Most businesses have relied on standard cybersecurity tools which aim tprevent attacks from occurring. However, the business environment has changed. There are a number of reasons why they now need to reconsider their strategy and take a more pro-active approach to cybersecurity:

• Cybercrime has become big business – as internet use has grown, criminal gangs have moved into the market, and attackers have become more sophisticated and professional. Attacks are also more frequent and are now a weekly occurrence for many businesses. According to the Cyber Security Breaches Survey 2020, which is produced by the UK government, almost half of businesses (46%) surveyed had suffered incidents in the previous 12 months – up from 32% the year before. Of these, around a third (32%) were experiencing incidents at least once a week.

• The nature of threats has changed – As companies have stepped up their defences, attackers have become adept at finding ways around them. The majority of attacks now involve some type of ‘social engineering’ such as persuading employees to open an email or download an app and in some cases, such as CEO fraud, can be highly targeted operations. New threats are emerging all the time.

• The rise in remote working – the use of cloud-based services has made it possible for employees to work from any location and on any device. However, it has also made it harder for IT teams to control access to their system and provides greater opportunity for attackers to gain entry. The sudden increase in home working due to the Coronavirus pandemic has amplified the problem.
• Pressure from customers and regulators – regular high-profile breaches have shown that even household names can fall prey to hackers. With growing concern amongst customers about data security, companies are under pressure to show they have proper defences in place and in turn, are demand assurances from their suppliers. At the same time regulators worldwide are introducing new and tougher standards and showing that they are willing to hold companies – and their directors – to account.
• Compliance with standards and regulations – while new rules such as GDPR apply to all companies, many are seeking accreditation to voluntary standards such as Cyber Essentials or ISO/IEC 27001:2005 to enhance their reputation. However achieving and maintaining these standards on an ongoing basis is difficult, if not impossible, to achieve without having some type of cybersecurity monitoring in place.