UK SMEs face heightened cyber threats from AI deepfakes

New research has indicated an increased cyber risk to small and medium enterprises (SMEs) in the UK as a result of AI and deepfakes, with employees admitting a lack of confidence in identifying these threats.

Conducted by Sharp Europe, the research surveyed over 11,000 employees across Europe, including more than 1,000 in the UK, revealing that 86% of UK SMEs' workers are more concerned about cyber risks than the previous year, citing AI as the primary factor escalating their concerns.

The findings highlighted that only a third of UK employees feel confident in their ability to spot a cyber threat, while nearly two-thirds (63%) lack confidence in identifying cybersecurity issues. This situation has generated increased fear of cyber breaches among 86% of the workforce.

Sharp's research also suggests that almost a third of employees are increasingly worried about making errors that could lead to cyber-attacks.

Approximately 29% of respondents doubted their ability to discern AI-related security threats or determine bogus emails.

Mark Williams, Chief Operating Officer at Sharp UK, commented on the situation, "There is a worrying disparity between UK employees' growing concerns about AI within cybersecurity and their perceived ability to effectively deal with cyber threats at work."

Williams further noted, "To make matters worse, business leaders aren't providing their employees with adequate or regular training to deal with these new cyber threats. 90% of data breaches are caused by phishing attacks but an organisation's people are also its first line of defence. Technology is constantly evolving, so cybersecurity training should be adapting at the same pace."

He emphasised the responsibility of SME leaders, "It is the responsibility of SME leaders to implement a robust cybersecurity training programme which is provided and updated regularly.

In doing so, they can maintain a high standard of security awareness across their workforce that can be regularly adapted according to needs."

Despite these concerns, over 43% of employees within UK SMEs have not received any cyber security training in the past year, and 16% report never having undertaken formal cyber security training. The research further suggests that employers are not sufficiently equipping their workforce to tackle emerging cyber threats effectively.

Sharp's research is released against the backdrop of new cybersecurity legislation; notably, the NIS2 Directive, the first EU-wide law focused on enhancing cybersecurity, which is relevant to UK businesses trading within the EU.

UK Government initiatives, such as the Cyber Essentials Framework, assist businesses in meeting baseline cybersecurity requirements amidst a rise in sophisticated cyber-attacks attributed to advancements in AI.