Cybersecurity challenges and mitigation strategies: empowering Malaysian SMEs against cyber risks

Today's businesses need to recognize the role of information and communication technologies.With the rise of remote working, increased use of the cloud and the integration of AI and IoT, the attack surface has increased significantly, requiring heightened vigilance. Small and mediumsized enterprises (SMEs) have been urged to capitalize on potential business opportunities by taking advantage of new technologies such as cloud computing services (Alahmari & Duncan, 2020). While these technological advances offer numerous benefits and opportunities for growth, they also bring new challenges, particularly cybersecurity threats. This is particularly important for SMEs, considered the least mature and most vulnerable to cybersecurity risks (Sukumar et al., 2023). The rising number of cyberattacks in Malaysia highlights the growing digital footprint of SMEs. With the adoption of digital platforms, SMEs are becoming more connected to the global digital economy. Malaysian SMEs will likely face more hostile cyber activities as they adapt to the digital environment. Cybercriminals increasingly target SMEs as they gain prominence in the digital economy and sometimes have less robust security measures. According to a study by cybersecurity firm Palo Alto Networks, Malaysian businesses were subject to the most disrupting cyberattacks in the ASEAN region in 2022. The research found that almost a third, 29% to be exact, of these companies experienced a significant increase in incidents, a remarkable 51% increase (The Star, 2023). The MCMC Network Security Center (MCMC NSC) documented 1653 phishing incidents in 2022 (MCMC, 2023). One of the most popular tactics in 2022 was using a malicious Android package (APK). Phishing is a cyberattack in which cybercriminals use various social engineering techniques to lure or trick people into performing specific actions or revealing sensitive information such as login credentials, financial information or personal data. There are also threats from cyber risks such as hacking, malware, attacks on the e-commerce supply chain and malicious insiders (Barlette et al., 2017; Chidukwani et al., 2022). This increasing networking leads to greater susceptibility to unlawful acts. Unlike large companies, SMEs face challenges in mitigating cyber risks. The six potential barriers to investing in cybersecurity risk management in SMEs include financial capacity, lack of awareness, SME size, traditional trade, lack of risk standards and overconfidence of decision makers (Alahmari & Duncan, 2021). Due to their limited past exposure and financial constraints, SMEs generally have weaker risk management capabilities. This is because difficult economic conditions strain the budgets of small and medium-sized enterprises. In addition, SMEs struggle to quantify their risk from cyberattacks due to limited resources and technical expertise. SMEs that invest in data security and governance can capitalize on market opportunities (Chidukwani et al., 2022). It has also been argued that SMEs need more risk culture and awareness. The tight market for IT experts is a significant obstacle to implementing cyber risk management in SMEs (Hoppe et al., 2021).