IT security non-compliance leads to loss of contract for quarter of SMBs

Supply chain attacks, which exploit vulnerabilities in third-party software, have recently emerged as a top threat to large enterprises. In response, corporations are raising security standards for suppliers and partners, putting new pressure on SMBs across the supply chain. To help smaller companies adapt to new market demands, Kaspersky examined the current state of organizations’ security compliance[1] and explains how cybersecurity solutions can both cover SMBs’ needs and ease the compliance process.

The study reveals that nine out of ten (90%) of SMBs involved in supply chains had to satisfy any IT security requirements of their customers or partners[2]. At the same time, less than one third (29%) of organizations managed to meet all the proposed requirements. The ability to meet all security requirements is linked with the IT security level of companies. Only 3% of companies describing their level of IT security as low (basic protection only implemented) managed to meet all requirements, while this share among organizations using advanced solutions, such as EDR, XDR, SIEM, reached 44%. 

Among SMBs that are already a part of any supply chain, 71% managed to only partially meet IT security requirements from a partner. One of the toughest criteria that led to non-compliance was obtaining IT security certifications: 26% of respondents failed to meet it. In addition, sharing and revising incident response plans (26%), implementing advanced IT security solutions (26%) and conducting regular third-party penetration testing or security audits (25%) were the most frequent requirements that surveyed companies did not satisfy.

In terms of the non-compliance impact, only 3% of SMBs that did not meet any IT security requirements could state they managed to continue or start partnership without any consequences. The remaining 97% admit that failing to meet any security requirements led them to business concerning outcomes. The majority of companies were forced to revise their IT security strategy and, in most cases, revision came with additional budget allocation (54%). Loss of revenue opportunities also affected a significant part of organizations: 42% faced contract delays, 26% were disqualified from a tender and quarter (25%) just lost contract.

“Cybersecurity advancement is becoming more and more important for SMBs. Large companies as usual were pioneering in technologies and now they take smaller companies with them. On the bright side, business is becoming more protected, but the transition phase, however, can be painful for growing companies due to insufficiency of expertise and small resources. SMBs and mid-market organizations are the main heroes for Kaspersky right now. We see that these organizations need support from leading vendors, and we are developing our solutions specifically to fit the needs of smaller companies.” – comments Zoya Gurevich, senior product manager at Kaspersky. “For SMBs, improving cybersecurity starts with addressing technical vulnerabilities and everyday security risks. Automated and easy-to-handle tools help identify weaknesses, monitor activity at the endpoint level and protect communication channels, e.g. corporate emails. Combined with practical employee training, these measures help reduce the risk of incidents, maintain long-term business continuity and meet the security requirements of partners and customers”.

Kaspersky tailors its enterprise-grade solutions for small and medium-sized businesses’ requirements, making stronger cybersecurity always achievable as a business grows. Advanced solutions within the Kaspersky Next Optimum offering provide SMBs with an expert level of protection while keeping implementation and everyday management proportionate to their resources:

•   Kaspersky Next EDR Optimum ensures strong endpoint protection and streamlined Endpoint Detection and Response capabilities, which automate the defense against complex threats. The solution instantly uncovers hidden malicious activity, visualizes the attack path, and allows IT administrators to neutralize incidents in a single click. By simplifying threat visibility and response, it enables SMBs to stop lateral movement across their network without requiring highly specialized or costly cybersecurity experts. 
• Kaspersky Next XDR Optimum breaks the stereotype that Extended Detection and Response is a luxury reserved only for large corporations. This cloud-native solution focuses on delivering the core value of XDR in a more accessible way, with a highly practically approach. By concentrating on the most common threat scenarios — particularly at the endpoint level — it helps small- and medium-sized organizations improve threat detection and response without the overhead of complex deployment.
• Kaspersky Next MDR Optimum effectively mitigates supply chain risks by providing continuous, expert-led monitoring across the entire corporate infrastructure to catch threats originating from trusted third parties. Backed by 24/7 expert analysis and automated incident validation, the solution allows organizations to constantly analyze behavior patterns, hunt for advanced persistent threats (APTs), and spot anomalies that signal a compromised partner account or software update.

The Kaspersky Next Optimum offering now also features targeted Security Modules that let SMBs reinforce their most relevant risk areas without overspending or needing to replace their existing technology stack. Mapped to real-world business demands and operational constraints, these modules—including Vulnerability Management, Email Security, and Security Awareness—provide precisely the tools needed to stop threats early in the attack chain with minimal overhead.

To learn more about Kaspersky's portfolio for small and medium-sized businesses and to access a free trial, please visit the link.