Cyber security is no longer a challenge that organisations can face in isolation. As businesses become more connected through digital environments, supply chains and shared technologies, cyber incidents in one organisation can impact many other organisations.
This means that improving security is no longer one organisation’s responsibility anymore, but requires a collective effort across organisations.
The UK Government has acknowledged this need for change with the Cyber Resilience pledge, which urges organisations to take 3 actions to improve their resilience to cyber attacks.
But why are SMEs delaying taking action?
This is often not a reluctance to act, but rather a mix of behavioural, cultural and financial reasons which mean that cyber security may not be a priority for smaller and medium-sized organisations. Often this is because they are too busy focusing on growing a business with limited budget and resources.
Behavioural
Smaller organisations often believe that because of their size, cyber attackers would see less value in targeting them. They may think that an incident is unlikely to happen to them because it makes little financial sense to threat actors.
But threat actors see value in whatever they can get their hands on. Whether you’re an independent coffee shop, car showroom, or any smaller business, your data always has value to someone.
Your business could also be targeted for attackers to enter your wider supply chain, so if you do not have even the basic cyber security foundations in place, you could be leaving yourself and your supply chain vulnerable.
Cultural
For most businesses, working culture includes aspects such as diversity, employee wellbeing, transparency and career development. It may be that security has never been part of the wider discussion for work culture within small and medium-sized businesses, so it is not seen as important to include it.
Security is often viewed as the responsibility of the security or IT team. Changing this narrative across the organisation helps employees understand how their actions can impact security. Empowering and educating staff to recognise and report suspicious activity is also a cost-effective way to strengthen an organisation’s security posture.
Financial
Small and medium-sized businesses are competing against an abundance of other organisations within the same sector to keep their business running and make profit.
For smaller businesses, there is greater financial pressure to keep revenue coming in and deliver quality service to customers. A consequence of this is that security can be a lower priority.
The Cyber Security Breaches Survey 2025/2026 highlights that despite cyber attacks and breaches becoming more impactful across businesses, small businesses still took less measures to implement controls to protect themselves. This included a decrease in small businesses conducting cyber security risk assessments, having formal cyber risk policies in place, and having a business continuity plan that covers cyber security.
This raises concerns as cyber crimes are becoming more difficult for smaller organisations to handle, with the proportion of micro businesses able to recover from their most disruptive breach in less than a day falling from 92% to 86%.
The increased difficulty in recovery suggests the nature of attacks is evolving quickly, so SMEs can no longer delay taking action to protect themselves from these growing threats.
So what can SMEs do to better protect themselves against security threats?
Security doesn’t need to be expensive; it just needs to be effective and relevant to your business. Understanding what you are trying to protect and identifying the most critical assets in your business ensures resources are spent in an informed manner. Making sure that you do the basics well goes a long way in protecting your assets.
The UK Government and National Cyber Security Centre (NCSC) have lots of resources available for small and medium-sized businesses. Below we have listed some free schemes and tools available for you to get started with:
These tools are designed to help organisations who aren’t familiar with cyber security implement the foundations to protect themselves from common threats, and can be built upon gradually to improve your organisation’s cyber resilience.
If you are unsure how to start your security program, please get in touch with our team and our experienced consultants will be happy to take you through the process.
