Many small business owners believe their cyber security is stronger than it really is. New Australian research now backs that up with evidence. The SME cyber security gap is wider than many people expect.
I recently attended CyberCon and sat in on a session by Alladean Chidukwani, PhD. His research paper is titled “Beyond self-reporting: Uncovering the operational realities of SME cybersecurity through expert assessment”. The journal Computers & Security published it, and you can read the full paper on ScienceDirect.
I have worked with small and medium businesses for more than 20 years. Much of that time goes into responding to cyber incidents. As a result, his findings matched what I see in the field. Below, I share the key takeaways and explain what they mean for your business.
What I learned at CyberCon
After the session, I had a great conversation with Alladean about his presentation and report. We compared notes on how small businesses really manage security. His data confirmed something I have seen for two decades.
When we investigate an incident, we work out how the attacker got in. Time and again, a gap exists between what the business thought it had and what was really in place. That gap gives the attacker the opportunity they need. For that reason, it is rarely a minor detail. It is often the root cause.
What is the SME cyber security gap?
The SME cyber security gap is the difference between the protection a business believes it has and the protection it actually has. SME stands for small and medium-sized enterprise. The Australian Bureau of Statistics defines it as a business with up to 199 employees.
Small businesses carry a lot of weight in our economy. The paper cites figures showing that SMEs make up 99.8 per cent of Australian businesses and contribute about 55 per cent of GDP. Meanwhile, criminals often target them as a stepping stone to larger partners. Therefore, a weak small business can put its customers at risk too.
How the researchers tested the SME cyber security gap
Most cyber security surveys simply ask owners how they are going. However, people tend to answer with optimism. Alladean and his co-authors, Sebastian Zander and Polychronis Koutsakis from Murdoch University, wanted proof instead.
They revisited eight Western Australian businesses that had completed an earlier survey. Over 14 months, the team combined four methods:
- Site visits and direct observation
- Interviews with key staff
- Reviews of policies, network diagrams and other documents
- Non-intrusive network vulnerability scans
Next, they checked 58 security controls against the NIST Cybersecurity Framework (CSF). Finally, they compared each claim with the evidence. The results were sobering.
Key takeaways on the SME cyber security gap for business owners
Here are the findings I think every owner should know.
- The overall picture was worrying.
On average, 72 per cent of controls were missing or only partly in place. Detection was weakest, with gaps in 79 per cent of controls. In other words, many of these businesses would struggle to spot an intruder. - Your IT provider is not always your security provider.
Several owners assumed their IT support company handled cyber security. However, the contracts often covered basics such as backups. One contract promised worry-free security, yet it covered a single detection service. - You cannot protect what you have not listed.
Five of the eight businesses believed they kept an asset inventory. Yet those lists were far from complete, and servers, mobile devices and cloud apps were often missing. Six businesses also had no network diagram. - Patching skipped printers and older devices.
Network printers sat outside patching at every business. One site ran a forgotten kiosk on Windows 7, and management did not realise it was a networked computer. The researchers think it may have been the way in during an earlier attack. - Multi-factor authentication (MFA) was patchy.
Several businesses reported using MFA, but it was often optional or limited to cloud services. One business sent every SMS code to the same phone number. Because attackers hunt for the weakest login, partial MFA still leaves a door open. - Nobody had trained staff to spot phishing.
That is striking, since every business used email. The authors note that free resources from the Australian Cyber Security Centre could cover the basics. - Cyber incident planning lagged behind.
Five businesses had no formal incident response protocol. None had a full recovery plan for a cyber incident, and only one held cyber insurance. In addition, one business had never backed up its data because it assumed its cloud provider did. - Privacy duties were poorly understood.
One business above the $3 million turnover threshold did not know about its Notifiable Data Breaches reporting duties. Some health providers also did not realise they are covered automatically. Meanwhile, none of these businesses had a customer notification plan.
A fair caveat applies. The study covered eight businesses in Western Australia. The authors also note that volunteers may have been more security-minded than average. So the SME cyber security gap elsewhere could be even wider.
Why the SME cyber security gap leads to cyber incidents
An attacker does not need to beat your best defence. Instead, they only need to find the control you assumed was working. For example, that could be an unpatched device, a login without MFA or a backup nobody tested.
