America’s small business is not ready for a cyberattack

Some of the most high-profile cyberattacks against the US in recent years are said to have come from Russia, including the 2021 attack on the Colonial Pipeline — the largest fuel pipeline in the US — the 2020 SolarWinds attack and the 2016 Democratic Party account hack. National committee.

Since Russia invaded Ukraine in January of this year, the US government has warned heightened risk of a cyberattack that Russia could use to try and draw the US into a direct conflict. Despite the increased threat, small business owners are no more worried about a potential cyberattack than they were a year ago, and no more prepared to deal with it should it occur.

CNBC|SurveyMonkey Small Business Survey screens more than 2,000 small business owners quarterly to understand their views on the overall business environment as well as the health of their own business. AT last polljust 5% of small business owners said that cybersecurity is the biggest risk to their business right now.

Quarter after quarter, the number of those who cite cybersecurity as their top risk remains stable and is the lowest priority of the five surveyed. During the same period, the number of small business owners who consider inflation to be the biggest risk to their business increased from 31% to 38%, ranking first in terms of risk. Reports of supply chain disruptions and Covid-19 as the biggest risk have declined.

This latest round of small business research is the first since the Russian invasion of Ukraine, although international developments have not had a noticeable effect on US small business sentiment.

While this is not their main concern, nearly four in 10 small business owners say they are very or somewhat concerned that their business will be the victim of a cyberattack within the next 12 months. This trend has also continued for four consecutive quarters, with no change since the Russian invasion of Ukraine.

The smallest of small businesses are the least concerned about cyber attacks: just 33% of owners with 0-4 employees are concerned about a cyber attack during the year compared to 61% of small business owners with 50 or more employees.

Few small business owners rate cyber threats as their top business risk, and less than half consider it a problem, but the majority nonetheless express confidence in their ability to respond to cyber attacks. As in previous quarters, about six out of ten small business owners are very or somewhat confident that they will be able to quickly fend off a cyber attack on their business if necessary.

This general lack of concern among small business owners is at odds with the general public. AT SurveyMonkey’s own surveythree-quarters of Americans say they expect US businesses to be hit by a major cyberattack within the next 12 months.

Consumer expectations for cyber preparedness vary from industry to industry. Most people in general say they are confident that their banks (71%), their health care providers (64%) and their email service providers (55%) have everything they need to protect against cybersecurity threats; on the other hand, only 32% expect the social media platforms they use to be ready.

Similar results are observed in the sphere of small business. Small business owners in the financial and insurance industries are most confident that they will be able to quickly respond to a cyberattack; more than seven out of ten say they can repel an attack. Among those working in the arts, entertainment and leisure industries, this number drops to 50%.

This is important because any cyber attack, even if it is quickly resolved, can have long-term negative consequences for the business. Consumers would rather not be the victim of a cyberattack themselves, and they are wary of trusting companies that have been compromised in the past. According to a SurveyMonkey survey, 55% of US residents said they were unlikely to continue doing business with brands that were victims of cyberattacks.

For small businesses to really be ready, they need to take more concrete steps. Less than half said they installed antivirus or malware software, strengthened their passwords, or backed up files to an external hard drive to protect their business from potential cyberattacks. Only a third of them have enabled automatic software updates or enabled multi-factor authentication. Only one quarter have installed a virtual private network (VPN).

These are basic steps that most companies in corporate America would consider commonplace, but are admittedly much more expensive to implement in a small business environment. Small businesses that do not take the cyber threat seriously risk losing customers or even more if a real threat emerges.