Connecting the Dots: An expanding network of risk and opportunity

An expanding network of risk

and opportunity:How UK SMEs are

under-estimating the growing complexity

of technology

Written by

2An expanding network of risk and opportunity:How UK SMEs are under-estimating the growing complexity of technology

About this report

In November 2012, the Economist Intelligence Unit, on behalf of Zurich, surveyed 549 small business owners

and directors in the UK to explore what SMEs think about the current economic landscape and how they are

adapting in order to survive and succeed.

In addition, in-depth interviews were conducted with two SME experts. Our thanks are due to the following

for their time and insight:

Jay Epton, Director of SMB for Symantec

Cliff Mills, Director of Research for the National Computing Centre

Simon Porter, Vice-President of Mid-Market Europe for IBM

The report was written by Melissa Carson and edited by Monica Woodley of the Economist Intelligence Unit.

Contents

Foreword 3

Executive summary 4

Technology: a requirement for SME business performance 6

Opportunity versus threat: the perception gap 9

Data protection risks: complex and interconnected 12

Emergent technology risks 15

Connecting the dots on technology risks 17

3An expanding network of risk and opportunity:

How UK SMEs are under-estimating the growing complexity of technology

Foreword

UK SMEs have always been innovators and ‘technology adopters’, in both good times and, perhaps even more so, during more challenging times. This certainly rings true today. Indeed, the SME sector may be at a ‘technological infl ection point’, a signifi cant point of change for how small businesses manage and conduct business.

Rates of mobile web usage and tablet adoption are defying historical precedent. ‘E-tailing’ is bringing structural change to high-streets and ‘Cloud’ (Internet-based) computing is changing the operational footprint of many small fi rms. A new hybrid ‘sharing economy’ of sole-traders, or ‘renters’, is also now emerging.

The business benefi ts for SMEs are signifi cant. Mobile working and Cloud computing can unleash new effi ciencies and levels of productivity for the small business. E-tailing, online distribution and social media offer enhanced scalability, allowing SMEs to reach, sell and service new markets and customers.

But these vast new opportunities also present a growing area of complexity in regards to risk – especially, for the small business. This report, ‘An expanding network of risk and opportunity: how UK SMEs are under-estimating the growing complexity of technology’, developed in association with the Economist Intelligence Unit (EIU), focuses on this very dynamic.

Over the past decade the realm of cyber risk has expanded and become increasingly complex. More long-standing challenges, such as data confi dentiality and protection, are now subject to increasing oversight from the Information Commissioner’s Offi ce (ICO), as well as new EU Data Protection legislation.

New emerging threats – such as cyber attack and social media reputational damage – are not only new challenges in their own right, but bring additional complexity to the long-standing risks, due to interconnectivity. The World Economic Forum (WEF) refers interconnectivity. The World Economic Forum (WEF) refers interconnectivityto this as the ‘dark side of connectivity’1, a digital landscape where the likelihood and impact of cyber threats are amplifi ed by hyper-connectivity.

The current ‘transformation of the high-street’ – and its genesis in the rapid growth of e-tailing – exemplifi es this challenging dynamic between opportunity and risk. SMEs must approach technology and the future with an appetite for both – but also an equally balanced awareness, appreciation and understanding for risk in this unchartered territory.

Moore’s law tells us that the power of computing power doubles every two years. The pace of technology development is only increasing. Over the next decade, the insurance industry can play a critical role within the greater business community in helping SMEs understand, monitor and protect against the new risks emerging in the cyber landscape.

Richard ColemanDirector, SMEUK General InsuranceZurich Insurance plc

1Global Risks 2012, World Economic Forum


Executive summary

There is no doubt that technology is dramatically shifting and rapidly expanding the landscape of opportunity for small and medium-sized enterprises (SMEs) in the UK . For example, 53% of SMEs in Europe have now adopted some kind of cloud computing service, an increase of 8 percentage points on the year before2, and experts believe getting fi rmly on the technology bandwagon is becoming increasingly important for SME success and competitiveness with every passing year.

