Closing the SMB security gap

Despite making up the vast majority of the economy, remain under-protected, according to security experts, unable to match the toolsets of larger organizations or compete for . On stage at TechSummit24 in Alpbach Austria, Brian Downey, VP of product management at , noted that under the EU’s definition, 50% of the region’s is generated by SMBs. The defines an SMB as a firm with under 250 employees and/or under €50 million (£42 million) in annual turnover, 99% of the companies in the region fit the criteria.

Klaus Gheri, VP of at Barracuda Networks, told he felt this definition was somewhat restrictive and covered what he considered the “low end” of mid-sized corporations. He added that he didn’t feel staff count was a particularly helpful criterion, suggesting organizations that don’t have a or a dedicated security team, for example, would be a better indicator of what constitutes an SMB. Earlier this month, Stephen McPartland, author of the McPartland Review into Cyber Security and former national security minister, told he found 99% of all businesses in the UK could be classified as SMBs, and that, “many do not even have basic .



” Downey cited stats from the (WEF) report which highlights the level of ‘cyber inequity’ between large and mid-sized corporations. First among the indicators of this disparity is a glaring lack of in smaller companies, with only 40% of SMBs having bought cloud services in 2023, compared to 72% of large businesses. Unable to afford the ‘best of breed’ security products used by their larger counterparts, the smaller organizations have implemented are also less effective, according to the WEF.

The report found more than twice as many SMBs said they lack the to meet their critical operational requirements, compared to larger organizations. SMBs are struggling to attract talent, MSPs could be the answer To compound the disparity in cyber readiness, the WEF also found over three quarters of cyber attacks are focused on SMBs, with 2023 marking a 38% increase in attacks against . SMBs don’t have the skills to deal with this escalating attack surface either, according to the study, with only 49% of SMBs telling the WEF they believe they have the skills required to meet .

Moreover, only 21% of SMBs said they feel they can recruit , unable to compete with better-resourced, larger enterprises. Speaking to Neal Bradbury, chief product officer at Barracuda Networks, said this is where channel, and specifically can step in to provide end users with the expertise they need, without having to compete in an increasingly tight cybersecurity labor market. “Small businesses will never be able to hire or afford all the security expertise that they need, and so what you’re seeing is three out of four businesses that are partnering with somebody to do their security,” he explained.

“They’re also trained, they’ve got the specialized talent, and so outsourcing it is almost the better way to do it because you can actually have a better security posture by hiring a professional that knows how to do it. It puts the IT team and more in the IT and the for what keeps the business running.” Bradbury added that added regulatory pressure will be a significant push factor forcing these businesses into making the investments to ensure they meet minimal security requirements, or risk facing hefty fines from authorities.

“A lot of and is driving these businesses, depending on what vertical they’re in, especially in the US and I know it might be even worse in Europe,” he noted. “They have to have specific checkboxes that they satisfy, and so you have to meet it, you have no choice. So they’re going to have to partner with somebody, an IT professional that can help make sure that they can actually go and check those boxes.

”.