Promoting and enhancing cybersecurity among small and medium-sized enterprises for the sustainable development: trends and best practices

Charles Odii highlights the enormous economic significance of SMEs in Nigeria, noting that the country has approximately 39 million small and medium businesses across various sectors. These businesses collectively contribute around 50% of Nigeria's GDP and provide employment for approximately 16 million people, making them indispensable to the national economy.

Odii stated that Nigeria has approximately 39 million plus small and medium businesses , that these businesses contribute approximately 50% of the GDP for Nigeria , and that they employ approximately 16 million people in Nigeria .

Charles Odii argues that the most effective way to get SMEs to adopt cybersecurity solutions is to offer them free or discounted access so they can experience the benefits in real time. Once they see how cybersecurity protects their revenue, they are more likely to commit to it as an ongoing investment rather than viewing it as an additional expense.

Odii explained that the best way for SMEs to secure themselves is to get them into the environment at a discounted or free rate so they can enjoy the perks for a few months and see how they can protect their revenue . He also noted that Nigeria is reviewing its national MSME policy, with cybersecurity as one of the key conversations, alongside intellectual property and issues affecting women and youth .

Charles Odii points to the partnership between SMEDAN and Kaspersky as a concrete example of how public-private collaboration can effectively bring cybersecurity within reach of SMEs. By combining government outreach with industry expertise and free tools, such partnerships help shift SMEs' perception of cybersecurity from a burden to a business enabler.

Odii described the partnership with Kaspersky, which provided free tools for small businesses to use and experience in real time before deciding to adopt them . He also referenced a free webinar conducted with SMEDAN to educate SMBs in Nigeria on cyber threats .

Odii argues that the key to changing the financial mindset of SME owners regarding cybersecurity is a gradual onboarding process rather than an abrupt demand for compliance or expenditure. By allowing businesses to experience cybersecurity tools for free or at a discount, they can witness the tangible benefits before making a financial commitment.

Odii used the analogy of not turning water hot immediately to illustrate the gradual approach - going from zero to 100 is counterproductive, and instead a step-by-step process of education and experience is needed . He referenced the Kaspersky partnership as a practical example of this approach, where free tools are offered so businesses can experience them in real time .

Ariq Bani Hardi underscores the critical role of SMEs in Indonesia's economy, noting that they represent the overwhelming majority of all business units in the country. Their contribution to GDP and employment makes their digital security a matter of national economic importance.

Hardi stated that Indonesia has more than 64 million SME units representing around 99% of all business units , that SMEs contribute more than 60% to the national GDP and absorb more than 90% of the national workforce , and that around 27 million SMEs have already adopted digital technology with the number continuing to grow .

Hardi outlines the concrete cyber risks that SMEs face as they digitalise, demonstrating that these threats are not abstract but have immediate and tangible consequences for business operations and income. Each digital tool or platform that SMEs adopt introduces a corresponding vulnerability that malicious actors can exploit.

Hardi explained that when SMEs use digital payment, they may face fraud or account takeover, directly affecting daily income . When using e-commerce or social commerce, they risk credential theft, fake admin schemes, or impersonation, leading to loss of sales and customer trust . Unmanaged devices with access control issues can interrupt business operations , and dependence on third-party logistics platforms means a disruption in one part of the chain can affect product and service delivery .

Hardi argues that for SMEs, a cyber incident is not merely a technical problem but a direct threat to business continuity. Unlike large enterprises, SMEs lack the financial buffers, technical teams, and recovery capacity to absorb such shocks, meaning a single successful attack can be devastating.

Hardi noted that a small business may not have the same financial buffer, technical team, or recovery capacity as a large enterprise, and that one successful attack can cause financial losses, reputational damage, operational disruption, or even force the business to stop operating temporarily . He further stated that at scale, this becomes a broader economic issue affecting trust in digital payments, consumer confidence in online transactions, and local supply chains .

Hardi reframes the cybersecurity challenge for SMEs as fundamentally a question of trust rather than a purely technical issue. He argues that strengthening SME cybersecurity is about ensuring that SMEs can continue to grow, serve customers, and contribute to the digital economy in a secure and resilient manner.

Hardi stated that what is at stake is not only cybersecurity but trust - trust in digital platforms, trust in payment systems, trust between SMEs and their customers, and trust in the digital economy as a whole . He emphasised that the goal is not to slow down digital transformation but to make digital adoption more trustworthy and resilient .

Hardi describes BSSN's structured four-stage framework designed to make cybersecurity accessible and practical for SMEs at varying levels of digital maturity. The approach is complemented by the Paman Kami tool, which enables SMEs to assess their own information security posture and identify priority areas for improvement without imposing heavy compliance burdens.