However, one-quarter of UK SMEs remain in the dark, not actively monitoring technologies and the impact they could have for their businesses. They also happen to be less confi dent in their business outlook and less opportunistic overall. For these non-adopters, technology ineffi ciency may add to other business challenges to create a strong headwind to long-term competitiveness and sustainability.

In order to investigate in detail how SMEs have adapted to the new technology risk landscape, the Economist Intelligence Unit, on behalf of Zurich, surveyed over 500 UK SMEs.

The majority are keen to capture the benefi ts to both serve their business needs and obtain a competitive advantage, but SMEs also need to manage an increasingly complex and swiftly evolving set of associated risks.

SMEs are undervaluing the level of threat and the growing complexity of many technology risks – particularly those associated with emergent trends such as web-based services (cloud), mobile and social media. They are underestimating their vulnerability to cyber criminals, even as attacks targeting SMEs are on the rise. And they are not suffi ciently connecting the dots regarding the interconnectivity of technology risks in general, which threatens to exponentially increase potential levels of exposure.

For some industries in particular, awareness of technology risks is worryingly low. Retail and distribution – a sector in potential transformation – stands out as surprisingly behind the curve on technology.

While key steps are being taken by many, the biggest oversight among SMEs is the human factor. Few are focussing on training and updating their security policies, which need to be driven all the way through the organisation to manage the expanding range of vulnerable points.

2According to a report published by Spiceworks (a social business network for IT professionals) in November 2012.



How are UK SMEs adapting to the growing complexity of technology?

Increased use of mobile technology

5% negative impact, 55% positive impactIT exposure associated with

teleworking/mobile workforces 40% not a threat

Social media reputational

disaster40% not a threat

Growth of social media

6% negative impact

34% positive impact

The technology landscape is changing quickly

As businesses change the way they communicate and share data, they are increasing their exposure to external threats such as data loss and cyber attack

Human error is probably the largest risk, however only

46% of SMEs have trained their staff46% trained their staff46% 28% have reviewed security policies

SMEs are underestimating the interconnectivity of the risks and the pace of change

DeleteDeleteDelete

e-markets online consumer reviews

facebook linkedIn

@@

Source: Economist Intelligence Unit


Technology: a requirement for SME business performance

Over two-thirds of UK SMEs say that they assess the impact of technological trends on their businesses. According to experts this group is much more likely to survive and thrive in the future. Being able to link technology directly to overall business performance is the “holy grail for technology experts; but it is very diffi cult to measure”, says Cliff Mills, Director of Research for the National Computing Centre (NCC).

But the consensus is clear among experts, who believe technology is increasingly a basic requirement for SME performance, more so than fi ve years ago even. Mr Mills says: “If you are not actively on the web, and not getting the technology expertise to help run your business, you will certainly be left behind.”

Technology, confi dence and risk appetite

Interestingly, in line with expert opinion, the ‘tech aware’ SMEs – the two-thirds who actively assess the impact or possible impact of technology on their business – are more confi dent about the outlook for their businesses in the coming one to two years. They also have a more opportunistic overall attitude towards risk than their ‘not tech aware’ counterparts.

Table 1: How do you feel about the outlook for your business over the following time periods?

Confi dent/Very Confi dent Tech Aware* Not Tech Aware

> Next 12 months 67% 55%

> Next 1-2 years 73% 63%

* Those SMEs that assess the impact of technological trends on their business (67% of respondents).

Source: The Economist Intelligence Unit.

Table 2: How would you describe your company’s ‘risk appetite’ compared with other SMEs in your industry?

Opportunistic/Highly Opportunistic Tech Aware Not Tech Aware

> 2 years ago 25% 14%

> Today 26% 12%

> 2 years from now 38% 24%


Simon Porter, Vice-President of Mid-Market Europe for IBM, a technology fi rm, warns that “by not leveraging new technologies, which many of the innovative competitors are doing, UK SMEs will lose competitiveness. Many foreign fi rms are now competing more aggressively with SMEs, leveraging the Internet and cloud, so unless the SMEs in the UK respond, they will not succeed”. And it is not just foreign fi rms that UK SMEs need to be conscious of. Increasingly, the new generation of directors running SMEs grew up with technology, and they will have a big advantage over others.

