The top SME security worries for 2025

Smaller businesses are just as vulnerable to cybersecurity issues as larger ones, more so in some cases as they have fewer resources to devote to protection.

New research from UK cloud services firm Six Degrees looks at the concerns of UK SMEs. It finds 35 percent cite AI-related threats as their top concern, outranking malware (25 percent), scams and other fraud (25 percent), phishing (25 percent), and ransomware (23 percent).

Other threats outside the top five, such as insider threat, zero-day vulnerabilities, and denial-of-service attacks, still present a significant danger.

"SMEs should definitely be concerned about AI-generated cyber-attacks, but that concern needs to be proportionate. For now, AI is an enabler for existing threats rather than a facilitator of new kinds of attacks. So, it's important to keep focused on those familiar cybercriminal tactics and not lower your guard. Take phishing, for example: AI could be deployed to create highly personalized spear-phishing emails -- dramatically speeding up attack rates and volumes. These attacks are likely to be far more effective and sophisticated and, therefore, a much bigger risk," says Vince DeLuca, chief executive officer at Six Degrees.

The research suggests that SMEs are acutely aware of these issues and are taking steps to address them -- often recruiting third-party assistance in the form of managed cybersecurity solutions. This approach appears to be paying off: almost a third of those who stated they had significantly improved their cyber security posture also reported increased adoption of cyber security tools and solutions, while 20 percent also report transitioning to hybrid or multi-cloud environments.

Almost 90 percent of SMEs believe their cybersecurity posture has improved in relation to the evolving risk landscape. But the report cautions that buying a cybersecurity tool or service does not guarantee improvements to cyber security posture.

"These solutions require the backing of an actively engaged IT or cyber security team to ensure they are utilized to their full potential. The cyber security tool or service purchase -- and its ongoing management -- has to form part of a broader strategy that informs business change in every single context. If you don't re-engineer your organization to be secure, no amount of tooling will fix it," adds DeLuca.

You can get the full report on the Six Degrees site.

Image credit: belchonock/depositphotos.com