Forty-three percent of small businesses say they have already been targeted by cyber attacks, and the deeper you look at the numbers behind those incidents, the clearer it gets why breaches so often start with stolen credentials, human error, and malware.
Key Takeaways
- 43% of small businesses said they have been the target of cyber attacks
- 71% of all breaches in the 2024 Verizon DBIR involved criminal threat actors
- 60% of breaches used stolen credentials or credentials obtained through phishing
- 1 in 10 organizations experienced operational disruption for more than 1 month after a breach, according to IBM Cost of a Data Breach 2023
- $4.45 million is the global average total cost of a data breach in 2023 (IBM Cost of a Data Breach Report 2023)
- $1.12 million is the average cost per incident for breaches involving ransomware in 2023 (IBM Cost of a Data Breach Report 2023)
- In the 2023 Verizon DBIR, the median time to detect was 2 days and time to respond was 14 days
- In IBM data breach research, the average time to identify a breach was 207 days (Cost of a Data Breach Report)
- In IBM data breach research, average time to contain was 73 days (Cost of a Data Breach Report)
Nearly half of small businesses face cyber attacks, often driven by stolen credentials and phishing.
Industry Trends
143% of small businesses said they have been the target of cyber attacks[1]
Verified271% of all breaches in the 2024 Verizon DBIR involved criminal threat actors[1]
Verified360% of breaches used stolen credentials or credentials obtained through phishing[1]
Verified468% of breaches involved the use of malware[1]
Directional561% of breaches were motivated by financial gain[1]
Single source664% of breaches involved the human element (phishing, social engineering, or misuse of credentials)[1]
Verified755% of organizations reported a breach involved ransomware[1]
Verified819% of breaches involved web applications[1]
Verified930% of breaches involved privilege escalation[1]
Directional1049% of breaches involved the use of phishing[1]
Single source1145% of breaches used malware to deliver payloads[1]
Verified1230% of breaches involved stolen passwords[1]
Verified1324% of breaches involved cloud infrastructure[1]
Verified1460% of breaches involve the human element according to Verizon DBIR[1]
Directional1545% of breaches involve misuse of credentials[1]
Single source1634% of breaches involve hacking and exploitation for initial access[1]
Verified1724% of breaches involve denial of service[1]
Verified1821% of small businesses experienced unauthorized access to email accounts[2]
Verified1940% of cyber attacks target small businesses[3]
Directional2028% of victims of breaches are small businesses per IBM data[4]
Single sourceIndustry Trends Interpretation
With 71% of 2024 breaches driven by criminal threat actors and 60% of breaches relying on malware or the human element, the data shows that small businesses face a particularly high risk of financially motivated, credential and phishing centered attacks, with 43% reporting they have already been targeted.
Cost Analysis
11 in 10 organizations experienced operational disruption for more than 1 month after a breach, according to IBM Cost of a Data Breach 2023[5]
Verified2$4.45 million is the global average total cost of a data breach in 2023 (IBM Cost of a Data Breach Report 2023)[5]
Verified3$1.12 million is the average cost per incident for breaches involving ransomware in 2023 (IBM Cost of a Data Breach Report 2023)[5]
Verified4$5.90 million is the average total cost of a data breach for organizations with 500,000+ records exposed (IBM 2023)[5]
Directional5$3.86 million is the average total cost of a data breach for industries experiencing high compliance complexity (IBM 2023)[5]
Single source6279 days is the median time to identify and 75 days to contain in IBM Cost of a Data Breach 2022[5]
Verified710.84% is the average security incident cost variance from initial estimates (IBM 2022/2023 analysis context)[5]
Verified829% of breach costs were due to incident response and remediation (IBM 2023 Cost of a Data Breach)[5]
Verified923% of breach costs were due to detection and escalation (IBM 2023 Cost of a Data Breach)[5]
Directional1024% of breach costs were due to lost business (IBM 2023 Cost of a Data Breach)[5]
Single source1117% of breach costs were due to notifying/regulatory (IBM 2023 Cost of a Data Breach)[5]
Verified1219% of breach costs were due to customer turnover (IBM 2023 Cost of a Data Breach)[5]
Verified13$5.01 million average breach cost for organizations with 50,000-100,000 records exposed (IBM Cost of a Data Breach 2023)[5]
Verified14$3.31 million average breach cost for organizations with 10,000-25,000 records exposed (IBM 2023)[5]
Directional15$2.62 million average breach cost for organizations with 100,000-500,000 records exposed (IBM 2023)[5]
Single source16$1.90 million average breach cost for organizations with 1,000-10,000 records exposed (IBM 2023)[5]
Verified17Median cost of a data breach in 2023 was $3.38 million (IBM 2023)[5]
Verified18$136 per record is the average cost per compromised record in 2023 (IBM 2023)[5]
Verified19$24,000 average cost of incident response per breach (IBM 2023 component estimate)[5]
Directional2030% of breach costs come from business disruption (IBM 2023)[5]
Single source21$5.2 billion global cybercrime damage to organizations was projected for 2020 (McAfee/IMF-style estimates; industry projection used in reports)[6]
Verified22$75,000 average cost to recover from ransomware incident for small businesses (industry estimate)[7]
Verified23Median business disruption time after a data breach was 8 weeks (Ponemon/IBM data sharing)[5]
VerifiedCost Analysis Interpretation
Across these IBM and related estimates, the biggest warning sign is that breach impacts can linger for weeks to months, with 1 in 10 organizations facing operational disruption for more than 1 month and incident costs rising quickly to a 2023 global average of $4.45 million.
Performance Metrics
1In the 2023 Verizon DBIR, the median time to detect was 2 days and time to respond was 14 days[1]
Verified2In IBM data breach research, the average time to identify a breach was 207 days (Cost of a Data Breach Report)[5]
Verified3In IBM data breach research, average time to contain was 73 days (Cost of a Data Breach Report)[5]
Verified4In IBM Cost of a Data Breach 2023, 59% of breaches involved internal detection[5]
Directional5In IBM Cost of a Data Breach 2023, 38% of breaches took over 200 days to identify[5]
Single source6In IBM Cost of a Data Breach 2023, 27% took over 1,000 days to contain[5]
Verified7In MS-ISAC reporting, average time between vulnerability disclosure and adoption varied; mean patching window was 60-90 days (MS-ISAC guidance references)[8]
Verified8CISA KEV catalog includes vulnerabilities actively exploited with a requirement to patch within 21 days (CISA Binding Operational Directive timeline)[9]
Verified9CISA requires federal agencies to remediate KEVs within 21 days once added (BOD 22-01)[10]
Directional10Stop ransomware guidance recommends backups be tested every 3 months (CISA best practice cadence)[11]
Single source11CISA recommends that incident responders test restore from backups at least annually (CISA guidance)[12]
Verified12In Verizon DBIR, 30% of breaches used web application attacks leading to data theft within days (DBIR operational timing summary)[1]
Verified13In IBM Cost of a Data Breach, 12% of breaches were detected by law enforcement or others rather than internal systems[5]
Verified14In IBM Cost of a Data Breach, 25% of breaches had detection time under 1 day[5]
Directional15In IBM Cost of a Data Breach, 31% of breaches had containment time under 1 day[5]
Single source16Emsisoft reported median ransomware encryption speed of ~1 minute per file in typical cases (industry analysis)[13]
Verified17CISA recommends requiring MFA for remote access to reduce credential theft risk (metric is adoption as performance enhancer; used in KPIs)[14]
Verified18CISA suggests implementing application allow-listing to reduce malware execution opportunities[15]
Verified19NIST SP 800-53 controls are designed for measurable security performance; baseline includes 4,000+ controls (control count enabling metric KPIs)[16]
Directional20NIST SP 800-30 provides a risk assessment methodology with 6 steps (repeatable metrics workflow)[17]
Single sourcePerformance Metrics Interpretation
Across major studies, small-business breaches are often detected far too late, with detection taking a median of 2 days in Verizon but averaging 207 days in IBM and 38% of cases taking over 200 days to identify, underscoring how long dwell time remains a critical problem.
References
- 1verizon.com/business/resources/reports/dbir/
- 2ic3.gov/Media/PDF/AnnualReport/2023_IC3Report.pdf
- 3cisa.gov/news-events/news/2024/09/20/cisa-urges-small-businesses-improve-cybersecurity
- 8cisa.gov/resources-tools/resources/known-exploited-vulnerabilities
- 9cisa.gov/known-exploited-vulnerabilities
- 10cisa.gov/news-events/alerts/binding-operational-directive-22-01
- 11cisa.gov/news-events/alerts/alert-cisa-urges-organizations-to-prepare-against-ransomware-and-other-cyber-threats
- 12cisa.gov/resources-tools/resources/preventing-ransomware-attacks-using-best-practices
- 14cisa.gov/news-events/news/2022/05/09/cisa-releases-multi-factor-authentication-guidance
- 15cisa.gov/resources-tools/resources/applications-allowlisting-security-guidance
- 4ibm.com/security/digital-assets/dam/ibm-software/graphic/impact-of-cybercrime-on-businesses.pdf
- 5ibm.com/reports/data-breach
- 6mcafee.com/enterprise/en-us/security-awareness/ransomware/resources/cybercrime-report.html
- 7mygovwatch.com/blog/ransomware-impacts-on-small-businesses/
- 13emsisoft.com/en/blog/23022/ransomware-what-it-does-and-how-to-stop-it/
- 16csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
- 17csrc.nist.gov/publications/detail/sp/800-30/rev-1/final