Small and medium-sized firms are not putting IT security at the top of their priority list despite believing a security breach would be crippling, a new survey has found.

Research conducted by IT research company IDC found that 80% of small firms fear a security threat. However, only 8% cited improving IT security as a top priority.

“Small and medium sized businesses’ behaviour toward security is very tactical and meets their immediate requirements,” said Eric Domage, European research manager, security products & solutions, IDC.

“However, the next generation of threats are not understood, not analyzed and the complexity cannot be handled internally.”

The biggest IT challenges cited by small firms were keeping up to date with security solutions (39%), keeping up to date with new threats (38%), and keeping costs low (33%).

Mark Sunner, chief security analyst at MessageLabs, who commission the research, pointed out the vulnerability of small businesses without proper protection.

“Security has a direct impact on every critical part of a business including reputation, productivity and business continuity.

“Although it appears [small firms] now have a better understanding of the risks it still appears that many are unable to prioritize or dedicate the resources to deal with security appropriately.

“Without a comprehensive security solution many [businesses] could be oblivious to the fact that they're being attacked, with the realization only obvious once the damage has been done.”

© Crimson Business Ltd. 2007