In the last 12 months, the total cost of cyber security breaches to UK mid-market businesses has reached at least £30 billion, according to an audit and accountancy firm.
More than half (53pc) of the companies interviewed by Grant Thornton UK LLP reported losses equivalent to 3-10 per cent of revenue following a cyber-breach. For those businesses hit most severely, losses can reach up to 25 per cent of revenue. Six per cent of the businesses surveyed reported a loss of this size (11 to 25pc of revenue). Despite this, the research found that almost two thirds (63pc) of the companies interviewed had no board member with specific responsibility for cyber security. Sixty-three per cent of those questioned also said that the board does not formally review cyber security risks and management.
The organisations interviewed were also under-prepared in terms of making their people aware of cyber risks, with only one in three (36pc) providing all their employees with cyber security training in the last 12 months.
James Arthur, partner and head of cyber consulting at Grant Thornton, said: “Boards have a key role to play in ensuring an effective cyber strategy is in place. Putting cyber-crime onto the board’s agenda is one of the most effective ways to minimise the chances of a successful attack and reduce the financial impact if a breach occurs. With that in mind it is worrying that almost two thirds of the businesses we interviewed do not have a board member responsible for cyber security.
“While commitment from the top is vital, ensuring your people are properly trained is also essential. Often, companies make themselves vulnerable to attack simply by failing to get the basics right. Training to raise employee awareness can have a hugely positive impact on cyber security. People are often unaware of the important role they play in helping a business to stay protected, so companies of all sizes need to ensure they have regular and ongoing cyber security training in place.”
Almost 70 per cent of the respondents felt confident in their ability to respond consistently at any time to a cyber-attack across their entire organisation. Over half of the businesses surveyed do not have a cyber incident response plan in place (59pc). Companies that have an incident response plan in place experience lower financial losses from a cyber-attack than those that don’t, the research found.
James Arthur added: “Cyber-crime represents a serious threat to every UK business and, as our research shows, just one successful attack can amount to a huge revenue loss. Mid-market companies are particularly vulnerable as they have a level of resources that make them an attractive target but are less likely to implement best-in-class cyber security compared to larger companies.
“Businesses need to understand where their weak points are in order to counter the threat effectively. Yet our research shows that perceived and actual vulnerability often don’t match up, with many businesses feeling confident in their cyber management capacity but having no meaningful response plans in place. A pre-prepared, effective response plan allows a business to do the right thing as fast as possible, in a situation where every minute counts.
“Many companies are relying on regular data backups to be able to recover rapidly from cyber incidents but with modern ransomware specifically designed to spend up to six months infecting entire networks, including data backups, this cannot be relied upon as a core component of a response plan.”
The report identifies six key areas that mid-market boards should be focusing on to ensure they are properly prepared, including;
establishing a cyber incident response plan
regularly rehearsing the response plan using a range of different scenarios
monitoring and managing the risk posed from their supply chain
ensuring they understand the terms of their insurance and what is covered
understanding what ‘normal’ looks like for their business, in terms of application usage, so they can identify any unfamiliar patterns
investing in regular training and raising their people’s awareness of cyber security.
James Arthur said: “Effective cyber-security does not need to cost the earth and goes beyond simply investing in new technology. There are simple, specific steps companies can take, such as implementing a meaningful cyber response plan and understanding what is ‘normal’ for their business, to put themselves in a much stronger position. Cyber risk management should be fundamental for every business striving to grow in a connected, digital world and boards need to recognise its importance. No business – whatever its size or sector – is immune.”
Comment
Rob Norris, VP Enterprise and Cyber Security, Fujitsu said: “A £30bn loss to UK mid-market businesses is staggering and highlights the work that still needs to be done across the board to minimise the financial cost of cyber-attacks. It’s not just the money, though; a whole company’s reputation is now on the line if discovered to have been breached and inadvertently given away sensitive information. Mid-market companies comprise the bellwether of the UK economy and should have the measures in place to reflect that.
“Perhaps the most surprising – and worrying – aspect of the report is that only a third of employees have had cyber security training in the last 12 months. Human error is one of the most common and most preventable causes of a cyber breach, but requires a culture of security understanding from the top down. Without cyber security being mission critical in the boardroom, it’s not going to trickle down to the employees. Every department and every employee needs to be adequately up-skilled – there should be no excuses in 2019.”
