The consequences of a successful cyber attack can be disastrous. From substantial financial loss to significant reputational damage, they can lead to untold operational disruption. Yet despite the clear and present danger, some businesses continue to deprioritise cyber security, with a concerning 15% failing to invest in cyber security measures. Whether this is a calculated decision or a matter of managing risk, it leaves the businesses’ data and processes exposed to attack.
Large corporations like Microsoft and AT&T, both of which recently experienced cyber breaches, are particularly vulnerable. These very public incidents can feed the perception that small and medium sized businesses are unlikely to be targeted by cyber criminals. However, this does not ring true when compared to a recent government survey which showed that 45% of medium sized businesses, and 50% of all companies in the UK, have suffered some sort of breach or cyber attack in the past 12 months.
For these smaller businesses, implementing simple security procedures is a strong start. Some quick market research can also highlight that engaging with the right managed services provider (MSP) can be a cost effective way of enhancing security and reducing cyber risk. Despite this, convincing business leaders to invest in cyber defences can be an uphill battle – even if decisions to delay only amplify the risk. Turning a blind eye could lead to devastating consequences.
An overshadowed priority
Despite a shared understanding of cyber threats among security leaders and C-suite, cyber security often gets overlooked. The root of this lies in a misalignment of priorities. Immediate business concerns like revenue growth, market expansion, and customer acquisition overshadow cyber security, which has historically been viewed as a cost centre, rather than a revenue driver.
This misalignment relegates security measures to a secondary issue, to be addressed only after a breach occurs. Alarmingly, a third of security leaders only prioritise cyber security expertise after an attack has happened.
This reactive approach to cyber security is fraught with risk. Neglecting proactive cyber security measures can lead to a raft of negative consequences, including financial repercussions. The immediate costs from a breach might include ransom payments, remediation expenses, and legal fees, while long-term impacts can involve lost business, regulatory fines, and increased insurance premiums.
Staff retention can also take a hit following a cyber attack – over half of employees indicate they would leave companies that have suffered from a breach. They are often driven by insecurity about the company’s future or frustration over inadequate security measures, leading to higher turnover rates.
The repercussions also extend to business relationships. Larger or partner companies, particularly those with stringent security standards, may be unwilling to engage with businesses that fail to meet their security expectations, limiting opportunities for growth and collaboration. Similarly, the same could be said for potential customers who might shy away from businesses who have suffered a breach, further isolating the business from lucrative partnerships and contracts.
Securing buy-in
To ensure cyber security is prioritised, it is vital to convey to the C-suite the very real implications of not mitigating cyber security risks. The most effective way to get this message across is by using business metrics to show the potential financial impact of cyber attacks.
Presenting case studies of similar organisations that have suffered financial losses from breaches and providing relevant statistics showing the financial and reputational cost can be very powerful to enhance your pitch. It is also key to highlight the benefits that strong cyber security affords a business. This includes building customer confidence, reputational protection, regulatory compliance, and financial security.
Starting with baseline measures can help secure initial support from the C-suite. Simple steps, such as regular software updates, staff cyber awareness training, and using Endpoint Detection & Response (EDR) tools to quickly identify threats like ransomware can substantially reduce exposure to cyber attacks.
Even simple changes to a company’s security posture can have long lasting effects. Many threat actors and hackers are looking for easy targets – companies with exposed vulnerabilities. For example, one of the most common breach points is via overlooked or underestimated aspects like poor password security.
Since the human factor is such a large part of attacks, regular cyber awareness training sessions for all employees helps to build a foundational understanding of cyber threats and safe practices. When everyone in the organisation is vigilant and informed, the overall security posture is strengthened. For password security in particular, companies can also implement multi-factor authentication tools to ensure employees accessing the network are who they say they are.
There is a myriad of cyber security tools out there to help secure your systems. Wading through the industry jargon can be tough going and is often a daunting task. Tools such as Network Detection and Response (NDR) and Security Incident and Event Management (SIEM) require teams of specialists to constantly monitor and modify settings to maximise efficiency. Achieving this in a small and medium sized business can be difficult and expensive. This can be overcome by partnering with an MSP who can provide expert advice and technical support to deliver a comprehensive security solution to your organisation.
It is time to implement cyber security measures now
By deprioritising cyber security, businesses are essentially deferring costs. Every organisation accrues a cyber security debt, which can be managed in two ways: it can either be paid upfront through continuous support and rigorous cyber security measures, or it will inevitably be paid later, often at a much higher cost when a breach occurs.
A proactive approach to cyber security that adopts even simple cyber security solutions can better protect businesses from the risk and cost of a breach and help it build a reputation as a secure and dependable partner.
Investing in cyber security today is not just about avoiding future costs; it’s about ensuring the long-term success and sustainability of the business.
Tom Exelby, Head of Cyber Security at Red Helix
