UK SMBs face cyber incidents amid basic security gaps

ESET has published research showing that 49% of UK small and medium-sized businesses suffered a cyber incident in the past year. The survey covered 500 UK businesses with between 25 and 1,000 endpoints.

The findings point to a gap between the threats business leaders fear most and the attacks causing the most harm. Respondents ranked AI-powered malware as their top security concern, but the incidents they reported were most commonly linked to phishing, unpatched vulnerabilities, weak passwords and a lack of monitoring.

Among businesses that had experienced an incident, 13% said they had faced more than one during the period covered by the research. The average time UK SMBs took to identify and recover from a breach was just over four weeks.

The research also showed that wider geopolitical concerns are shaping cyber risk perceptions. More than four in five respondents, or 81%, said cyber warfare and global conflicts are a very real cyber threat that could affect their business.

Basic gaps

That concern has not yet translated into broad use of outside support. The survey found that 86% of UK SMBs do not outsource any part of their cybersecurity responsibilities through a managed detection and response provider, a managed service provider or a managed security service provider.

The data suggests many companies still rely mainly on internal teams with limited specialist capacity. Some 32% said cybersecurity forms part of a broader IT specialist role, 33% said they have a dedicated cybersecurity specialist and 21% said they have an internal security operations centre team. Only 11% said they partially outsource cybersecurity responsibilities to a third party, while 3% said they outsource all of it.

Among those that use external providers, MSP and MSSP firms were the most common option. Some 57% of businesses that outsource at least some security work do so through an MSP or MSSP, while 21% also use their managed service provider for MDR. Another 27% outsource security through a cyber insurer offering MDR, and 16% use a vendor offering MDR.

The study identified several barriers holding back stronger cyber defences. Respondents cited keeping up with cybersecurity threats, keeping up with new technologies such as AI, vulnerability and patch management, and a lack of skills as the main challenges.

Budget plans

Even so, many businesses expect to spend more on security. The survey found that 55% of UK SMBs expect their cybersecurity budgets to increase in the next year, with employee training and awareness and cloud security among the main investment priorities.

The mix of concerns suggests smaller businesses are trying to respond to a changing threat environment while still struggling with basic operational controls. In practice, that leaves many organisations exposed to relatively simple, widely used attack methods.

Jake Moore, Global Cybersecurity Advisor at ESET, said basic weaknesses remain the main issue for many smaller organisations.

"It's true that AI will help cybercriminals speed up their attacks against UK businesses. But the core tactics they use, such as phishing or exploiting software vulnerabilities, will largely stay the same," Moore said.

"Until organisations improve their security by locking down the basics, smaller businesses will be easy pickings for cybercriminals looking to steal sensitive data and turn a profit," he added.

The findings also point to a potential opening for service providers as businesses weigh whether to build more internal expertise or buy in support. Skills shortages and patch management pressures have long been recurring problems for smaller organisations, and the continued low use of outsourced monitoring and response services suggests many have yet to change their operating model.

Matt Knell, UK Country Manager at ESET, said the market already offers several ways for smaller businesses to address those gaps.

"The odds might look stacked against UK businesses," Knell said.

"But rising security budgets, robust cyber insurance offerings and a wealth of MDR and MSP services are available to help SMBs bolster their resilience. Right now, organisations have a golden opportunity to rethink security strategies, close skills gaps and bring in much-needed support before a costly incident occurs," he added.