Cliff Mills is the Director of Research for the National Computing Centre

(NCC), an independent membership organisation for IT professionals. The

NCC is the single largest corporate membership body in the UK IT sector.

Simon Porter is Vice-President of Simon Porter is Vice-President of Simon PorterMid-Market Europe for IBM, the world’s largest IT and consulting

services company. IBM is a global business and technology leader,

innovating in research and development to shape the future of

society at large.




Unleashing competitiveness for micro fi rms and small businesses

Larger companies are now only slightly ahead of their smaller SME counterparts in staying abreast of technology trends and their business impacts. Some 80% of medium-sized enterprises are assessing technology, compared with 73% and 70% of small and micro-enterprises, respectively.

With the advent of cloud services, and the evolution of mobile devices and technological sophistication, smaller SMEs are less hindered by the cost barriers that used to defi ne the divide between medium and small/micro-enterprises. Indeed, our survey demonstrates that they are getting much closer to the norms among medium-sized businesses.

Sole traders, on the other hand, are at a disadvantage owing to their lack of resources. Only one-half (52%) are thinking about the impact of technology on their business. Jay Epton, Director of SMB for Symantec, a computer security fi rm, reminds us that as sole traders and in micro-enterprises, “you are often MD (managing director), IT manager, marketing director and operations director at once, so it’s diffi cult to prioritise”.

In some sectors, new technologies may have a low level of practical benefi t and application for the sole trader. However, for some, emerging areas such as social media can offer increased marketing and customer service opportunities, as well as reduced administrative overheads.

Table 3: Do you assess the impact that technological change is or might be having on your business? (Size)

Yes No/Don’t Know

Sole trader 52% 48%

Micro-enterprise (1-9 employees) 70% 30%

Small enterprise (10-49 employees) 73% 27%

Medium-sized enterprise (50-249 employees) 80% 20%

Total 69% 31%

*Those SMEs that assess the impact of technological trends on their business (67% of respondents).


Jay Epton is Director of SMB at Symantec, a global leader in providing security, storage and

systems management solutions to help small businesses secure and

manage their information.



Retail industry stands out as behind the technology curve

Industry sector infl uences the relative importance of technology. Most striking is how few SMEs in the retail and distribution industry are assessing technology impact, particularly in light of the cannibalisation of high street shops by online retailers in recent years. Not only is the growth in retail overall expected to be fl at in 2013-14, according to the Centre for Retail Research (CRR), but 2012 proved to be the worst year for bankruptcies since the start of the recession in 2008. Yet for many retailers ‘online seems to be an afterthought’.

Table 4: Do you assess the impact that technological change is or might be having on your business? (Industry)

Industry Yes No/Don’t know

IT services 88% 12%

Manufacturing 74% 26%

Media, marketing or entertainment 73% 27%

Professional or fi nancial services 73% 27%

Building & construction services 63% 37%

Other consumer or business services 62% 38%

Retailing and distribution 55% 45%

Property management & rental 46% 54%

Other 55% 45%


Retailers also appear to underappreciate the potential scale of threat that the emerging technology landscape poses for their day-to-day and business performance. For instance, only 17% view data loss as a ‘major threat’ and, even lower, 10% see social media reputational disaster as such. Given the increasing reliance of retailers on ‘online reputation’ – for instance, online customer reviews – to help generate future demand and business earnings, the latter refl ects a signifi cant new area of vulnerability.



SMEs seem to fully embrace the upside of technology for their businesses, but are they taking the right precautions when they adopt new technologies? Many are underappreciating the potential business impact that many technologies may pose.

Technology only has an upside in the eyes of SMEs

Emerging technologies are evolving rapidly, creating huge opportunities for SMEs that are both accessible and, as we saw in part one, necessary to remain competitive according to experts. The broad perception among SMEs is that technology brings almost exclusively positive opportunities to their businesses. At most, just 6% of respondents see technology trends having a negative impact.

Online shopping is the one exception, and the retail industry is struggling with the technological challenge it faces (see box).