Hardi outlined the four stages as: awareness (understanding cybersecurity as protecting trust and business continuity) , self-assessment (understanding their own cybersecurity condition and gaps) , cyber hygiene (basic practices such as strong passwords, multi-factor authentication, regular backup, and anti-phishing awareness) , and building resilience (developing a continuity and recovery mindset) . He described Paman Kami as an information security self-assessment tool designed for capacity building rather than compliance, helping SMEs move from not knowing where to start to knowing what to improve first .

Hardi argues that no single actor can address SME cybersecurity alone, and that a coordinated multi-stakeholder approach is essential. BSSN's role is not only regulatory but also that of an enabler, translating complex cyber risks into simple and scalable resilience practices that SMEs can actually adopt.

Hardi stated that the government cannot do this alone and that securing SMEs requires multi-stakeholder cooperation . He outlined the roles of different actors: national cybersecurity agencies providing guidance and frameworks, local governments supporting outreach and capacity building, digital platforms and cloud providers making security easier, financial institutions helping with fraud prevention, and SME associations delivering practical messages . He also highlighted the role of cybersecurity service providers like Kaspersky in offering affordable, easy-to-use, SME-friendly solutions .

Hardi challenges the myth that cybersecurity is irrelevant to small businesses by pointing out that SMEs are already deeply embedded in the digital ecosystem through the tools they use daily. This existing digital exposure means they are already at risk, regardless of whether they acknowledge it.

Hardi stated that today, even the smallest businesses use digital payments, online marketplaces, social media accounts, mobile devices, cloud applications, and logistic platforms, meaning they are already connected to the digital economy and digital supply chain . He warned that if an SME account is taken over, payments are disrupted, or customer data is leaked, the consequences are real and immediate .

Hardi acknowledges that many SMEs have limited budgets and technical capacity, making it essential that cybersecurity solutions are designed with these constraints in mind. He emphasises that making the first step easy, improvement measurable, and resilience continuous are the key principles for effective SME cybersecurity support.

Hardi noted that many SMEs have limited budget and limited technical capacity, making it important for cybersecurity service providers to offer affordable, easy-to-use, and SME-friendly solutions . He summarised BSSN's lesson as: make the first step easy, make security improvement measurable, and make resilience continuous for SMEs .

Sheila Birgen highlights that SMEs, especially those led by women and youth, form the backbone of most global economies despite growing more slowly than startups. Through DCO's WeElevate initiative, she has observed that these businesses are critical economic contributors even though they face structural constraints on growth.

Birgen noted that most businesses supported through the WeElevate initiative are women-led and youth-led businesses that predominantly employ youths , and that DCO has been able to support more than 10,000 of these businesses in just a year . She observed that SMEs' growth is not as rapid as startups, while they are the ones who majority support economies of most countries globally .

Birgen argues that AI represents a transformative opportunity for SMEs by levelling the playing field between small businesses and large enterprises. Previously, only large organisations could afford advanced technology, but AI is changing this dynamic by making powerful tools accessible to smaller businesses.

Birgen stated that AI provides an equaliser for SMEs because in the past it was assumed only big enterprises could afford technology, but AI is changing that . She noted that AI creates opportunities for SMEs to increase productivity, lower operating costs, make better decisions, conduct market research, and accelerate growth in areas where it would have previously stagnated .

Birgen argues that the primary barrier to SMEs adopting digital tools and AI is not a lack of technology but a lack of confidence and trust. She contends that cybersecurity is central to building this confidence, as SMEs will not engage with digital tools if they do not feel safe doing so.

Birgen observed that most small businesses do not transition to technology in general - not just AI - because of lack of confidence, which is ultimately driven by trust . She argued that if SMEs do not feel safe enough to transition to the digital economy or use digital tools, AI is not an exception to that, making the cybersecurity conversation critical .

Birgen warns that if SMEs enter the digital economy and suffer losses due to cyber incidents, they will have no incentive to continue and will revert to offline operations. This creates a significant risk for digital transformation efforts, as negative experiences can permanently deter SMEs from engaging with digital tools.

Birgen illustrated this with the example of an entrepreneur who starts getting customers on Instagram but then loses everything due to a cyber incident, asking 'what's the point?' and preferring to stay offline . She argued that building the capacities of entrepreneurs to protect themselves and leverage digital tools is essential for enabling full participation in the digital economy .

Birgen argues that effective capacity building for SMEs must go beyond training the founder alone and must encompass the entire team, as the founder cannot be expected to then train staff without support. She also advocates for a graduated approach to digital engagement, starting with domestic e-commerce before moving to cross-border and international trading.

