Digital Transformation » Cyber Security » UK mid-market companies ignoring £30bn cyber risk

UK mid-market companies ignoring £30bn cyber risk

Cyber-attacks are a clear and present danger for UK mid-market firms, but boards are not effectively prepared to manage the risk, says Grant Thornton.

Mid-size companies are failing to grasp the scale of cyber risk, according to research that found 63% do not have a board member responsible for cyber security.

A report by accountancy firm Grant Thornton found that in the last 12 months, the total cost of cyber security breaches to UK mid-market businesses has reached at least £30bn.

Yet only one in three (36%) companies have provided all their employees with cyber security training in the last 12 months and over half of the business surveyed (59%) do not have a cyber incident response plan in place.

The report called ‘Cyber Security – the Board Report, estimates that in the last 12 months, the total cost of cyber security breaches to UK mid-market businesses has reached at least £30bn.

It found more than half (53%) of the companies interviewed reported losses equivalent to 3-10 per cent of revenue following a cyber-breach. For those businesses hit most severely, losses can reach up to 25 per cent of revenue. Six per cent of the businesses surveyed reported a loss of this size (11 to 25% of revenue).

James Arthur, partner and head of cyber consulting at Grant Thornton UK LLP, said: “Boards have a key role to play in ensuring an effective cyber strategy is in place. Putting cyber-crime onto the board’s agenda is one of the most effective ways to minimise the chances of a successful attack and reduce the financial impact if a breach occurs. With that in mind it is worrying that almost two thirds of the businesses we interviewed do not have a board member responsible for cyber security.

“While commitment from the top is vital, ensuring your people are properly trained is also essential. Often, companies make themselves vulnerable to attack simply by failing to get the basics right. Training to raise employee awareness can have a hugely positive impact on cyber security. People are often unaware of the important role they play in helping a business to stay protected, so companies of all sizes need to ensure they have regular and ongoing cyber security training in place.”

Misplaced confidence in cyber capabilities

Almost 70% of the respondents felt confident in their ability to respond consistently at any time to a cyber-attack across their entire organisation. Conversely, over half of the businesses surveyed do not have a cyber incident response plan in place (59%).

The importance of having a well-rehearsed plan of action cannot be underestimated, said Grant Thornton. “The research found that companies that have an incident response plan in place experience lower financial losses from a cyber-attack than those that don’t,” it added.

Arthur continued: “Cyber-crime represents a serious threat to every UK business and, as our research shows, just one successful attack can amount to a huge revenue loss. Mid-market companies are particularly vulnerable as they have a level of resources that make them an attractive target but are less likely to implement best-in-class cyber security compared to larger companies.

“Businesses need to understand where their weak points are in order to counter the threat effectively. Yet our research shows that perceived and actual vulnerability often don’t match up, with many businesses feeling confident in their cyber management capacity but having no meaningful response plans in place. A pre-prepared, effective response plan allows a business to do the right thing as fast as possible, in a situation where every minute counts.

“Many companies are relying on regular data backups to be able to recover rapidly from cyber incidents but with modern ransomware specifically designed to spend up to six months infecting entire networks, including data backups, this cannot be relied upon as a core component of a response plan.”

The report identifies six key areas that mid-market boards should be focusing on to ensure they are properly prepared, including establishing a cyber incident response plan, regularly rehearsing the response plan using a range of different scenario and monitoring and managing the risk posed from their supply chain

It also recommended ensuring they understand the terms of their insurance and what is covered, understanding what ‘normal’ looks like for their business, in terms of application usage, so they can identify any unfamiliar pattern and investing in regular training and raising their people’s awareness of cyber security.

Arthur concluded: “Effective cyber-security does not need to cost the earth and goes beyond simply investing in new technology. There are simple, specific steps companies can take, such as implementing a meaningful cyber response plan and understanding what is ‘normal’ for their business, to put themselves in a much stronger position.

“Cyber risk management should be fundamental for every business striving to grow in a connected, digital world and boards need to recognise its importance. No business – whatever its size or sector – is immune.”

Was this article helpful?

Comments are closed.

Subscribe to get your daily business insights