UK SMBs experienced a 37% surge in daily cybersecurity warnings over the last year, according to research from cybersecurity provider, Censornet.

The volume of cybersecurity warnings rose from 597 in 2013 to 815 in 2024, leaving security professionals with just 87 seconds to review each security incident and decide what is a genuine threat.

Private sector organisations were hit harder by the tsunami of cyber threats, receiving 18% more alerts than their public sector counterparts. As threat levels rose, IT teams also showed signs of shrinking – the mean size of each security team at the beginning of 2024 was 2.63 people, slightly down from 2.7 people in 2021.

The findings based on insights from 200 UK-based IT and security leaders revealed that a SMBs are surrounded by cyber incidents, with security professionals taking the brunt of the stress.

Cyber Incidents Hit from All Sides

SMBs are suffering from a variety of cyber incidents, ranging from data breaches to ransomware.

Two in five (41%) SMBs had to take their systems and applications offline due to an incident over the last year. For one in seven of those, (14%) the outage lasted more than a day.

Data loss affected nearly two in five (39%) of SMBs due to a cyber-attack in 2023, a 13% jump since 2021.

Nearly a third (30%) of SMBs also lost data due to user error in the last 12 months and 27% lost data due to disgruntled employees.

Further, one in five fell victim to ransomware, with the pace of attack remaining consistent over the last three years.

The research also showed that 34% of SMBs paid out after a ransomware attack, with the average pay-out standing at £139,368. One if five were subjected to a regulatory fine as a result of paying out.

Human error is also plaguing SMBs, with nearly a quarter (23%) experiencing an email attack, with employees opening a suspicious or malicious email that led to a serious attack.

Security Professionals Paying the Price 

Security professionals are bearing the brunt of cyber incidents, often working overtime.

44% of private sector security professionals have been called in the middle of the night to investigate a cyber alert, compared to 28% in the public sector.

Further, 34% have had their holiday interrupted, with 40% of private sector professionals handling a security alert during annual leave, compared to 23% in the public sector.

32% feel unable to cope with the unsustainable workload risk UK SMs suffering from significant financial, operation, and reputational damage with only 60% of alerts fully investigated.

Security professionals also feel stuck – around a third (29%) think their career prospects have been negatively impacted because of a cyber-attack, jumping from 18% last year.

“Cybersecurity professionals are working hard to discern genuine threats from noise – sacrificing sleep, holidays, and career stability,” commented Ed Macnair, CEO of Censornet. “With SMBs forming the lifeblood of the UK economy, it’s imperative to simplify and bolster their resilience against rising cyberthreats, leaning into new technologies, such as AI, to help.”

SMBs Struggle to With Sprawling Security Solutions

Despite the rising intricacy and persistence of threats, the ability of SMBs to protect against some of the most common attack vectors is on the decline.

Over two thirds (69%) of SMBs list the number of point products needed to protect against the entire threat spectrum as one of their biggest challenges in 2024. And the patchwork of multiple solutions SMBs are turning to are weakening defences.

Defence adoption appears to be down. 30% can protect against cross channel attacks, down from 37% in 2021. Similarly, 47% of SMBs can block ‘dangerous attachments from reaching the inbox of users, down from 51% in 2021.

Recommended reading

• What is the Current Data Telling Us About Cyber-attacks?
• Strong Cybersecurity Key to AI Superpower Ambitions, Microsoft Says
• 75% of UK Businesses Had a Cyber Incident Last Year

Further, only a third (33%) can quarantine suspicious emails, down from 35% in 2021. While 47% have data loss prevention, which is up one percent from last year, this is still less than half of surveyed SMBs.

SMBs Look to AI With Hope

To manage their risk, SMBs are turning to cyber applications that are easier to set-up, manage, and maintain.

Overwhelmed private sector professionals are more hopeful about the opportunities that AI will offer to automate everyday tasks and combat AI generated threats.

Over half (56%) of private sector SMBs will use AI to fight threats, but only a quarter (26%) of public sector SMBs will use AI to combat threats despite the opportunity it offers to automate everyday tasks.

Over half (51%) of private sector SMBs hope that AI will alleviate workloads by responding to security alerts. While 49% think it will boost cyber defences by freeing up team time to proactively investigate risks.

A third (32%) of public sector SMBs think AI will respond to security alerts and 35% think it will boost their cyber defences by freeing up time to proactively investigate threats.

Neil Langridge, marketing & alliances director, e92plus said: “The rapid growth of AI, the increasing complexity of cloud environments and the expanding potential attack surface creates additional openings for security vulnerabilities, misconfigurations, and exploits. Adopting a cybersecurity perspective that emphasises controls rather than merely tools will be essential for effectively managing technology estates.”