The survey was conducted in 18 countries and was based on responses from professionals working in companies with fewer than 500 employees. Just 14% said they had not experienced any incidents in the past 12 months. On average, each organization experienced three different types of incidents.
Which incidents occurred most frequently?
The most common problem was misleading messages that try to convince employees to reveal information or take some action. This was reported by 20% of participants from small and medium-sized businesses.
They followed:
- problems in programs used to compromise systems, with 17%,
- attempts to remotely access corporate systems, with 16%,
- unknown security issues and attacks through partners or other trusted relationships, with 8% each.
Although the latter two incidents occurred less frequently, Kaspersky calls them particularly dangerous. The research does not show that smaller businesses face completely different risks than larger ones. However, mass malware attacks, file-locking and ransom-demanding attacks, corporate email compromises, and security issues in artificial intelligence systems were slightly more common in companies with more than 500 employees.
Staffing remains a key challenge
When participants were asked to select the most important factors that increase the risk of a successful attack, the two most common answers concerned personnel.
24% said that the digital security department lacks sufficient expertise, while 23% said that employees outside of the IT department are not sufficiently informed about security issues. Inadequate internal security rules (21%), outdated programs and devices (21%) and a high workload for IT teams (20%) were also cited as key challenges.
The lack of skilled personnel and financial constraints are particularly difficult for growing businesses, according to Ilya Markelov, head of Kaspersky’s Unified Platform Product Line. He said that security solutions for smaller companies must offer strong protection without requiring a large number of specialists or complex management.
More money for security
70% of companies surveyed plan to strengthen their cybersecurity department, while 75% of SMEs increased their cybersecurity budget this year.
41% allocated additional money to strengthen IT and security teams, while 30% invested in more advanced monitoring and problem detection systems.
Kaspersky's instructions
Kaspersky recommends that small and medium-sized businesses implement clear rules about who can access company files and services. An employee's rights should be removed immediately when they leave the company.
It also suggests automatic backups so that critical information can be restored after a major incident. Instructions to employees on safe internet use and password management should be simple, while the installation of new programs should be approved by the IT department.
The company also recommends targeted training for staff to recognize fake videos, fake phone calls, and deceptive messages. For this purpose, it cites the Kaspersky Automated Security Awareness Platform, which includes online courses and test campaigns with deceptive messages.
For very small businesses with fewer than 50 employees, Kaspersky recommends Kaspersky Small Office Security Premium. For companies with a more experienced IT team, it recommends Kaspersky Next Optimum, while for organizations that need external support, it recommends Kaspersky Next MXDR Optimum. For corporate email protection, it also recommends Kaspersky Security for Mail Server, which is designed to combat phishing emails, corporate email breaches, and invoice payment fraud.
Your comments will not be published if: