Strengthening Cyber Resilience through Workshops for SMEs and PSOs

SMEs in the Île-de-France region face escalating cybersecurity threats that jeopardise their operations and financial stability. Many of these businesses lack the necessary knowledge and tools to effectively defend against sophisticated cyberattacks, leaving them exposed to various types of breaches. Common threats include phishing attacks, ransomware, and data breaches, which can disrupt operations, damage reputations, and lead to significant financial losses. For example, a 2023 survey by Amrae revealed that the average cost of a cyberattack reported by SMEs to insurance companies in 2022 was €120,000.

A small consulting company in Hauts-de-Seine, anonymised for confidentiality, exemplifies these challenges. Despite having basic security measures in place, such as antivirus software and firewalls, the company had limited awareness of more advanced cybersecurity practices. This gap led to several minor breaches, including unauthorised access to sensitive client data, which undermined client trust and resulted in additional costs for remediation.

The primary obstacles preventing stronger cybersecurity measures include a lack of specialised knowledge, limited budgets for advanced security solutions, and insufficient internal resources to implement and manage comprehensive security strategies. Many SMEs struggle to stay updated with rapidly evolving cyber threats and often view cybersecurity as an expense rather than a critical investment. Additionally, the complexity of cybersecurity tools and the need for ongoing training and support further complicate their ability to enhance defenses effectively.

The challenge lies in bridging this knowledge gap and providing practical, actionable tools that SMEs can easily integrate into their operations. By equipping these businesses with essential cybersecurity skills and resources, the aim is to bolster their defenses, mitigate risks, and ultimately strengthen the overall digital security landscape of the region.

To address the cybersecurity challenges faced by SMEs in Île-de-France, CYBIAH, coordinated by Campus Cyber and in collaboration with Paris Ouest La Défense (POLD) and the Paris Île-de-France Regional Chamber of Commerce and Industry (CCI Paris Île-de-France), launched the «Atelier Cyber PME» workshops. POLD fosters regional innovation and economic development, while CCI Paris Île-de-France supports around 915,000 companies, providing valuable insights and growth support.

The workshops are designed to educate SMEs on cybersecurity best practices through engaging formats. Each session covers critical topics such as phishing prevention, ransomware defenses, and incident response strategies. Workshops are tailored to various SME types, with a special edition addressing Public Sector Organisations.

Using the Cyber Investigation platform created by CYBIAH’s consortium member, the workshops feature gamified, immersive content that raises awareness and engages participants. This interactive approach allows participants to experience real-world scenarios and apply cybersecurity best practices.

CYBIAH also partnered with Axel (Meogroup) to develop innovative training materials. Axel, supporting startups with over 850 professionals, provided additional resources, while CYBIAH’s expert Hubert Loiseau, a former information systems security officer for France’s Prime Minister's Services, led the sessions.

Public and private investments are crucial for this initiative. Public funding ensures broad access and regional support, while private contributions provide specialised expertise and advanced tools. This collaboration ensures high-quality training, strengthens SMEs' cybersecurity, and promotes regional digital resilience.

The workshops led to significant improvements in the cybersecurity postures of participating SMEs. For instance, the consulting company saw a marked reduction in cyber incidents and enhanced digital resilience. The interactive nature of the workshops and personalised advice enabled businesses to implement effective strategies immediately. The special edition for PSOs increased awareness and preparedness among local authorities. The workshops also facilitated "test before invest" discussions, allowing SMEs to explore cybersecurity solutions in a low-risk environment before committing to investments.

Survey results from the «Atelier Cyber PME» workshops held on 25/03, 28/05, and 30/05 revealed an overall satisfaction score of 8.7/10. Participants rated the workshop facilitation and interactivity between participants at 8.2/10. Additionally, 83.33% of SMEs started CYBIAH’s cybersecurity program at the end of the workshop, with 80% indicating a plan to schedule an appointment with a CYBIAH expert for support within the next 3 months.

The “Atelier Cyber PME” workshops have provided valuable insights and highlighted ongoing challenges. Engaging SME leaders for a 2.5-hour session proved difficult due to their demanding schedules. In response, CYBIAH adjusted the format to include less segmented sessions, resulting in increased participation. This flexibility has been a crucial lesson, emphasising the need for adaptable formats to accommodate busy professionals. Recognising time constraints, CYBIAH also created the "Safe & Sound" podcast as an accessible alternative for cybersecurity education, ensuring that SMEs benefit from essential information even if they cannot attend workshops.

Challenges such as occasional no-shows and the complexities of internal approvals for joining CYBIAH’s cybersecurity program have provided valuable insights. Despite SMEs’ interest in our free cyber support program, navigating internal hurdles remains a part of the process. The early stage of the program (launched in 2023) underscores the need for enhanced outreach strategies to boost commitment and engagement.

Additionally, obtaining case studies has been challenging due to beneficiaries’ reluctance to disclose cybersecurity issues. Future initiatives will focus on finding alternative ways to demonstrate the program’s impact and effectiveness beyond direct case studies.

Looking ahead, the introduction of a hybrid approach with remote access aims to improve participation accessibility. These experiences highlight the importance of overcoming logistical barriers, fostering internal buy-in, and innovating in our methods to showcase the program’s success and impact.