In the last 12 months, the total cost of cyber security breaches to UK mid-market businesses has reached at least £30 billion. And, yet, 63% of UK mid-market businesses do not have a board member responsible for cyber security. Something doesn’t add up, especially considering the financial cost to businesses of ignoring the UK cyber risk:
More than half (53%) of the companies interviewed reported losses equivalent to 3-10% of revenue following a cyber breach. For those businesses hit most severely, losses can reach up to 25% revenue — 6% of the businesses surveyed reported a loss of this size (11 to 25% of revenue).
A CTO guide: The main challenges facing the cyber security industry
UK mid-market boards: ignoring the cyber threat?
Despite this, the research found that almost two thirds (63%) of the companies interviewed had no board member with specific responsibility for cyber security. And, 63% of those questioned also said that the board does not formally review cyber security risks and management.
The organisations interviewed were also under prepared in terms of making their people aware of cyber risks, with only one in three (36%) providing all their employees with cyber security training in the last 12 months.
James Arthur, partner and head of cyber consulting at Grant Thornton UK LLP, said: “Boards have a key role to play in ensuring an effective cyber strategy is in place. Putting cyber-crime onto the board’s agenda is one of the most effective ways to minimise the chances of a successful attack and reduce the financial impact if a breach occurs. With that in mind it is worrying that almost two thirds of the businesses we interviewed do not have a board member responsible for cyber security.
“While commitment from the top is vital, ensuring your people are properly trained is also essential. Often, companies make themselves vulnerable to attack simply by failing to get the basics right. Training to raise employee awareness can have a hugely positive impact on cyber security. People are often unaware of the important role they play in helping a business to stay protected, so companies of all sizes need to ensure they have regular and ongoing cyber security training in place.”
Cyber security best practice: Definition, diversity, training, responsibility and technology
Misplaced confidence in cyber capabilities
Almost 70% of the respondents felt confident in their ability to respond consistently at any time to a cyber attack across their entire organisation. Conversely, over half of the businesses surveyed do not have a cyber incident response plan in place (59%).
The importance of having a detailed, actionable plan can’t underestimated — the research found that companies that have an incident response plan in place experience lower financial losses from a cyber attack than those that don’t.
“Cybercrime represents a serious threat to every UK business and, as our research shows, just one successful attack can amount to a huge revenue loss,” continued Arthur. “Mid-market companies are particularly vulnerable as they have a level of resources that make them an attractive target but are less likely to implement best-in-class cyber security compared to larger companies.
“Businesses need to understand where their weak points are in order to counter the threat effectively. Yet our research shows that perceived and actual vulnerability often don’t match up, with many businesses feeling confident in their cyber management capacity but having no meaningful response plans in place. A pre-prepared, effective response plan allows a business to do the right thing as fast as possible, in a situation where every minute counts.
“Many companies are relying on regular data backups to be able to recover rapidly from cyber incidents but with modern ransomware specifically designed to spend up to six months infecting entire networks, including data backups, this cannot be relied upon as a core component of a response plan.”
ISO 27001: the cyber security standard that organisations should strive for across the supply chain
How to: preparing for a cyber attack
The report identifies six key areas that UK mid-market boards should be focusing on to ensure they are properly prepared, including;
• establishing a cyber incident response plan;
• regularly rehearsing the response plan using a range of different scenarios;
• monitoring and managing the risk posed from their supply chain;
• ensuring they understand the terms of their insurance and what is covered;
• understanding what ‘normal’ looks like for their business, in terms of application usage, so they can identify any unfamiliar patterns; and
• investing in regular training and raising their people’s awareness of cyber security.
“Effective cyber security does not need to cost the earth and goes beyond simply investing in new technology. There are simple, specific steps companies can take, such as implementing a meaningful cyber response plan and understanding what is ‘normal’ for their business, to put themselves in a much stronger position,” said Arthur.
“Cyber risk management should be fundamental for every business striving to grow in a connected, digital world and boards need to recognise its importance. No business — whatever its size or sector — is immune.”