Table 5: What impact do you think the following technological trends are having on your business?

Signifi cant negative impact

Some negative impact

No impact

Not applicable

Some positive impact

Signifi cant positive impact

Increased use of mobile technology

0.4 % 4.7 % 29.7 % 10.0 % 40.8 % 14.4 %

Increased use of personal devices

0.5 % 3.8 % 31.7 % 11.7 % 39.3 % 12.9 %

Growth of web-based software or IT services

0.4 % 4.4 % 39.3 % 10.9 % 31.0 % 14.0 %

Increased analysis/use of customer data

1.5 % 3.6 % 39.7 % 17.7 % 30.1 % 7.5 %

Growth of social media 0.7 % 5.5 % 47.5 % 12.6 % 25.3 % 8.4 %

Growth of online shopping/consumption

3.5 % 10.4 % 39.0 % 22.0 % 17.9 % 7.3 %

Advances in manufacturing technology

0.7 % 2.6 % 54.3 % 20.0 % 16.4 % 6.0 %


Still surprising is the proportion of SMEs who view these technology-related trends – such as mobile technology, personal devices and web-based software services – as irrelevant to their businesses. But the numbers are also slightly skewed by the signifi cantly different perspectives among the ‘tech aware’ and ‘not tech aware’. Opportunity in technology (positive impact) lies in the eyes of the ‘tech aware’.

Opportunity versus threat: the perception gap



Table 6: What impact do you think the following technological trends are having on your business?

No Impact/Not Applicable

(Some/Signifi cant) Positive Impact

Tech Aware Not Tech Aware Tech Aware Not Tech Aware

Increased use of mobile technology 29% 62% 66% 34%

Increased use of personal devices 33% 63% 62% 33%

Growth of web-based software or IT services 40% 72% 55% 24%

Increased analysis/use of customer data 49% 76% 46% 19%

Growth of social media 53% 75% 41% 19%

Growth of online shopping/consumption 58% 68% 29% 17%

Advances in manufacturing technology 69% 85% 29% 10%


Threat – a mix of healthy fear and underestimation?

Technology-related risks are seen on an entirely different scale. Over three-quarters of UK SMEs, a huge number in comparison to those that see opportunities, see long-standing risks associated with data loss, cyber attack and electronic theft or fraud as threats. This implies that SMEs hold a healthy – if not overly fearful – view of the potential threats that these long-standing technology-related risks pose. The risks associated with emergent trends, however – such as cloud computing, Internet-based services, social media and mobile workforces – are not seen to be as signifi cant. While over one-half of UK SMEs see these trends as some level of threat, worryingly less than 20% perceive them as a ‘major threat’. In the case of reputational disaster from social media, only 13% of SMEs view this as a major risk. These statistics may indicate a lack of understanding of the complexity and the potential scale of impact associated with these emergent trends.



Mr Mills of the NCC also raises an interesting point about the distinction between these risks. “Data protection is not just about IT. It’s been around for a long time, so yes there is a lot of awareness, but its also looked at as a business-level risk, as well as at an IT level; whereas mobile, cloud [and risks associated with other emergent trends] are still often looked at only as technology risks [not business risks]”. Therefore, they do not always hit the radar for SMEs at a strategic or business-wide level.

Table 7: How would you rate the following types of technology-related risk in terms of the threat to your business?

Major threat Some threat No threat Don’t know

Data loss (1) 34% 50% 15% 1%

Cyber attack (eg, virus or hacking) (2) 29% 52% 18% 2%

Electronic theft or fraud (6) 21% 54% 23% 3%

Failure of Internet-based service (such as cloud computing) (4)

17% 40% 40% 4%

Social media reputational disaster (3) 13% 42% 40% 5%

Breach of regulations while trading/selling online (eg, non-compliant distribution to foreign countries via the web) (5)

10% 31% 51% 7%

IT exposure associated with teleworking/mobile workforces (7)

8% 44% 40% 9%




Protecting data in a world where systems are changing rapidly and information fl ows freely introduces a whole set of complex challenges that SMEs are not fully grasping.