Birgen noted that if you build the capacity of the founder but not their team, you add more work for the founder who already lacks time . She described the WeElevate approach as looking at the business holistically, covering domestic e-commerce first, then export readiness, then international selling, to avoid a drastic shockwave of growth before businesses are ready . Training is delivered through Skills Universe, tailored to specific capacity gaps rather than as blanket training .

Birgen argues that international organisations like DCO play a vital role in facilitating peer learning and mutual support among countries and entrepreneurs at different stages of digital maturity. This cross-border exchange of knowledge and experience means that no country or entrepreneur has to navigate digital transformation challenges alone.

Birgen noted that DCO's diversity of member states spanning different levels of digital maturity allows countries to learn from each other, entrepreneurs to share best practices, and countries to leverage lessons from others . She stated that international cooperation is critical because entrepreneurs and countries don't have to struggle independently , and that it provides an avenue for mutual understanding of gaps and for diverse voices to talk to each other .

Birgen challenges the widespread misconception that cybersecurity is only relevant to large organisations, arguing that small businesses play a vital role and that their insecurity can expose the broader ecosystem. She emphasises that cybersecurity is for everyone, not just large enterprises and governments.

Birgen stated that one common myth is that cybersecurity is for large enterprises and government entities and does not really affect small businesses, calling this 'a big lie' . She argued that small businesses have a vital role to play and that if they are not secure, they can expose everyone else in society .

Birgen argues that the biggest myth to debunk is that cybersecurity is purely a technology issue. She reframes it as a matter of confidence, trust, and enabling SMEs to participate fully and safely in the digital economy.

Birgen stated that the biggest myth she would like to demystify is that cybersecurity is only about technology - it is about ensuring that you protect yourself and your customers, and that you participate fully in the digital economy . She used the analogy of locking a door to illustrate how cybersecurity builds confidence: when you lock your door, you feel more secure, and the same applies to business owners who have confidence in their cybersecurity .

Dina Matar, as moderator, frames the discussion by highlighting that SMEs are not only important as individual economic actors but also as critical links in broader value and supply chains. This interconnected role means that their cybersecurity vulnerabilities have cascading consequences beyond their own operations.

Matar noted that SMEs play an important link in the value chain and in the critical supply chain , and that such businesses are highly susceptible to cyber attacks which are happening ever more frequently . She stated that promoting cybersecurity and the resilience of SMEs should be considered a matter of primary importance, requiring collaborative efforts from the public sector, technology vendors, and industry associations .

Shlychkova challenges the common misconception among SMEs that their small size makes them unattractive to attackers. She explains that cybercriminals are motivated by ease of access rather than the size of the target, and that SMEs' limited resources make them particularly vulnerable.

Shlychkova stated that the majority of SMEs think they are small and therefore not interesting for attackers, but the reality is the opposite - attackers think about how easy it is to penetrate a business, not its size . She noted that because SMEs have no manpower and not enough budget, it is really easy for attackers to get into smaller businesses .

Shlychkova outlines three primary categories of cyber attacks targeting SMEs, drawing on Kaspersky's threat intelligence data. These vectors exploit SMEs' reliance on common digital tools, their growing adoption of AI services, and their interest in financial opportunities such as business loans.

Shlychkova described the first vector as malicious programmes masquerading as legitimate tools like Microsoft Office or messengers, which can steal data, credentials, or encrypt files . The second vector involves attackers masquerading as legitimate AI services, with Kaspersky detecting 30,000 such attacks targeting SMBs in the first half of the year alone - a fivefold increase - impersonating ChatGPT, Claude, and DeepSeek . The third vector involves phishing and scam campaigns targeting credentials, corporate social media accounts, Google business accounts, and banking accounts, often exploiting SMEs' interest in financing and business loans .

Shlychkova highlights that SMEs are not only targeted for direct financial gain but also serve as entry points for sophisticated threat actors seeking to infiltrate larger organisations or national infrastructure. This elevates SME cybersecurity from a business issue to a matter of national security.

Shlychkova noted that SMBs are interesting not only for cybercriminals seeking money or credentials, but also for advanced cyber espionage groups who try to penetrate SMBs in order to use them as proxies to get into larger enterprises or national ecosystems . She concluded that the resilience of SMBs is therefore a question not just about protecting them, but about protecting national cyber resilience .

Shlychkova identifies the exploitation of SMEs' growing interest in AI tools as a rapidly emerging attack vector. Cybercriminals are creating fake versions of popular AI services to steal credentials and data from businesses that are trying to leverage AI for their operations.

Shlychkova reported that Kaspersky's systems detected 30,000 attacks masquerading as AI services targeting SMBs in the first half of the year, representing a fivefold increase compared to the previous period . These attacks impersonated the three most popular AI services: ChatGPT, Claude, and DeepSeek .

