Marsh Report Highlights Cybersecurity Gap Between SMEs and Large Organisations in the EU
Marsh, a leading global insurance broker and risk advisor, part of the Marsh McLennan family, has unveiled significant findings indicating that small and medium-sized enterprises (SMEs) in the European Union (EU) are, on average, lagging 15% behind their larger counterparts in implementing effective cybersecurity controls. This insightful report, titled “Why the Cybersecurity Gap Between SMEs and Large Organisations Matters,” sheds light on the various challenges that SMEs face in striving for cyber resilience, especially in contrast to larger organisations.
The comprehensive analysis encompasses data from 320 organisations across the EU, categorised by annual revenue: SMEs with revenues below €51 million, mid-sized firms earning between €51 million and €250 million, and large organisations with revenues exceeding €250 million. Utilizing Marsh’s innovative Cyber Self-Assessment tool, the report evaluates the execution of 12 essential cybersecurity control categories.
According to the findings, larger organisations demonstrate a markedly higher effectiveness in implementing cybersecurity measures compared to SMEs. On average, large organisations achieved a score of 80% in applying the 12 cybersecurity controls, while SMEs managed a score of only 65%. For instance, a notable 91% of large organisations enforce multi-factor authentication for remote logins, in stark contrast to just 75% of SMEs adopting the same practice.
The report also uncovers a significant shortfall in the regular testing of incident response plans. Only 40% of SMEs engage in routine testing of their incident response strategies, compared to 61% of larger organisations that conduct such practices. Despite some progress in incident response capabilities, SMEs and mid-sized businesses continue to fall behind their larger counterparts.
Moreover, the report highlights considerable industry-specific disparities: while an impressive 85% of finance-related SMEs provide cybersecurity training to their employees, only 58% of those in the manufacturing sector offer similar training opportunities. This inconsistency underscores the varying levels of awareness and preparedness across different industries.
Marsh emphasizes the critical need for SMEs to actively participate in the burgeoning cyber insurance market. Many SMEs currently find themselves either uninsured or underinsured, leaving them at heightened risk for cyber threats. Although traditional barriers to accessing sufficient coverage have historically existed, recent market innovations present SMEs with a significant opportunity to bridge this protection gap.
Gamze Konyar, Head of Cyber at Marsh Europe, remarked, “SMEs are crucial to the national infrastructure, and their cybersecurity vulnerabilities can precipitate financial losses and data breaches, jeopardizing economic stability and public trust. As vital components of the supply chain, they can also introduce risks to larger enterprises. It is essential to foster collaboration aimed at closing the cybersecurity divide for SMEs and to craft tailored solutions from the insurance market.”
Typhaine Beaupérin, Chief Executive Officer of the Federation of European Risk Management Associations (FERMA), added, “As cyber threats continue to evolve, this report underscores the urgent necessity for all organisations, especially SMEs, to bolster their cybersecurity measures to ensure resilience. It advocates for heightened awareness, education, and support for robust cybersecurity practices, calling on key stakeholders—governments, industry associations, and larger organisations—to provide resources and collaboration opportunities to enhance the cyber resilience of SMEs.”
Source: Reinsurance News
