotland’s small and medium-sized enterprises [SMEs] and business support organisations is whether current levels of awareness, investment and preparedness are sufficient to combat the next, inevitable wave of attacks.”
When asked to rate their vulnerability to a cyber-attack on a scale of one to five - where one represents “not at all vulnerable” and five “extremely vulnerable” - more than half of businesses (52 per cent) placed themselves at level three or above. A significant minority rated their vulnerability at level four or five, indicating a genuine and acknowledged exposure to risk.
Wham added: “The survey results suggest that, even among those who have implemented technical defences such as multi-factor authentication and regular data backups, the capacity to weather a prolonged disruption remains dangerously limited.
“They show that more than three-quarters of Scottish SMEs surveyed would face severe financial distress within a month of a complete operational shutdown - and for nearly half, the critical threshold would be reached within just two weeks or less.
“For many small businesses operating on thin margins, such a scenario would likely prove terminal.”
When asked about the cyber security measures currently deployed, the survey revealed a mixed picture.
Multi-factor authentication and automated data backups were the most commonly implemented measures - adopted by 67 per cent and 62 per cent of businesses respectively - while encrypted data storage and transmission, endpoint detection and response, and next-generation antivirus software were also used.
There were wide variations in cyber security awareness for staff, with more than two thirds of businesses limiting provision to annual training sessions or longer. Only 14 per cent of respondents said they provided monthly updates.
Meanwhile, only 12 per cent of firms reported having a formal policy never to pay a ransom, while 88 per cent either had no formal policy or were unsure.
Comments
Want to join the conversation? Please or to comment on this article.