WHY SMEs UNDERESTIMATE HUMAN RISK
Small and medium-sized enterprises are the backbone of the economy. They innovate quickly, operate lean teams and move faster than large corporations. Yet in the world of cybersecurity, that agility often becomes their greatest vulnerability. And here we talk cyber risk. Most SME leaders believe cybersecurity is under control because they have purchased the right tools. Firewalls are in place. Anti-virus is installed. Backups are running. An IT provider is on contract. From a management perspective, everything appears secure. But a dangerous question remains unanswered:
How well do CEOs and managers truly understand the cyber risk created by their own employees?
The reality is uncomfortable. In most SMEs, human behaviour represents the largest and least measured security risk.
CYBER STRATEGY HAS BECOME TOO TECHNICAL
Over the past decade, cybersecurity has grown increasingly complex. Cloud platforms, remote working, mobile devices and digital transformation have created sprawling technology ecosystems that many SME leaders struggle to fully grasp. Research from EY highlights that organisations often build cyber strategies filled with multiple tools and processes without clearly understanding whether those investments actually reduce meaningful risk. For large enterprises, this complexity is challenging. For SMEs with limited budgets and small IT teams, it can be overwhelming. As a result, many CEOs rely on comfort statements rather than real insight:
- We have IT support, so we must be secure
- We passed a compliance audit last year
- We have cyber insurance
- We use cloud services, so security is handled
These assumptions create a false sense of safety. They focus on technology, while ignoring the human factor that attackers exploit most often.
WHAT DO CEOs REALLY THINK ABOUT CYBER RISK?
A landmark study from Oxford University examined how senior leaders perceive cybersecurity. The findings revealed a significant gap between awareness and action. The research showed that many CEOs:
- Recognise cybersecurity as important
- Feel uncertain about how to measure it
- Delegate it entirely to IT departments
- Lack clear visibility of actual organisational risk
- Underestimate the role of employee behaviour
In SMEs, this gap is even wider. Cybersecurity is often viewed as a technical expense rather than a business-critical discipline. But attackers do not see the difference between a global enterprise and a 50-person company. They simply look for the easiest human target.
REAL INCIDENTS THAT STARTED WITH A SINGLE EMPLOYEE
To understand why human risk matters, it helps to look at how real attacks unfold.
INCIDENT 1: THE INVOICE REDIRECTION SCAM
A mid-sized professional services firm received an email that appeared to be from a long-term supplier. The message explained that bank details had changed and requested future payments be sent to a new account. An accounts assistant updated the payment details without verifying the request by phone. Over the next two weeks, more than £120,000 was transferred to a criminal-controlled account. By the time the fraud was discovered, the money had disappeared.
- No malware was used
- No firewall was breached.
- No sophisticated hacking occurred.
The entire incident relied on one believable email and one untrained employee.
INCIDENT 2: THE CREDENTIAL PHISHING ATTACK
A small financial advisory business invested heavily in security tools. They used multi-factor authentication, endpoint protection and a managed firewall. One morning, an employee received a message claiming to be from Microsoft about an urgent password reset. The email looked legitimate and linked to a professional-looking login page. The employee entered their credentials. Within hours, attackers accessed the mailbox, monitored communications and began sending fraudulent payment requests to clients. The breach originated from a single click by a trusted staff member. Technology did not fail. Awareness did.
INCIDENT 3: RANSOMWARE THROUGH A COMPROMISED USER
The 2025 Unit 42 Incident Response Report highlights that modern ransomware attacks frequently begin with stolen credentials rather than technical vulnerabilities. In one typical scenario, attackers gained access to a small manufacturing company after an employee reused a password that had been leaked in a previous data breach. Once inside, the criminals moved laterally across systems and deployed ransomware, shutting down operations for several days and costing the business hundreds of thousands of pounds. The root cause was not weak technology. It was predictable human behaviour.
WHY SMEs ARE PARTICULARLY EXPOSED
Large enterprises often have dedicated security teams, formal training programmes and sophisticated monitoring capabilities. SMEs rarely do. Instead, they typically rely on:
- Small internal teams
- External IT providers
- Basic annual training
- Informal security processes
This creates a dangerous combination of:
- Limited security expertise
- High dependence on individual employees
- Less structured governance
- Fewer layers of oversight
Attackers know this. That is why SMEs are increasingly targeted as low-hanging fruit.
HOW DO CEOs ASSESS BUSINESS RISK?