During our incident response work, we investigate how each attack happened. The root cause often sits inside this gap. The business believed an area was covered, so nobody checked it.
This is why optimism is risky. The researchers link overconfidence to optimism bias, limited time and limited expertise. In short, good intentions are not a control. Evidence is.
How to close your SME cyber security gap
The good news is that you can close your SME cyber security gap with clear, practical steps. Start here:
- Get an independent view. Self-assessment misses things, as this research shows. A security assessment compares what you believe with what is true.
- Find your weak points. A vulnerability assessment locates unpatched systems, including printers and older devices. Then a penetration test shows whether an attacker could use them.
- Build an asset list. Record every device, server and cloud app, and keep a simple network diagram.
- Turn on MFA everywhere. Cover every internet-facing login, not just email.
- Train your team. Regular cyber awareness training helps staff spot phishing early.
- Plan for the worst. Write a cyber incident response plan and practise it before you need it.
- Follow a recognised framework. The NIST CSF and the Essential Eight give you a clear roadmap.
- Improve detection. Cyber security monitoring helps you notice attacks sooner.
Use Google Workspace? Then check its settings and backups too. Download our free Google Workspace Security Playbook to get started.
How to choose a cyber security partner
Perhaps you are asking who is a good company to work with for cyber security help. These questions make it easier to compare providers:
- Does the provider separate IT support from cyber security in writing?
- Do they have hands-on incident response experience?
- Can they test your defences, not just review your paperwork?
- Will they train your people as well as check your technology?
- Do they work to recognised frameworks such as the NIST CSF and the Essential Eight?
- Will they explain findings clearly and rank what to fix first?
Sentry Cyber is an Australian cyber security company that helps small and medium businesses find and fix weaknesses. We deliver small business cyber security services that include risk assessments, penetration testing, incident response and compliance support. Our work with SMEs spans more than 20 years, and incident response is a large part of it.
How Sentry Cyber helps you close the SME cyber security gap
Each service below targets a gap the research uncovered:
- Security assessment: a review of your controls against reality
- Vulnerability assessment: finds weaknesses across systems and devices
- Penetration testing: safely tests whether attackers can break in
- Incident response: fast help and investigation when an attack happens
- Cyber awareness training: teaches staff to spot and report threats
- Security monitoring: helps detect suspicious activity sooner
- Compliance and certification: supports NIST CSF alignment and other standards
- Essential Eight assessment: reviews your position against the Essential Eight
- Google Workspace security: secures and backs up your Google environment
- AI security and risk assessment: reviews the risks of using AI tools in your business
- Security consulting: practical advice tailored to your business
Conclusion: close the gap before an attacker finds it
Alladean’s research delivers a clear message. Confidence is not the same as evidence. The SME cyber security gap can sit quietly in any business, and attackers know how to find it.
The best next step is an expert check. Sentry Cyber can assess your environment, whether you need a cyber security risk assessment, a penetration test, a Google Workspace assessment or something else. We will show you what is really in place and what to fix first.
Request your expert assessment today. While you are here, download the free Google Workspace Security Playbook.
Frequently asked questions
What is the SME cyber security gap?
It is the difference between the security a small or medium business believes it has and what is actually in place. Research from Murdoch University found that SMEs consistently overstated their cyber security maturity.
Why do small businesses overestimate their cyber security?
Optimism, limited expertise and tight budgets all play a part. Many owners also assume their IT provider handles security, so nobody checks the details.
Is my IT provider responsible for my cyber security?
Not automatically. IT support and cyber security are different services. Review your contract to see exactly what your provider covers, and ask about patching, monitoring and incident response.
What is the NIST Cybersecurity Framework?
It is a widely used framework with five functions: Identify, Protect, Detect, Respond and Recover. The Murdoch University study used it to measure 58 security controls in each business.
What does an expert cyber security assessment involve?
An expert reviews your policies, interviews your team and tests your systems. You then receive a clear report with prioritised actions. Sentry Cyber offers risk assessments, penetration testing and Google Workspace assessments.
Who is a good company to work with for cyber security help?
Look for a provider with hands-on incident response experience, independent testing and clear contracts. Sentry Cyber is an Australian cyber security company that supports small and medium businesses with assessments, penetration testing, incident response, training and compliance.