Shlychkova advocates for a balanced, three-pillar approach to SME cybersecurity that addresses technology, processes, and people simultaneously. She argues that no single element is sufficient on its own and that even basic measures across all three pillars can dramatically improve an SME's security posture.

Shlychkova described the three pillars as: technology (using cybersecurity protection solutions scalable to business size, protecting endpoints and networks) ; processes (hardening existing systems, reviewing access to sensitive systems and financial transactions, ensuring strong passwords and two-factor authentication) ; and people (increasing awareness about cyber threats, noting that being aware of the problem means being half prepared) . She noted that doing 20% of the effort in these areas can make a business 80% more secure .

Shlychkova argues that cybersecurity cannot be treated as the sole responsibility of individual SMEs but must be understood as a collective challenge requiring cooperation across all stakeholders. The broader economic and societal impacts of cyber incidents make this a shared concern for everyone.

Shlychkova stated that if it is your business, it is not only your problem - it is all of our problem and a shared responsibility, with cybersecurity companies, governments, and organisations needing to join forces . She argued that cooperation is the key because cyber incidents affect the economy, society, and the future .

Shlychkova responds to an audience question by affirming the value of cyber threat intelligence for medium-sized SMEs, explaining that modern threat intelligence is increasingly packaged in machine-readable formats that can be integrated directly into cybersecurity solutions. This allows businesses to proactively search for specific indicators of compromise and continuously enrich their defences.

Shlychkova noted that for more medium-sized businesses, threat intelligence should be part of the protection strategy . She explained that threat intelligence is increasingly packed in machine learning and can be purchased as machine-readable data feeds that are included in cybersecurity solutions to search for specific indicators of compromise and constantly enrich the organisation's defences .

The audience member argues that cyber threat intelligence is a valuable tool for SMEs because attacks on one small business often use the same methods as attacks on others. Sharing and leveraging this intelligence can therefore help SMEs collectively protect themselves more effectively.

The audience member asked the panellists to elaborate on the role of cyber threat intelligence in enabling small and medium businesses to protect themselves, noting that cyber threat intelligence enhances communication because one small business can be attacked using the same techniques, tactics, and procedures .

The audience member identifies a fundamental disconnect between cybersecurity professionals who understand the risks and financial decision-makers who focus on costs. This gap means that financial managers in SMEs often do not appreciate the importance of cybersecurity investment and resist spending on it.

The audience member asked how to bridge the gap between the technical risk perspective of cybersecurity engineers and the financial mindset of financial managers, noting that financial managers do not know they need security and see cybersecurity spending only as a cost rather than recognising its importance .

The audience member calls on governments to take an role in making cybersecurity solutions financially accessible to smaller businesses, particularly those involved in securing critical national infrastructure. The argument is that without government intervention on pricing, many SMEs will remain unable to afford adequate protection.

The audience member asked how the government and cybersecurity providers can reduce or subsidise security modules to fit the budget of smaller developers who are securing critical national infrastructure .

Hardi argues that framing cybersecurity purely as an IT concern misses the broader reality for SMEs, for whom a cyber incident can immediately threaten the survival of the business itself. Unlike large enterprises, SMEs do not have the resources to absorb and recover from attacks, making prevention and resilience existential concerns.

Hardi stated that cybersecurity for SMEs should not be seen only as an IT issue, because for many SMEs a cyber incident can immediately become a business continuity issue . He noted that a small business may not have the same financial buffer, technical team, or recovery capacity as a large enterprise, and that one successful attack can cause financial losses, reputational damage, operational disruption, or even force the business to stop operating temporarily .

Hardi suggests that while cyber threat intelligence is a valuable concept, it is not the most immediately relevant tool for SMEs, which tend to face more direct and practical cyber attacks. He implies that the conversation about threat intelligence for SMEs requires a dedicated and more specialised discussion.

Hardi responded to the audience question on cyber threat intelligence by stating that discussing cyber threat intelligence for SMEs requires a different forum, because SMEs face it more like direct cyber attacks rather than the sophisticated threat intelligence scenarios discussed for larger organisations .

Ife Inwa raises the point that cyber threat intelligence can serve as a communication and protection tool for SMEs, given that attackers frequently reuse the same methods across multiple targets. By sharing intelligence about these common attack patterns, SMEs can collectively strengthen their defences.

Ife Inwa asked what role cyber threat intelligence plays in enabling small and medium businesses to protect themselves, arguing that cyber threat intelligence enhances communication because one small business can be attacked using the same techniques, tactics, and procedures as others . She requested that the panellists draw more lines on this point .