SMEs more exposed to cyber-attacks as resilience grows, finds BCI

This year’s BCI Cyber Resilience Report saw 74% of respondents note an increase in the number of cyber-attacks within the past twelve months.

It also found that most organisations registered the impact of those attacks as small to medium.

As higher numbers of organisations are taking proactive steps to mitigate the impact of cyber incidents, this serves as evidence that it is resulting in reduced impacts.

Humans still the weakest link

The traditional methods of phishing and spear phishing remain the most frequent form of cyber-attack, with the number of organisations reporting a successful phishing attack rising from 65.7% to 72.4% this year.

It also ranked as the most disruptive method of attack, particularly as the sophistication of such attacks is becoming greater as cybercriminals work to eliminate the tell-tale signs of a phishing email, such as bad grammar and other inconsistencies.

However, it is also important to note that phishing attacks often work in tandem with another form, where the phishing email effectively works as a vessel for malicious code, such as ransomware.

On this note, while ransomware only just makes it into the top five most frequent methods of cyber-attack, respondents have ranked it as the second-most disruptive – showing this threat is not to be taken lightly.

Rachael Elliott, head of Thought Leadership, BCI: “With the classic attack vectors, attackers are becoming increasingly more intelligent with their approaches; phishing emails no longer contain the spelling errors of yesterday and attacks have the potential to unleash damage to systems quicker than an organisation has time to react.

“Even if an organisation has the most advanced technology in place, attackers know that by approaching the weak link to cyber security within an organisation – the people – their attack will have more chance of success. Thankfully, we see training and exercising of staff in cyber awareness on the increase.”

Developing a response

Positively, 87% of respondents say their organisation has business continuity arrangements in place to deal with cyber incidents.

The BC function can be a vital aide in a cyber-attack and respondents highlighted that it ensures a faster recovery first and foremost, followed by also helping to mitigate financial losses.

However, the report also finds that cyber risks can still be siloed within organisations.

Other findings:

• Looking ahead, 74% of respondents consider a ransomware attack to be within the top threats to their organisation over the next five years.
• Most respondents (67.2%) feel that they could respond to a cyber incident within the hour, showing a confidence in the effectiveness of their response and detection times.
• 40.4% of organisations have suffered financial losses of more than €10,000 euros as a result of cyber incidents. While the financial impacts of cyber-attacks may not seem like an existential threat, it is also important to consider indirect costs (potentially losing customers) as well as the cost of investments to keep the organization safe from an attack.

Steve Burden, head of Cyber Security Solutions, Daisy said the success of cyber resilience relies on the partnership between cyber security and resilience personnel.

“However, what is clear from the findings of the survey is that organisations are not always getting it right, resulting in more frequent breaches and rising costs,” he continued.

“Attacks are getting more sophisticated and, sadly, the commonly repeated phrase of it ‘not being a matter of if, but when’ you’re breached has never been more true.

“It is therefore encouraging to see so many organisations taking an assumed breach mentality and proactively implementing cyber resilience measures to reduce the impact of a cyber incident; and we hope to see this trend continue throughout 2023.”