Are SMEs over confident about their ability to manage cyber risk?

Small Medium Enterprises (SMEs) in Australia believe they are less vulnerable to cyber risks than their larger competitors. According to Chubb's SME Cyber Preparedness Report “Too Small to Fail?”, 60% of the 400 respondents agreed with that statement. They also think that they can overcome cyber incidents quickly and easily, with more than half (56%) believing that they can contain a breach within 12 hours.

60% believe that they are in a better position than their larger competitors.

87% believe they can overcome a cyber incident, with 56% believing they can contain an incident within 12 hours.

72% believe a similar incident is less likely to occur in the future.

67% realise they are more vulnerable than they previously thought.

However, nothing could be further from the truth.

• More than half (60%) experienced a cyber incident in the past 12 months.
• When probed, 45% of respondents are not confident that all their employees who have access to sensitive data are fully aware of their data privacy responsibilities.
• 67% believe they are not aware of all the cyber threats they face.

While SMEs may be at risk of external cyber attacks, our research shows that the majority of the cyber incidents are actually caused by internal factors. The top three incidents are business interruption or data loss through human error, system malfunction or technical fault.

18% Business interruption or data loss through human error.

27% Business interruption from a system malfunction or technical fault.

23% Data loss through system malfunction or technical fault

Following a cyber incident:

• SMEs react differently with 33% stating that they increased their security, 31% notified affected parties, and 28% took no action at all.
• Their key concerns were relationship with customers (51%), profits (51%), cost of incident (51%) and public reputation (47%).

These statistics lead us to believe that there is a significant gap between the hard reality of cyber risk and how well small companies are prepared to deal with it. SMEs face a far bigger risk exposure as they face many of the same threats as larger companies do, yet most do not have the means to make as much investment required to implement comprehensive protection, or to recover from an attack.