Report finds nearly two in five (38%) businesses have no cybersecurity budgets, or no plans to increase
Small companies are less likely to have cybersecurity budgets
Reputational damages can be as bad as financial losses

Despite the fact cyberattacks are coming closer to home, new research has claimed many companies are still failing to allocate enough time, money and resources to protection.

A report from ESET found as many as 15% of UK businesses don’t even have a cybersecurity budget, with a further one in four (23%) confirming they have no plans to increase cybersecurity investments despite growing threats.

All of this despite the fact UK businesses have lost a staggering £64 billion to cyberattacks over the past three years, with recent attacks on M&S and Co-op highlighting the severity of threats.

Businesses aren’t adapting to emerging cyber threats

Nearly half (45%) of the companies surveyed said they manage cybersecurity internally, without any third-party expertise, and only 8% have a standalone cyber insurance policy with around one-third (35%) banking on cyber threats being covered by broader insurance policies, and more than half not even having any such cover.

Smaller businesses are the least likely to have a dedicated cybersecurity budget (58%), while nearly all large companies have one (96%), suggesting this area is still being thought of as a luxury for those with spare cash and not a necessity.

Besides huge financial losses, like the £25 million a week M&S reportedly lost following its recent attack, ESET Global Cybersecurity Advisor Jake Moore explained that it can take months, even years, for businesses to recover from reputational damages.

“While some major brands have the recognition to weather the storm, many don’t, and for them, the damage can be far more difficult to undo,” Moore said.

Looking ahead, Moore calls for widespread collaboration between industries, cybersecurity providers and governments for countries like the UK to strengthen digital defenses.