July 16, 2021 By Tally Shea 2 min read

Small- and medium-sized businesses can be victims of digital attacks as much as global ones can. In fact, 88% of small business owners think they’re open to a cyberattack. In response, startups must allocate time and resources to getting the right small business cybersecurity measures, right? If only business realities were that simple.

Let’s talk about startup culture for a second. What do you envision when you hear ‘startup’? Mark Zuckerberg, Silicon Valley, cold brew on tap, standing desks and a race to the finish line? You probably don’t think about late nights obsessing about small business cybersecurity. And therein lies the problem.

The Issue With Small Business Cybersecurity

There seems to be a conflict between the culture of startups and best practices for strong security. Security experts have been shouting this mantra from the rooftops for a while now: We need digital protection built in from day one. But that doesn’t sound very appealing to startup founders.

Instead, startup founders want to inspire their employees. They want to help them dream about what their product can do for the world and they want to beat their rivals. They want to rush forward and build now, think later. There is a lot of pressure to deploy software overnight and fix bugs later, but later never comes. This mindset of nudging developers away from caring about security and letting the experts handle it might be hurting them in the long run. When the most important job is to innovate without thinking about small business cybersecurity, startups only add to the already growing attack surface.

Why Should Startups Care About Small Business Security?

Whether it’s thinking they’re not attractive or worthwhile targets for cyberattacks, indifference towards suffering a breach or simply not future-proofing their company, startups need a wake-up call.

A successful cyber breach can be the kiss of death for small businesses, including startups. More and more, people care about their data and are holding companies accountable for safeguarding it. In fact, most small businesses that have been compromised reported that it affected their good name, which in turn hurts their growth. There is nothing like receiving an alert that your personal identification has been compromised to turn you off from a company.

Where Can Change Come From?

Startups need to change their culture — and that is best done from the top down. Founders need to face the fact that creating a business without including small business cybersecurity in the planning process opens it up to major risk. Once leadership makes this more important than process, time to launch and beating rivals, they can start to instill digital defense best practices into employees. Startups should encourage employees to speak up and point out potential problems. Let them know it is okay to slow down the process if needed.

Teaching your employees what bad small business cybersecurity looks like can go a long way. Training programs should be a standard for every employee. Here’s a rule of thumb — if they have a computer, they need training. What are the areas in which employees need to be trained? Here are a few:

Knowing the basics and the concept that employees should keep an eye on the company’s security breeds accountability. Leaders and employees, let’s work together to reduce risks and make the world a more secure place.

More from CISO

X-Force Threat Intelligence Index 2024 reveals stolen credentials as top risk, with AI attacks on the horizon

4 min read - Every year, IBM X-Force analysts assess the data collected across all our security disciplines to create the IBM X-Force Threat Intelligence Index, our annual report that plots changes in the cyber threat landscape to reveal trends and help clients proactively put security measures in place. Among the many noteworthy findings in the 2024 edition of the X-Force report, three major trends stand out that we’re advising security professionals and CISOs to observe: A sharp increase in abuse of valid accounts…

Boardroom cyber expertise comes under scrutiny

3 min read - Why are companies concerned about cybersecurity? Some of the main drivers are data protection, compliance, risk management and ensuring business continuity. None of these are minor issues. Then why do board members frequently keep their distance when it comes to cyber concerns?A report released last year showed that just 5% of CISOs reported directly to the CEO. This was actually down from 8% in 2022 and 11% in 2021. But even if board members don’t want to get too close…

The CISO’s guide to accelerating quantum-safe readiness

3 min read - Quantum computing presents both opportunities and challenges for the modern enterprise. While quantum computers are expected to help solve some of the world’s most complex problems, they also pose a risk to traditional cryptographic systems, particularly public-key encryption. To ensure their organization’s data remains secure now and in the future, chief information security officers (CISOs) should educate themselves about quantum computing, proactively address the coming quantum risks to cybersecurity and work to establish cryptographic agility in their enterprise.A future cryptographically…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today