Data protection is a critical challenge for SMEs

SMEs seem to have a high degree of awareness of the data protection risks. Data loss, cyber attacks and related electronic theft/fraud are the top three technology-related risks for UK SMEs, and they are all contributors to the data protection risk.

However, there are still a huge number of UK SMEs that are not suffi ciently aware of the importance of data protection, despite the now inescapable interconnectivity of technologies and technology risks. The survey found that between 16% and 25% of respondents do not recognise data loss, cyber attack and electronic theft or fraud as either a major or some threat to their business – equating to between 760,000 and 1.2m of the almost 4.8m SMEs in the UK. Some stark statistics should help to prompt greater interest.

For example, Symantec has found an increasing level of cyber attacks directed at SMEs, with the number of attacks doubling in less than a year. They estimate that 36% of all attacks are targeted at SMEs. But according to Mr Epton, SMEs often do not consider themselves to be of suffi cient interest to cyber criminals, and because of this lack of awareness they are even more vulnerable.

Unlike big enterprises, SMEs do not have the resources to recover from loss of customer data records, such as credit card information, fi nancial or personal information, Mr Epton points out. And for SMEs, the Information Commissioner’s Offi ce (ICO) cap of £500,000 for fi nes related to serious breaches of the Data Protection Act represents a crippling sum.

Interconnectivity in data protection

As businesses radically reform the way they communicate and share data – using cloud computing, linking an exploding number of personal devices to business systems and leveraging social media – they are exponentially increasing their exposure to external threats (both viral and cyber attack). Emergent trends could signifi cantly compound the vulnerability points around data loss and cyber attack.

The vulnerability of SMEs also creates risks for their customers. SMEs often have lower barriers to attack than large enterprises but, in many cases, they are connected to large organisations as suppliers and service providers – potentially putting all businesses in the chain, as well as their end-customers, at risk.

A multitude of major and very public PR (public relations) disasters linked to these risks have brought home the catastrophic impact they can have. It would therefore be expected that data protection risk awareness would be high among SMEs of all sectors, given that their very survival is on the line. However, we see quite a range of views across sectors.

Data protection risks: complex and interconnected




Table 8: How would you rate the following types of technology-related risks in terms of the threat to your business?

Major threats

IT s

ervi

ces

Med

ia,

mar

ketin

g or

ent

erta

inm

ent

Prof

essi

onal

or

fi nan

cial

ser

vice

s

Man

ufac

turin

g

Build

ing

& c

onst

ruct

ion

serv

ices

Prop

erty

man

agem

ent

& r

enta

l

Oth

er c

onsu

mer

or

busi

ness

ser

vice

s

Hot

els,

res

taur

ants

, ca

fes

& p

ubs

Reta

iling

and

dis

trib

utio

n

Mot

or t

rade

s an

d tr

ansp

orta

tion

Data loss (1) 47% 44% 43% 36% 32% 32% 29% 27% 17% 9%

Cyber attack (eg, virus or hacking) (2)

49% 28% 31% 32% 25% 24% 28% 27% 17% 17%

Electronic theft or fraud (6) 33% 9% 22% 24% 25% 28% 22% 23% 10% 13%

Failure of Internet-based service (such as cloud computing) (4)

30% 26% 18% 16% 18% 20% 18% 0% 8% 0%

Social media reputational disaster (3)

5% 13% 13% 10% 11% 16% 26% 9% 10% 9%

IT exposure associated with teleworking/mobile workforces (7)

19% 7% 8% 4% 14% 8% 6% 5% 7% 0%

Breach of regulations while trading/selling online (eg, non-compliant distribution to foreign countries via the web) (5)

12% 2% 10% 18% 11% 12% 10% 5% 8% 13%


Bandwidth and ‘data culture’ challenges for SMEs

Experts agree that many SMEs simply do not have the expertise or IT awareness to cover all the technology bases (both opportunities and threats). A skills gap is a major challenge faced by SMEs, and experts cannot stress enough the benefi ts that they feel trusted advisers can provide to help these businesses to manage risks.