Most CEOs assess business risk by combining data, experience, and forward-looking judgment rather than relying on a single framework. They focus on threats that could undermine strategy, disrupt operations, strain finances, or damage reputation, while also considering regulatory and technology risks such as cybersecurity. Scenario planning helps them test resilience across different futures, and intuition plays a role in spotting early warning signs that may not yet show up in reports. Ultimately, risk is viewed through the lens of growth, continuity, and speed of impact on the business.
- What could derail our strategy or slow our growth?
- Where are we financially exposed if conditions change?
- Which operational or technology failures would hurt us fastest?
- What compliance, regulatory, or reputational risks could cause serious damage?
- Are we resilient enough if the worst-case scenario happens?
In short, most CEOs assess risk by asking one core question from multiple angles:
What could stop us from growing or put the business at risk, and how fast could it hurt us?
HOW DO CEOs ASSESS CYBER RISK?
When CEOs assess cyber risk, they tend to frame it in business terms rather than technical ones. Their questions sound more like this:
- What would a cyber incident stop us from doing as a business?
- How long could we operate if systems were unavailable?
- What would this cost us in lost revenue, fines, or reputational damage?
- Are we more exposed than our competitors or peers?
- Who is accountable if something goes wrong, and are we confident in that ownership?
Many SME leaders default to technical questions because they are tangible and familiar, but mature cyber risk assessment happens when cybersecurity is treated as a business risk, not an IT checklist. That shift is often the difference between basic protection and real resilience. However, they typically ignore the most common causes of incidents:
- Employees clicking on malicious links
- Staff reusing passwords
- Finance teams falling for payment fraud
- Sensitive data being emailed to the wrong recipient
- Poor handling of confidential information
Very few CEOs can answer questions such as:
- Which employees are most likely to fall for phishing?
- How often are suspicious emails reported?
- Which staff have excessive access rights?
- How quickly would a compromise be detected?
- How many users represent high behavioural risk?
Without these insights, leadership cannot truly understand their true exposure to cyber risk.
START WITH HUMAN RISK MEASUREMENT
Accenture’s research on cyber-resilient leadership makes it clear that modern CEOs must move beyond a technology-only mindset. A resilient SME should be able to measure:
- Employee awareness levels
- Phishing susceptibility
- Access privilege risks
- Incident reporting effectiveness
- Behavioural trends over time
Cybersecurity should be managed like any other business risk, with clear metrics and accountability.
THE QUESTIONS EVERY SME LEADER MUST ASK
To genuinely assess organisational cyber risk, CEOs and managers should be demanding answers to practical questions:
- Do we know which staff are most likely to be targeted?
- How many phishing simulations do employees fail?
- Are high-risk users receiving additional support?
- Can we detect compromised accounts quickly?
- Do employees know how to report incidents?
- Is cyber awareness training regular and measurable?
If these questions cannot be answered with data rather than opinion, the organisation is operating blindly.
HOW ZHERO HELPS
Zhero works with SMEs to transform cybersecurity from guesswork into measurable control. Rather than focusing only on technology, Zhero helps organisations to:
- Identify high-risk user behaviour
- Deliver targeted security awareness programmes
- Monitor identity and access risks
- Detect suspicious activity early
- Build a security-conscious culture
- Provide leadership with clear risk metrics
This approach allows CEOs to make informed decisions instead of relying on assumptions. Cybersecurity becomes a visible, manageable business function rather than a mysterious IT expense. Reach out to Zhero for an end-user risk assessment here.
WAITING IS NOT AN OPTION
Too many SME leaders only realise the importance of human cyber risk after an incident occurs. By then, it is too late. The consequences of a breach can include:
- Financial loss
- Operational downtime
- Regulatory penalties
- Loss of client trust
- Reputational damage
- Increased insurance costs
All of these can be triggered by a single moment of human error. In today’s threat landscape, hoping employees will make the right decisions is not a strategy.
AWARENESS MUST START AT THE TOP
For SMEs, cybersecurity success depends less on expensive technology and more on informed leadership. CEOs who fail to understand human cyber risk leave their businesses dangerously exposed. Those who measure, monitor and improve employee behaviour dramatically reduce their chances of becoming the next victim.
The most important cybersecurity question for any SME leader is not: Do we have the right tools? It is: Do we truly understand the cyber behaviour of our people? Until that question is answered with confidence, no organisation can claim to be secure.
