The latest DSIT Cyber Security Breaches Survey found that 43% of UK businesses identified a cyber breach or attack in the last 12 months, affecting an estimated 612,000 businesses. The same survey also points to weakening risk management practices among smaller firms, with cyber risk assessments, formal policies and business continuity planning all falling year on year.

The data points to a real legal and reputational risk for directors and management teams. A breach can lead to a customer alleging that their personal data was mishandled or a supplier arguing that commercially sensitive information was exposed. An employee may claim that their personal payroll, HR or identity data was taken. In each case, the company may face a claim for damages, defence costs and associated disruption.

Mark Lowther, (pic)  head of technology and Cyber Underwriting at Markel, said: “Many SMEs still think about cyber primarily as an IT risk, but the consequences of a breach can be much wider. If a third party suffers a loss because data has been compromised, the business may be asked to defend their data decisions, controls and governance that led to the incident.”

The risk is typically not a sophisticated attack. Phishing was the most common breach or attack by far, experienced by 38% of businesses and 25% of charities in the last 12 months. It was also seen as the most disruptive type of breach or attack. Among organisations that experienced a breach or attack, 69% of businesses and charities said phishing was their most disruptive incident.

The challenge is also growing as more businesses adopt artificial intelligence. DSIT found that 31% of businesses had adopted, were adopting or were actively considering AI tools, yet only 24% of that group had cyber security practices in place to manage the associated risks.

AI tools have the ability to process, analyse and store large volumes of data. Used without clear governance, such tools may create uncertainty over where information is held, who can access it, whether data has been shared with third party providers and if employees understand what information should never be entered into the system.

“AI can create real benefits for SMEs, but adoption has to be matched by governance,” added Lowther. “If a business uses new tools without reviewing data protection, access controls, staff guidance and supplier risk, it could increase its exposure if third party data is later compromised.”

The DSIT findings also show why cyber resilience cannot be treated as a one off exercise. Risk assessments need to be revisited as the business changes and policies reflect the systems and tools employees actually use. Continuity should look to account for data loss as well as system downtime. Incident response plans are another consideration. These need to exist in the first place, and then explain who takes decisions, contacts affected parties, manages regulatory engagement and communicates with customers.

A data incident may require defence under the Data Protection Act 2018 or UK GDPR, as well as support where a third party seeks compensation. In some cases, compensation may depend on the claimant alleging a specific financial loss. These distinctions matter, because the costs of responding to a claim can become significant even where the underlying allegation is disputed.

“Management teams should be considering four key questions,” continued Lowther “What third party data do we hold? What could happen if it was lost, stolen or wrongly disclosed? Could we evidence the steps we took to reduce that risk? Where those steps as robust as they should have been?”

The answers can reveal important gaps such as contracts not clearly defining data responsibilities. Employee access rights may not have been reviewed in a timely manner and data storage and backups may not be tested frequently enough. And when it comes to AI, usage may be happening informally without sufficiently documented rules.

None of these issues means a business has acted without due consideration – SMEs are under constant pressure to move quickly, adopt useful technology and manage costs. But after a breach, informal arrangements will be harder to defend.

“Robust preparation shapes the impact of the, the response and the liability position,” Lowther said. “A business that can show it understood the risk, reviewed its controls and had a plan in place will be in a stronger position than one trying to reconstruct its governance after the event.”

The message for SMEs is a simple one. Cyber security is not just about protecting the company’s own systems. It is about reducing the company’s liability by protecting the people and businesses whose data the company holds.