Vulnerable SMEs: One in four SMEs is at very high risk of suffering a cyberattack

SMEs face a high level of risk across the board

One of the main conclusions of the study is that 1 in 4 SMEs is at very high risk of suffering a cyberattack. Targeted intrusions and privilege escalations (threats arising from the misuse of accounts with high privileges or external attackers who have managed to escalate privileges) top the list of the most dangerous cyber threats, and 100% of SMEs are exposed in the initial stages of access due to poorly managed privileges.

Despite the increase in ransomware and malware (a set of threats based on the installation of malicious code in an organization's systems) in recent years, only 6% remain low exposure to this type of incident, a figure that stands out when compared to 35% in countries such as the United Kingdom or the United States. However, the study shows us extreme inequality in the cybersecurity landscape in Spain. On the one hand, we find SMEs that are totally vulnerable or have a very low level of security, coexisting in the same ecosystem with companies that do have more robust defenses.

The most common pattern is that of areas that are reasonably covered at some stages, alongside areas that are completely vulnerable and neglected. More than inequality, it is absolute heterogeneity. In this sense, the study highlights some critical shortcomings in the digital protection of Spanish SMEs. On the one hand, only 18% of companies manage to effectively limit the installation of malware on their key devices, leaving the rest exposed to infections that can spread unchecked. On the other hand, we find something even more worrying, as less than 10% have adequate mechanisms in place to manage the final impact, which implies a very limited response capacity in the event of serious incidents.

In addition, one in four businesses allows malicious tools to be executed once the attacker has passed the initial access phase, demonstrating a lack of containment at critical stages of the attack. Added to this is an alarming lack of technical surveillance: only 5% of SMEs conduct external security audits or have deployed specific firewalls for their web applications (WAF), key elements for detecting vulnerabilities and stopping attacks in real time.

These data confirm that, despite some awareness of the risk, the implementation of effective measures remains very low, especially in the most sensitive and vulnerable environments.

Recommended measures for protecting SMEs

These data confirm that, despite some awareness of the risk, the implementation of effective measures remains very low, especially in the most sensitive and vulnerable environments.