Following a spate of attacks on UK businesses, BT has warned that UK SMEs are presenting a potential easy target for threat actors, as new research reveals two million businesses have undertaken no cybersecurity training.

BT’s study, released in partnership with Be the Business, reveals that two in five (39%) of SMEs have not arranged cybersecurity training for their teams, even as 42% of small businesses and 67% of medium-sized firms report having experienced a cyber-attack in the last twelve months.

The research revealed that the most common attack SMEs now face is phishing, with email scams targeting 85% of UK businesses, and QR code scams, or ‘quishing’ attacks, surging by 1,400% over the past five years

Meanwhile, even more damaging ransomware incidents have more than doubled in the last twelve months, and are now affecting one in every 100 UK firms. 

As cyber-attackers ramp up their onslaught, the impact of these incidents is becoming more severe, with recovery costing companies considerable time and money.

For micro and small businesses, these costs are particularly prohibitive, with firms forced to pay £7,960 on average to cope with their most disruptive breach and sometimes taking months to recover, making the financial hit that much worse.

Despite the threats to their livelihoods, BT found that less than half (46%) of business leaders turn to industry experts for cybersecurity advice. 

To try and close the gap, BT and Be the Business have released a new cybersecurity Action Guide, designed to help SMEs understand what practical steps they can take to protect themselves against cyber-attacks and educate them about next-generation threats.

Recommended reading

• • 1 in 4 SMEs Find Remote Working A Key Cybersecurity Concern
  • How Are SMEs Reacting to the Rise of AI and Increased Cyber Threats?
  • Cyber-attacks Cost UK SMEs £3.4BN a Year, Vodafone Says

Among the recommendations are the adoption of zero-trust security approaches, the prioritisation of meeting next-level quantum threats, and, perhaps most importantly, being careful to choose tech partners with proven expertise in secure AI implementation, not just general IT skills.

“The good news is that effective cybersecurity doesn’t require corporate-grade resources,” said Tris Morgan, managing director for security at BT.

“With the right training, basic security measures, and awareness, SMEs can dramatically reduce their risk profile. 

“The key is recognising that, in today’s digital landscape, cybersecurity is not a luxury but a foundation that enables companies to face forwards confidently, rather than forever looking over their shoulder.”