Medium-sized companies face numerous hurdles to implement effective cybersecurity, while smaller and low-margin organisations cannot afford next-generation technology to improve their cybersecurity posture, as these require expert skills to implement not only next-generation security solutions, but also maintain current good practice.

Given that the cybersecurity landscape changes on a daily basis, no static implementation would be relevant or offer the kind of protection required. Therefore, if an organisation does not have an extended security team, it is difficult to maintain current best practices, says information technology services multinational T-Systems South Africa security specialist sales executive Lukas van der Merwe.

"A myriad of solutions offer multiple layers of protection, depending on the type of information an organisation processes and its specific risk profiling," he explains.

Medium-sized companies should consider looking at managed security service providers that deliver an end-to-end service instead of investing in their own technology, which could be prohibitively expensive and difficult to manage and maintain, Van der Merwe advises.

It is important that enterprises perform a holistic risk assessment and define the defence cost relevant to their organisation before dismissing any cybersecurity investment as too expensive, he emphasises.

A breach can be particularly acute and financially devastating for small and medium-sized businesses, yet many still believe that smaller entities are less likely to be targeted than large enterprises.

This is exacerbated by the current pandemic, as many organisations are adopting remote work practices, cloud and software-as-a-service solutions. This affords them sustainability under the circumstances, but frequently expands the attack surface of an organisation in terms of cyberattacks, says Van der Merwe.

"South Africa has been near the top of the list for cyberattacks for some time now and has one of the highest risk ratings in the world.

Unfortunately, it is becoming increasingly difficult to reduce this, as attacks are continuing to become more sophisticated. Medium-sized firms find themselves firmly in the crosshairs of cybercriminals, they also have limited options to successfully defend themselves against cyberattacks, as the challenges faced by this segment of the market are multifaceted."

From an access protection point of view - beyond basic perimeter protection - companies need to consider network access control to ensure only authorised users are able to access its network. With a significant amount of remote workers, companies need to ensure they securely connect their networks and virtual private network technology is key.

The list of what solutions can be added on top is almost endless, adds Van der Merwe.

"Most mid-size companies can successfully defend their operations by using managed security service providers.

"Companies can leverage shared solutions that are in place for a larger number of customers, while being maintained by a group of experts with significant experience. This can be implemented at a unit cost that is far below what a dedicated investment would be," he says.