The digitization of the Spanish small and medium-sized company has reached a point of no return, but its legal and technical security does not always evolve at the same pace. In this critical context, our colleague Julio Antonio Aranda, responsible for the legal procedural department in Afianza, recently participated in the forum Disruptores – El Español organized by El Español. Together with experts from Cepyme, ADISS and CrowdStrike, Julio Antonio analyzed the risks of a scenario where 94% of cyberattacks in Spain already have as their main objective the SME.
The Economic and Operational Impact of Cyberattack
A security incident is not just a technical problem; it is a direct threat to the survival of the business. The current scenario is defined by critical data:
- Financial losses: the average cost of an attack for a SME EUR 50,000, according to the Cyberpreparation Report of Hiscox.
- Closing risk: For many companies, a system block or financial fraud means total paralysis of activity and loss of liquidity.
- Talent gap: Spain faces a lack of more than 30,000 specialized professionals, which makes security services more expensive beyond the reach of the average SME.
The 3 Factors that Raise Digital Risk in SMEs
The expert debate points out three axes that are leaving our companies unprotected:
1. The Enhancement of Sophistication (IA and Ransomware)
The 29% of the SMEs attacked suffer ransomware. The eruption of Artificial Intelligence has allowed cybercriminals to create more frequent and sophisticated attacks, while only 11% of SMEs use AI as a defense tool.
2. The Cloud Unit and the External Perimeter
Businesses tend to focus on protecting their physical office, but current cybersecurity is played in the cloud. Lack of knowledge to secure systems cloud exposes credentials and sensitive data in a massive manner.
3. Regulatory Pressure and Social Responsibility (NIS2)
European regulations such as the NIS2 Directive They introduce a paradigm shift: cybersecurity is no longer optional. SMEs now have a legal and social responsibility if their data leaks, facing high penalties and judicial costs.
"Prophylactic Security": Afianza's Legal Approach
-
From the legal point of view, protection must be preventive. Julio Antonio Aranda, lawyer in Afianza Consulting Consulting, introduces the concept of prophylactic safety:
- Previous analysis: A detailed study of current coverage and protections before the incident occurs is vital.
- Claim capacity: After an attack, it is essential to know who is legally responsible and how to judicially claim the damage suffered.
- Regulatory accommodation: Businesses must meet Brussels' demands to prevent technological damage from becoming a legal disaster.
Towards Simple, Quick and Affordable Cybersecurity
All experts agree that ‘crafted cyber security’ is dead. SME cannot manage a complex IT department alone. The solution is:
- Managed Services (MSSP): delegate security to specialized operations centres (SOCs) monitoring threats 24/7.
- Technological simplification: tools should be practical and understandable for non-technical staff of the company.
- Awareness-raising and Training: promote a culture of good digital practices so that employees are no longer the weakest link.
Protecting SMEs is protecting the national economy. Cybersecurity for small businesses today must be, above all, accessible and expertensuring that a digital incident does not mean the end of a business project.
You can read the full story at:
