On paper only: 65% of small and medium enterprises lacking applicable cybersecurity strategy

• Two-thirds say their strategy is more theoretical than practical - broken down into objectives

• 34% admit they lack the expertise to respond to cyber incidents

• New Kaspersky report reveals the everyday challenges and misconceptions of IT leaders in SMEs

The majority of cybersecurity decision-makers in small and medium-sized enterprises (SMEs) in Europe lack preparedness when it comes to protecting their companies.

Two-thirds (65%) report that their strategy exists more in theory than in practice, or that it boils down to a series of objectives.

Furthermore, some admit that there are gaps in their knowledge of even the most basic aspects of cybersecurity, with 34% stating that they need to better understand how to respond to and resolve cyber incidents.

This lack of applicable strategy and expertise leaves many without real protection - and vulnerable to cyberattacks.

These are the conclusions of the latest Kaspersky report “Real talk on cybersecurity – What’s annoying, what’s missing, and what’s really helping?”. (1)

SMEs in Europe lack the right knowledge and a consistent strategy to protect themselves. Only 29% can claim to have a fully implemented cybersecurity strategy.

A total of two-thirds (65%) admit that their current approach is a partially implemented, mostly theoretical strategy, or that it is not a real plan at all, but just a set of goals.

Specifically, 46% say that their strategy is designed but not yet fully implemented, while 19% say that they are working towards achieving goals rather than implementing an actual strategy.

These findings point to a widespread gap between strategy development and operational implementation - a gap that is likely to lead to structural weaknesses in the day-to-day cybersecurity operations of SMEs.

Attacks in Europe and the attitudes of decision-makers - Does anyone know what SMEs need?

This lack of an applicable strategy is confirmed by the latest Kaspersky analysis of attacks in Europe. From January to April 2025, Austria recorded the highest share (40%) of attacks in Europe in which potentially unwanted software (PUA) and malware imitating legitimate brands targeted SMEs, followed by Italy (25%), Germany (11%), Spain (10%) and Portugal (6%).

These statistics clearly show that there is a gap between strategy and implementation. This becomes even more apparent when considering the limited trust decision makers have in their own cybersecurity knowledge and tools.

For example, 34% want to better understand how to optimize their response and resolution capabilities during a cyber incident, and a third (30%) are curious to know if their endpoint protection is even strong enough to deal with today’s threats. They also want - or need to - better understand:

• which of the many tools available on the market they really need (28%),

• how to provide cloud visibility and vulnerability assessments (24%),

• the legal and regulatory requirements that apply to their companies (24%).

Based on this, with 30% doubting that the risk profiles offered by vendors truly reflect the reality of a company of their size, the question arises whether anyone really knows how to protect their business.

“Decision-makers involved in cybersecurity in SMEs too often rely on strategies that look good on paper but fall short in practice, lacking the concrete operational measures necessary to defend against today’s attacks.

Our research shows that two-thirds of them have yet to implement these measures effectively, leaving them vulnerable to attacks that are increasingly targeting SMEs. To close this gap, organizations need to establish cybersecurity strategies that are not only clearly defined, but also fully embedded in everyday structures, responsibilities and decisions.

To reduce this exposure, organizations need to move from theory to practice, close key knowledge gaps and build a coherent cybersecurity strategy that is an integral part of everyday operations - not isolated documents or uncoordinated measures,” said Dragan Davidovic, Managing Director for Eastern Europe at Kaspersky.

To overcome the lack of knowledge and strategy now and in the future, business leaders and organizations should take the following steps:

• Turn cybersecurity plans into concrete protection: Kaspersky Next for SMEs integrates advanced endpoint protection with EDR and XDR solutions - providing real-time insight, threat response, and the transparency needed to operationally execute a security strategy.

For SMEs with an already established IT infrastructure, Kaspersky Next XDR Optimum provides advanced integration and visibility.

• Deliver protection with limited IT resources: Even very small businesses can achieve professional-level protection.

Kaspersky Small Office Security offers security that is easy to implement and manage, preventing financial losses, data theft and ransomware - without the need for in-house experts.

• Invest in awareness and education: Introduce targeted training programs and implement security awareness initiatives at all levels of the organization to minimize the risk of internal incidents. The Kaspersky Automated Security Awareness Platform supports SMEs with scalable, role-based learning modules.

• Integrate and develop cyber resilience: Establish a “security first” mindset across the organization by building a culture that empowers employees to effectively mitigate emerging threats in their daily business.

(1) For this research, Kaspersky commissioned Arlington Research to conduct an online survey of decision-makers whose role significantly involves cybersecurity, working in organizations with fewer than 500 employees in Europe in August and September 2025.

Arlington conducted a total of 820 interviews with this target group Europe: 600, 60 interviews each in: Germany, Austria, Switzerland, UK, France, Italy, Spain, Greece, Romania and Serbia.

Kaspersky

Kaspersky

Kaspersky Next

Kaspersky Next XDR Optimum

Kaspersky Small Office Security

Kaspersky Automated Security Awareness Platform

cybersecurity

cyber incident

survey