#Infosec2025: Cybersecurity Support Networks Too Fragmented for SMBs, Say Experts – Source: www.infosecurity-magazine.com

Sources of cybersecurity advice and support are too diffuse and difficult to find, adding complexity to SMB efforts to build cyber-resilience, a panel of experts has argued.

Speaking on the second day of Infosecurity Europe, experts from across industry, academia and government agreed that awareness isn’t necessarily the problem among smaller businesses.

In fact, cybersecurity is now the second biggest concern for British SMBs, just after inflation, according to the recently released VikingCloud 2025 SMB Threat Landscape Report. 

However, according to findings from a new government-funded project dubbed Cyber Security Communities of Support (CyCOS), SMBs are somewhat lost about where to turn for cybersecurity advice.

The University of Nottingham’s Steven Furnell, who is helping to lead CyCOS, said a casual web search on SMB cybersecurity guidance revealed dozens of websites from government, IT industry, SME, and insurance sectors, and other organizations.

“Essentially, looking at the range of issues SMEs ought to be aware of and the extent to which the sources cover then, it was a very varied picture. There wasn’t a single source that we found that covered every single one of the issues we thought would be relevant, and there wasn’t a single issue that was covered by all of the sources,” he explained.

“So, depending on where an SME chooses to look, they might get a very varied picture of what cybersecurity would mean to them in the first place.”

This confused picture is borne out by government statistics that reveal just 14% of small businesses have even heard of the NCSC Small Business Guide to Cyber Security.

The problems extend beyond merely finding a single authoritative source of trusted information on cyber, Furnell added.

“One of the things is that, fundamentally, [SMBs are] not sure how to take it forward – they’ve got the guidance and that tells them what needs to be done, but it doesn’t take them on the journey much further in terms of how to do it,” he argued.

“A lot of the SMEs in our interviews said ‘we don’t really have anyone to talk to about it unless we’re paying them … or making a formal report.’”

Chartered Institute of Information Security (CIISec) CEO, Amanda Finch, said pathways to advice and support need to be simplified.

“I was surprised by the myriad of available advice. It’s just a minefield for people that are trying to deal with this. I can fully understand why small businesses just completely glaze over with it,” she said.

“Cyber isn’t their business. They’re trying to make money, probably working on really small margins. We’ve got to make [advice] affordable and accessible.”

Read more on SMB security: Cyber Extortion Soars: SMBs Hit Four Times Harder

Introducing Communities of Support

The hope is that CyCOS – in partnership with organizations like CIISec, the Federation of Small Businesses, the Home Office, IASME, ISC2, the National Cyber Security Centre (NCSC) and regional Cyber Resilience Centres (CRCs) – will help create more accessible ways for SMBs to engage with cybersecurity.

It will do so via community-based support networks and targeted resources. In fact, CyCOS’s Furnell urged cybersecurity professionals to get in touch if they want to share their expertise with these networks.

“The idea here is basically to find a way of socializing the notion of cybersecurity for this audience,” Furnell explained. 

“So, it’s not replacing anything that’s already there. It’s another avenue we’re looking to establish that lets the SMEs and the cyber experts come together in a context where the experts can support the SMEs, and the SMEs can support each other – perhaps on a regional or a sector basis.”   

Sapna Chadha, CEO of the London CRC, expressed hope for its success.

“There are 5.5 million SMEs and nine CRCs. The scale is the thing, so something like this would make it a bit easier for that information flow; for people to feel less scared of asking for that information,” she added.

“I’m hoping this pilot could sit hand in hand with what we do.”

Home Office Head of Cyber Crime Prevention and Victim Support, Stephen Bell, also sounded optimistic about the CyCOS approach.

“Our ability to engage with SMEs is incredibly difficult,” he admitted.

“But one thing we do know is that people tend to listen to each other. So, if your peers are doing something, you’re more likely to have a bit of an interest. We’re really hoping to find new and better ways of helping [SMBs] to understand this is a manageable subject.”

SMB cyber-resilience is a pressing issue. Nearly a fifth of those SMBs surveyed by VikingCloud admitted that they wouldn’t survive a successful attack, claiming that losses as low as $50,000 (£40,500) would force them out of business.