More and more companies in the Netherlands have had to deal with cybercrime at some point, according to research by Abn Amro among 233 business customers who are ultimately or partly responsible for their company's cyber security. By 2023, more than three quarters of companies are affected, compared to 'only' 45 per cent at the beginning of last year.
The increase among SMEs is striking: 80 per cent of them have now been targeted by cyber criminals. With this, attacks in the SME segment have for the first time penetrated deeper than in large companies, 75 per cent of which have experienced cybercrime. Big business was still significantly more attacked than SMEs last year. Now criminals seem to be shifting their focus to smaller vulnerable companies, according to Abn Amro.
Shift towards SMEs
Although the cyber threat among SMEs has increased significantly, their risk perception lags behind the actual threat. For instance, only 29 per cent of SMEs see cybercrime as a major risk, the same level as last year. Among large companies, the high risk perception does show a clear increase: from 41 to 64 per cent of companies.
Cybercriminals are fast and creative
While many companies are rapidly expanding their IT landscape, criminals are also adding more and more innovative technologies to their modus operandi. For instance, artificial intelligence helps them crack passwords at lightning speed, shape convincing 'phishing' campaigns, and create malicious programmes that improve themselves automatically. Consequently, the attacks come in many guises.
Phishing and malware
'Phishing' is the most common: almost two-thirds (66 per cent) of companies have encountered it at some point. Through e-mails, text or WhatsApp messages and phone calls, people are enticed to perform an action that later turns out to be harmful. A good proportion of companies also have experience with malware (38 per cent). The spread of these malicious programmes is easy in an age where access to software and software components is achieved with a few clicks of the mouse. Because developments are so rapid, companies risk falling behind the hacker community.
Suppliers
Malicious actors are increasingly targeting IT suppliers, such as cloud companies, IT service providers and software developers. Disruptions in a company's IT landscape can affect both its own operations and those of chain partners. Also, vulnerabilities in IT systems are a potential entry point to a larger group of victims.
Chain-wide approach needed
"To contain the increasing threat of phishing, malware and ransomware, a chain-wide approach is required. However, this urgency is not yet sufficiently felt. Small businesses in particular are not adequately arming themselves against this form of crime," said Julia Krauwer, Sector Banker Technology, Media and Telecom at Abn Amro.
European regulation
“The need to scrutinise supply chain partners will be further reinforced by new European regulations on cyber security. NIS2, the successor to the earlier Network and Information Systems Directive (NIS), encourages companies to set out cybersecurity arrangements contractually with their direct suppliers and partners. They must therefore pay close attention to their own cybersecurity policies in order to be able to answer critical questions from partners effectively. Companies that do not have their cybersecurity properly in order – and these are primarily small businesses – risk sidelining themselves.”
See also: Cyberattacks against industrial companies on the rise
