Small and medium-sized business owners beware: Cyber threats are on the rise, according to new research from Mimecast. In fact, Mimecast’s new Threat Intelligence Report finds that medium-sized companies specifically have seen an uptick in threats by more than 21% in Q3 – a trend that Mimecast expects to continue growing into 2024.
Users at small- and medium-sized companies face a greater number of threats than their larger counterparts because opportunistic attackers tend to see smaller companies as easier targets for phishing and ransomware campaigns. Further, they’re often good third-party launching points from which to compromise larger partner companies. In addition, because of their smaller size, email threats targeted at specific internal groups, such as accountants or developers, will have an outsized impact on smaller companies. Overall, attackers see mid-sized companies as a profitable combination of vulnerability and potential cash value.
For CISOs and security managers, this seemingly modest number of threats can quickly overwhelm their resources when multiplied across the entire employee base, especially because attackers only need a single success.
The report concludes with general and threat-specific countermeasures small- and medium-sized businesses can adopt including; mandating more security from third parties, scanning external network for open ports, blocking images in email messages, and segment the network & log internal traffic, among many others.
SME cyber trends observed by Mimecast include:
- On average, users saw more non-spam, non-malware threats in Q3 2023 compared to Q2 2023.
- Attackers’ use of PDF and Microsoft Excel formats is growing by 158% and 86%, respectively.
- Attackers returned to pre-pandemic targets in Q3 2023, focusing on the internal groups and external services that are critical to business operations.
- Cybercriminals are exploiting known vulnerabilities to launch attacks far faster than most organisations can patch their systems.
- Attackers are increasingly using major providers’ cloud services to launch attacks, with an increasing amount of spam and phishing coming from public domains, such as gmail.com and outlook.com.
Also read: Impersonation scams on the rise: know the red flags
