Successful cyberattacks are costing Irish SMEs an average of 34 hours in operational disruption and placing additional pressure on growth, investment and commercial opportunities, according to the latest Hiscox Cyber Readiness Report. The research was conducted by Wakefield Research for the business insurance provider on a sample of cyber security decision-makers in 300 businesses with fewer than 250 employees.
Among Irish businesses affected by a successful attack more than a third (36%) lost business opportunities or partnerships; a similar number (34%) delayed growth, expansion or new business initiatives; the same number suffered a negative impact on financial performance, valuation or credit rating; and just under a third (32%) delayed the adoption of AI or other new technologies.
Ciara Weldon, senior development underwriter, Hiscox Ireland, said: “Cyber security is no longer simply a technology issue. For an SME, losing almost a full working week to disruption can mean delayed orders, missed opportunities, pressure on cash flow and valuable management time being diverted away from customers and growth.
“Smaller businesses often face many of the same sophisticated threats as larger organisations, but without the same depth of in-house cybersecurity, fraud-prevention or compliance resources. That makes preparation, clear responsibilities and access to the right support particularly important.”
The report also indicated that responsibility for cyber security was becoming more firmly embedded at leadership level.
More than one in three businesses affected by a successful attack (36%) linked leadership compensation or performance measures to cyber security goals. A further 34% increased their use of external cyber security expertise as a result, while 33% created or updated cyber crisis-response plans.
Weldon continued: “Business leaders do not need to become cybersecurity specialists, but they do need to understand the potential consequences of an incident and ensure clear responsibilities, appropriate controls and tested response arrangements are in place.
“For SMEs, responsibility for cybersecurity may be shared across leadership, operations, IT and trusted external advisers, which makes clarity around roles and response planning particularly important.”
Trust, continuity and commercial relationships at risk
Almost half of respondents (48%) ranked reputational damage or loss of customer trust among their greatest business risks.
Operational downtime or business interruption and supply chain or third party disruption were each identified by 47%, while 46% included regulatory compliance among their leading concerns.
The findings reflect the growing reliance of Irish SMEs on digital systems, cloud services, payment providers and external technology partners. An incident affecting a supplier or service provider can disrupt a business even where its own systems have not been directly compromised.
Weldon said: “The wider impact of an attack can continue long after systems are restored. A cyber incident can affect financial performance, business relationships, customer confidence and the ability to move forward with new investment or expansion.
“That is why cyber resilience needs to be treated as a core business discipline rather than an issue owned solely by the IT department.”
Businesses investing in resilience
Irish businesses are responding to the evolving threat environment. More than two-thirds (68%) of respondents said they were updating the cyber security training provided to employees; more than half (57%) were investing in cyber security software; and more than two-thirds (67%) currently have cyber insurance.
Weldon added: “The businesses making the greatest progress are those that treat cyber resilience as a combination of people, technology and process. For SMEs, that does not necessarily mean complex governance structures or major technology investment. Clear responsibilities, practical employee guidance, proportionate controls and a tested response plan can make a meaningful difference.
“Preparation is also about more than trying to prevent every possible attack. Businesses need to know how they will respond, who they will contact and how they will restore operations quickly.
“Cyber insurance should be considered as part of a wider resilience strategy. Alongside financial protection, its value can include rapid access to forensic specialists, legal advisers, crisis communications support and recovery expertise when time is critical.”
TechCentral Reporters
Ltd
