Despite improvements in preparedness, US small businesses remain highly vulnerable to cyber incidents. A recent report indicates that although these businesses spent less on responding to cyber incidents last year, the increased frequency of attacks and breaches offset these cost reductions. The median number of cyber attacks has risen from 3 in 2022 to 4 in 2023, and 41% of small businesses fell victim to cyber attacks in 2023, a significant increase from previous years.

One concerning trend highlighted in the report is that US small businesses paid over $16,000 in cyber ransoms in the past 12 months. According to Chris Hojnowski, vice president and product head of technology and cyber at Hiscox USA, the rise in cyber attacks is alarming and the statistics reflect a growing threat to small businesses. Hiscox surveyed over 500 US small business professionals to gauge their preparedness to combat cyber incidents, as part of a global survey involving over 5,000 professionals responsible for their company’s cyber security strategy.

Hojnowski emphasized the importance of remaining vigilant and utilizing AI tools to protect against cyber threats. However, the report also revealed that despite increased IT security spending, there are still areas of vulnerability. For example, a significant percentage of small businesses do not utilize security awareness training and lack network-based firewalls.

The report also highlighted the growing complexity of cyber attacks, underscoring the need for additional investments in cyber security, training, and insurance. Despite increased IT security spending, the report showed that many small businesses are still vulnerable due to a lack of essential security measures. The US ranks second for cyber maturity, with a significant percentage of small businesses classified as intermediates and only a small percentage labeled as cyber experts.

Overall, Hiscox’s cyber readiness report for small businesses in the US reflects the growing threat of cyber attacks and the need for increased preparedness and investments in cyber security measures.