Getting staff up to speed is important. Human error is probably the largest data risk, and while most SMEs are strengthening provisions for devices, back-up and virus protection (72%), or at least considering this (19%), skills training and policies are taking a back seat. Only 46% of SMEs have trained their staff and only 28% have reviewed security policies, yet ensuring proper use of passwords and driving policies all the way through the organisation are both critical to security.



Consequently, despite the huge amount of resources some SMEs (particularly larger ones) are putting into technology risk management, human error is still a major vulnerability point. ‘Data culture’ – in an era of proliferating customer information, workforce mobility and an ever-expanding number of networked devices – is perhaps emerging as the core data protection challenge.

One key to risk management in this area, according to Mr Epton, is password policies, and driving those policies all the way through the organisations. But no matter what technology-based security SME owners put in place, employees must always have a clear understanding and appreciation of data and technology risks, as well as the personal governance and compliance requirements that refl ect this.

Table 9: What steps, if any, is your business taking to respond to technological risk?

Taken Considering Not considered Don’t know

Strengthen protection against computer viruses or hacking (eg, by keeping software & anti-virus programmes up-to-date & having a well confi gured fi rewall)

72% 19% 6% 3%

Strengthen provision for devices & data back-up

63% 24% 9% 4%

Restrict access to IT systems (eg, only allow trusted users to access systems & ensure strong passwords)

54% 18% 23% 6%

Train staff 46% 20% 26% 9%

Improve physical security around servers & devices

42% 24% 28% 6%

Create &/or review our IT disaster recovery plan

29% 30% 35% 6%

Create &/or review technology policies (eg, personal devices policy)

28% 32% 32% 8%

Hire technology specialists 23% 20% 49% 8%

Take out technology risk insurance 12% 21% 60% 8%

Other (please specify) 10% 18% 32% 40%




SMEs are more focussed on the benefi ts of emerging technologies than their risks. In this section we look at the top three emergent trends and the associated risk perceptions among UK SMEs now and into the future.

Cloud risks – potentially under-appreciated and unknown

SMEs are more focussed on the benefi ts of cloud-based services than their risks; compelled by the promise of fl exibility, affordability and accessibility. Indeed, the advantages of web-based software are so compelling that experts claim that it will supplant the standalone desktop computer, and that ‘Software-as-a-Service’ (SaaS)3

will be the new model for small business.

“A cloud-managed back-up, for example, can reduce the total cost of ownership by up to 40%,” says Mr Porter. Larger SMEs now see the greatest potential benefi t of cloud computing as allowing for greater employee mobility and fl exibility, according to a recent survey by IBM Mid-Markets. Critically, the technical expertise of web-based service providers often far exceeds what the SME has in-house or could afford.

But while web-based services are generally considered secure, they could also be susceptible to browser exposure to malware, the increasing sophistication of cyber-criminals and critical system failure (for instance, the failure of cloud services or an associated delivery network). Yet only 17% of SMEs even recognise failure of cloud services as a ‘major threat’ to their businesses.

Similarly low numbers (25%) of UK SMEs see the risks increasing in the years to come, while one-half feel that cloud risks have now stabilised; a surprisingly large number. Considering that the market is expected to grow at 20% per year and be worth £2bn by 2015, risks in this arena may be signifi cantly undervalued by UK SMEs.

The explosion of mobile working is opening SMEs to risk

Only a mere 8% of SMEs see IT exposure associated with teleworking/mobile workforces as posing a major threat. This includes ‘bring your own device’ (BYOD), which, according to Mr Epton, is more prevalent among SMEs and may have the most dramatic future impact on the risk profi le of SMEs. The interconnected risks linked to mobile computing and teleworking can extend well beyond the work environment, as the personal and professional use of devices increasingly merge.

In Mr Epton’s experience, part of the risk management challenge for SMEs is simply prioritising. “Until someone experiences some kind of situation, it is not top of mind, or a detriment to day-to-day business decisions,” he says.

On the fl ip side, while a more healthy proportion (44%) see this as at least some threat, and almost one-third (30%) realise that this will be an increasing area of risk to their business in years to come, these fi gures are still alarmingly low overall.

