Cybersecurity for SMEs: risks, threats and practical steps
Cybersecurity is essential for small and medium-sized enterprises. SMEs increasingly depend on cloud services, connected systems, digital supply chains and remote access, while often having limited time, budgets and specialist security expertise. This combination makes them an attractive target for cybercriminals.
A cyberattack can result in stolen data, disrupted production, financial losses and reputational damage. Fortunately, organisations can significantly reduce these risks by understanding their vulnerabilities and implementing appropriate security measures.
Why is cybersecurity important for SMEs?
Cyber threats affect organisations of every size, but their impact can be particularly serious for SMEs. Smaller organisations often have fewer dedicated cybersecurity specialists and may depend heavily on external IT service providers. At the same time, their systems and data can be just as valuable to attackers as those of larger companies.
Manufacturing companies face additional risks because office networks, production systems, machinery and external connections are increasingly interconnected. A security incident may therefore affect not only business data but also the continuity of production.
Research commissioned by the Dutch Cyber Security Council and conducted by Deloitte illustrates a broader challenge faced by SMEs across Europe. The study found that many smaller businesses lack sufficient cybersecurity awareness, insight into their risks and practical guidance on which measures to prioritise.
Common challenges faced by SMEs include:
- A shortage of cybersecurity expertise
- Limited time and financial resources
- Complex security guidelines and legislation
- Dependence on suppliers and other supply chain partners
- Limited visibility into vulnerabilities and suspicious activity
- A constantly evolving cyber threat landscape
These challenges do not mean that effective cybersecurity is beyond the reach of SMEs. The key is to prioritise measures based on the organisation’s actual risks instead of attempting to implement every available security solution.
What are the main cyber threats facing SMEs?
The cyber threat landscape continues to evolve. Cybercriminals use automated tools to scan organisations for known vulnerabilities, exposed systems and stolen credentials. They also use social engineering to persuade employees to disclose information, transfer money or open malicious files.
The most relevant cyber threats facing SMEs include:
- Ransomware
Malicious software that encrypts systems or data. Attackers may demand payment in exchange for restoring access or preventing stolen information from being published. - Phishing and social engineering
Fraudulent emails, messages or telephone calls designed to persuade employees to share credentials, open malicious attachments or make unauthorised payments. - Business email compromise
Attackers gain access to or imitate a business email account to redirect payments, send fraudulent invoices or obtain confidential information. - Exploitation of software vulnerabilities
Attackers exploit weaknesses in outdated software, internet-facing servers, VPN connections and other systems to gain access to an organisation’s network. - Credential theft
Stolen usernames and passwords are used to access cloud platforms such as Microsoft 365, especially when multi-factor authentication has not been enabled. - Distributed denial-of-service attacks
A DDoS attack overwhelms a website, server or online service with traffic, making it unavailable to legitimate users. - Supply chain attacks
Attackers compromise a supplier, software provider or business partner to gain access to other organisations within the supply chain. - Attacks on IT and OT environments
In manufacturing organisations, attackers may attempt to move from the corporate IT network towards operational technology and production systems.
The risks faced by each organisation depend on its systems, external connections, employees, suppliers and business processes. A cybersecurity assessment helps identify which threats are most relevant and where the most important vulnerabilities are located.
Would you like to learn how SBL assesses an organisation’s cyber resilience? Read more about our cybersecurity assessments.
What are the consequences of a cyberattack?
A cyberattack can have immediate and long-term consequences. The total impact is often much greater than the direct cost of restoring affected systems.
Financial consequences- Direct financial losses: Cybercriminals may steal money, redirect payments, send fraudulent invoices or demand a ransom.
- Recovery costs: Systems must be restored, the incident investigated and additional security measures implemented.
- Loss of revenue: Production downtime, unavailable services and cancelled orders can result in significant financial losses.
- Contractual claims: Customers or partners may seek compensation if the incident affects their operations or data.
- Production processes may be interrupted
- Employees may be unable to access essential systems
- Orders, logistics or customer services may be delayed
- Backups may be damaged, encrypted or made unavailable
- Customers and supply chain partners may also experience disruption
- Organisations may be required to report personal data breaches under the GDPR
- Customers or partners may take legal action following the loss or misuse of their data
- Organisations within the scope of NIS2 may be subject to additional cybersecurity and incident-reporting requirements
- Requirements may also be imposed through contracts or by customers within regulated supply chains
- Negative publicity can damage the organisation’s reputation
- Customers may lose confidence in the organisation’s ability to protect sensitive information
- Business partners may introduce stricter security requirements
- The organisation may lose opportunities to work with larger or regulated customers
How can SMEs improve their cybersecurity?
Improving cybersecurity does not begin with purchasing as many security tools as possible. It begins with understanding which systems, data and business processes are critical and determining where the most significant risks exist.
Important measures include:
- Conduct a cybersecurity assessment.
Identify vulnerabilities, outdated systems, unnecessary external connections and gaps in existing security controls. - Keep software and systems up to date.
Install security updates promptly and maintain an accurate overview of the hardware and software used throughout the organisation. - Use multi-factor authentication.
Protect Microsoft 365, remote access, administrator accounts and other critical services with more than a password alone. - Limit access rights.
Employees and suppliers should only have access to the systems and information they need to perform their work. - Protect and test backups.
Maintain secure backups that cannot easily be accessed or encrypted by an attacker. Test regularly whether data and systems can be restored. - Separate IT and OT networks.
Manufacturing organisations should prevent unnecessary connections between office systems, production networks and external parties. - Train employees.
Help employees recognise phishing, fraudulent payment requests, suspicious attachments and unusual login notifications. - Monitor systems and network traffic continuously.
Continuous monitoring helps detect suspicious behaviour before it develops into a major security incident. - Prepare an incident response plan.
Define who must take action during an incident, which systems should be isolated and how customers, suppliers and authorities will be informed.
Cybersecurity and NIS2 within the supply chain
Cybersecurity is no longer relevant only to organisations that are directly regulated. Larger companies increasingly require suppliers and business partners to demonstrate that appropriate security measures are in place.
NIS2 strengthens cybersecurity requirements for organisations operating in important and essential sectors within the European Union. Although not every SME falls directly within its scope, smaller suppliers may still face additional security requirements through contracts and supply chain relationships.
This means SMEs may increasingly be asked to demonstrate:
- How cyber risks are identified and managed
- Which technical and organisational security measures are in place
- How incidents are detected, reported and handled
- How access by employees and suppliers is controlled
- Whether backups and recovery procedures are regularly tested
Strengthening cyber resilience therefore helps SMEs protect their own operations while also meeting the expectations of customers and supply chain partners.
Cybersecurity as part of your business strategy
Cybersecurity should not be treated solely as an IT issue. It directly affects operational continuity, customer confidence, compliance and the ability to work with larger organisations.
Stef Liethoff, founder of SBL Cyber Monitoring, explains:
“We see that organisations gain greater confidence from major customers when they can demonstrate that their cybersecurity is properly managed. Regular assessments and continuous network monitoring provide assurance that cyber risks are being identified and addressed.”
When an organisation can demonstrate its cyber resilience, cybersecurity becomes a strategic advantage. It helps protect existing operations and can make it easier to win new customers and participate in demanding supply chains.
Start by understanding your cyber risks
Every organisation has a different IT environment, threat profile and level of cyber maturity. An assessment provides a practical starting point by identifying the most important risks and determining which improvements should receive priority.
SBL Cyber Monitoring helps SMEs assess their cyber resilience and continuously monitor their IT and OT environments. This enables suspicious activity to be identified earlier and allows organisations to respond more effectively when an incident occurs.
