2022 SMB IT Security Needs Study Highlights & Contradictions
Security firm Action 1 recently published the results of its 2022 SMB IT Security study after surveying 750 small and midsize businesses.
Key Findings and Contradictions of the Action1 SMB Report
It is no secret that perceptions about our security risks differ from reality. Not surprisingly, some of the 2022 SMB IT security needs survey results contradict one another.
52% vs 65% vs 37%52% of respondents acknowledge that they lack sufficient skills and technology to effectively protect against cyber attacks. But 65% believe the cost of protection is too high and 37% complain that security controls hurt productivity. Businesses clearly struggle to balance the security they need with the cost and the user experience. Often SMBs are presented with security solutions designed – and priced – for larger organizations. As employees use added security steps for everyday transactions (online banking, etc.), the overhead of security protocols is less intrusive.
63% vs 81% vs 40%While 63% believe that their SMB faces a lower cyber risk compared to larger companies, 81% of respondents had at least one security incident within the past 12 months. 40% of SMBs had 2 or more incidents. Too many SMBs continue to have a false sense of security. Cyber criminals understand that is easier to hack 10, or even 100, small businesses than it is to successfully attack 1 large enterprise. And with current tools, cyber attacks are inexpensive to launch and manage.
Where the Security Risks Exist
40% vs 39% vs 34%The most common forms of successful cyber attacks are password attacks (40%), ransomware or other malware (39%), and phishing (34%). Note that these forms of attack are not mutually exclusive. One form of attack, malware for example, can be used to gather the information needed for a successful password breach.
63% vs 43%Looking at root causes, 63% of SMB IT Security study respondents noted that attacks began with phishing. Unpatched systems were the starting point for 43% of attacks. These numbers make sense as these attack vectors provide access to information that supports further attacks.
Who is Helping
96% vs 23%The vast majority of SMBs rely on outside experts for help with their security needs. 93% of respondents use an IT firm for at least some of their IT security needs. That said, 23% of small businesses are looking to replace their IT service providers in the coming year. While security is not the only trigger for changing providers, it is one consideration.
48% vs 33% vs 29%SMBs responded that poor system performance (48%), system outages (33%), and long problem resolution times (29%) are the three primary reasons for switching service providers. Each of these issues relate to business interruptions.
2022 SMB Security Study Conclusions
Examining the SMB IT Needs Security Study results, we see three clear conclusions.
- Failing to recognize the risks leads business owners to under value security technology and services. The cost to respond and recover to a single incident dwarfs the cost of reasonable protections. For SMBs, the average successful cyber attack can disrupt business operations for 18 to 21 days at a total cost to recover exceeding $200,000.
- With 50% of employees working remotely, at least part time, individuals and systems are more exposed to attack. Physical security is no longer sufficient. SMBs need a security services designed to protect against the most common and the most costly types of cyber attacks.
- As an IT service provider, we must ensure that our services, first and foremost, do no harm. While security protocols can introduce some inconveniences, our services cannot interfere with performance, availability, or reliability.
Next Steps to Improve Your IT Security
Step back and take a look at your security services and footprint. Our Rapid Security Assessment is a quick and simple starting point to identify security gaps. You can also schedule a call with one of our Cloud Advisors to review your security and IT services.