Against the fast-paced mobile backdrop, the explosion of a mobile-enabled marketplace and the dramatic adoption curve of devices, better appreciating and managing the risks will be vital.

Emergent technology risks

3SaaS (Software-as-a-Service), IaaS (Infrastructure-as-a-service) and PaaS (Platforms-as-a-Service).


Emergent technology risks

SMEs underestimating social media risk

SMEs struggle to quantify reputational risk, but in today’s more unforgiving environment, customer confi dence is business critical. Research by Symantec shows that 63% of SMEs use social networks, but only 13% of EIU survey respondents feel that this poses a major threat to their business.

SMEs seem to be undervaluing the nature and complexity of this emerging risk. A single case of disparaging commentary on social media platforms can have a powerful amplifying effect, with real long-term fi nancial business implications. The spread of digital misinformation owing to hyperconnectivity – called ‘digital wildfi res’3 – has been cited as a critical emerging risk by the World Economic Forum.

But social media also exacerbates other technology-based vulnerabilities, such as cyber attack. Cyber criminals can extract many separate bits of information from social media platforms and piece these together to attack SMEs.

Less than one-half (46%) of SMEs see social media risks as increasing in the years to come – a proportion more aligned with expectations than that seen with cloud and mobile trends.

Table 10: Do you think the following types of technology-related risks are increasing, decreasing or stable?

Increasing Stable Decreasing Don’t know

Cyber attack (eg, virus or hacking) 59% 28% 7% 7%

Electronic theft or fraud 54% 32% 7% 8%

Social media reputational disaster 46% 35% 5% 14%

Data loss 35% 45% 11% 9%

IT exposure associated with teleworking/mobile workforces

30% 43% 5% 22%

Failure of Internet-based service (such as cloud computing)

25% 50% 5% 20%

Breach of regulations while trading/selling online (eg, non-compliant distribution to foreign countries via the web)

25% 48% 5% 22%


The World Economic Forum is an independent international organization

committed to improving the state of the world by engaging business, political, academic and other leaders of society to shape global, regional and industry

agendas. Its Global Risks Report analyses 50 global risks in terms of

impact, likelihood and interconnections.



SMEs are not suffi ciently connecting the dots with respect to technology risk.

Technological vulnerabilities are amplifi ed by interconnectivity. And although more than one-half of SMEs believe that cyber attack and electronic theft/fraud are increasing (59% and 54%, respectively), it is alarming that only 35% of SMEs believe that data loss – intimately connected to cyber attack and electronic theft – is an increasing threat in the years to come.

The relationship between an expanding range of connected devices and workforce mobility is also not being fully connected to threats such as data loss. With regard to data governance, workforce behaviour (data culture) is one of the most challenging areas to address, yet less than one-half (46%) of SMEs are training staff and less than one-third (30%) see IT exposure associated with teleworking or mobile workforces as increasing going forward.

Too many SMEs also are not fully considering the potential risks and opportunities in a technology-driven world. While many may be aware that today’s emerging SME leaders grew up in a technology-enabled environment and that foreign fi rms are reaching UK markets through the Internet, their appreciation of the potential risks this poses to traditional SME business models falls short.

Small businesses also need to connect the dots between their IT security strategies – opting for anti-virus software or back-up and recovery plans – and link technology risk management to their overall business model and initiatives.

Too many see the future of technology trends and risks to be more stable than the rapidly-evolving landscape that the experts believe it is and will continue to be. All SMEs, especially those revealed by the survey to be rather not tech aware, need to re-evaluate quickly the possible risks – and opportunities – that technology presents, in order to become more resilient in the face of this shifting landscape.

Connecting the dots on technology risks




Zurich Insurance plc is authorised by the Central Bank of Ireland and subject to limited regulation by the Financial Conduct Authority. Details about the extent of our regulation by the Financial Conduct Authority are available from us on request, FCA registration number 203093. These details can be checked on the FCA’s register by visiting their website www.fca.org.uk or by contacting them on 0845 606 1234.13

5559

A02

(04/4/4

13)

ZCA

Economy & Finance

Connecting the Dots: An expanding network of risk and opportunity