With small businesses accounting for nearly a third of all data breaches while being vastly unprepared, the hidden costs of a cyberattack—from crushing fines to a 60% chance of closing within six months—are a quiet crisis threatening the backbone of our economy.
Key Takeaways
- 43% of all cyber attacks target small businesses despite them representing only 20% of the market
- In 2023, 74% of small and medium-sized businesses (SMBs) reported experiencing at least one cyber incident
- Small businesses account for 31% of all data breaches reported in 2023
- Average cost of a data breach for small businesses was $25,000 in 2023
- SMBs lost $4.45 million on average per ransomware attack in 2023
- 60% of small businesses that suffer a breach close within 6 months, costing $1.2M in lost revenue
- Phishing is the most common threat, accounting for 36% of SMB breaches in 2023
- Ransomware affected 66% of SMBs that paid attackers in 2023 surveys
- Malware infections represent 22% of small business cyber incidents annually
- Only 26% of SMBs use multi-factor authentication (MFA), exposing to account takeovers
- 51% of small businesses lack employee cybersecurity training programs
- Just 14% of SMBs have incident response plans in place
- Businesses with backups recover 60% faster from ransomware
- SMBs with incident response plans reduce breach costs by 35%
- MFA adoption cuts account compromise recovery time by 50%
Small businesses face devastating cyber attacks and must urgently increase their security.
Common Threats
1Phishing is the most common threat, accounting for 36% of SMB breaches in 2023
Verified2Ransomware affected 66% of SMBs that paid attackers in 2023 surveys
Verified3Malware infections represent 22% of small business cyber incidents annually
Verified4Business Email Compromise (BEC) scams targeted 43% of small firms in 2023
Directional5DDoS attacks hit 20% of SMB websites monthly
Single source6Supply chain vulnerabilities exploited in 15% of SMB breaches
Verified7Cloud misconfigurations cause 32% of small business data exposures
Verified8IoT devices are entry points in 18% of SMB attacks
Verified9Insider threats contribute to 34% of small business incidents
Directional10Weak passwords lead to 81% of SMB hacking-related breaches
Single source11Spear-phishing success rate in SMBs is 3%, higher than average
Verified12Unpatched software vulnerabilities in 57% of SMB malware cases
Verified13Social engineering tricks 85% of small business employees yearly
Verified14Mobile device threats affect 25% of SMB remote workers
Directional15Third-party app risks in 29% of SaaS-using SMBs
Single source16Credential stuffing attacks on SMBs up 71% in 2023
Verified17Zero-day exploits hit 12% of small manufacturers
Verified18Vishing (voice phishing) incidents rose 15% in SMB call centers
Verified19Smishing texts targeted 40% of small retailers
Directional20Ransomware-as-a-Service used in 70% of SMB infections
Single source21API vulnerabilities exposed in 23% of SMB cloud apps
Verified22Wi-Fi eavesdropping risks 19% of SMB cafes/hotels
Verified23Deepfake threats emerging in 5% of BEC SMB cases
Verified24Legacy system exploits in 27% of small finance firms
Directional25Shadow IT usage leads to 16% of unauthorized access
Single sourceCommon Threats Interpretation
If you thought your small business was too unglamorous for cyberattacks, this constellation of statistics suggests that criminals are far less discerning and far more opportunistic than your average food critic.
Financial Impact
1Average cost of a data breach for small businesses was $25,000 in 2023
Verified2SMBs lost $4.45 million on average per ransomware attack in 2023
Verified360% of small businesses that suffer a breach close within 6 months, costing $1.2M in lost revenue
Verified4Phishing costs small businesses $4.91 million annually on average
Directional5Hiscox reports average cyber claim for SMBs at £12,500 ($15,800) in 2023
Single source6Downtime from attacks costs SMBs $184,000 per incident in productivity losses
Verified7Small business ransomware recovery averages $1.85 million including fines
Verified8BEC scams drained $2.9 billion from US small businesses in 2023
Verified9Notification costs post-breach average $150,000 for SMBs under GDPR
Directional10SMB cyber insurance premiums rose 50% to $2,500 annually in 2023
Single source11Lost business post-breach costs SMBs 25% of annual revenue on average
Verified12Average DDoS attack mitigation costs SMBs $40,000 per event
Verified13Data recovery expenses hit $100,000 for 35% of SMB breaches
Verified14Legal fees from SMB breaches average $75,000 in the US
Directional15SMB supply chain attacks cost $500,000 in remediation on average
Single source16Phishing training failure costs SMBs $12,000 per employee annually
Verified17Cloud breach costs SMBs $200,000 in fines and cleanup
Verified18IoT attack financial impact on SMBs averages $50,000 per incident
Verified19SMB malware removal costs $25,000 including expert help
Directional20Reputation damage post-SMB breach leads to 20% revenue drop ($300K avg)
Single source21Ransomware negotiation fees for SMBs average $10,000
Verified22SMB e-commerce breaches cost $90,000 in PCI compliance fines
Verified23Hybrid work cyber losses total $1.5M per SMB annually
Verified24Small business fines under CCPA average $50,000 per violation
Directional25DDoS extortion demands cost SMBs $30,000 in payouts yearly
Single source26SMB data center outages cost $8,000 per hour
Verified27Phishing spear campaigns cost SMBs $150,000 per successful hit
Verified28Small retailer POS breaches average $250,000 loss
Verified29SMB consultant fees post-breach hit $60,000
Directional30Ransomware backups restoration costs SMBs $80,000
Single sourceFinancial Impact Interpretation
This chorus of fiscal horrors, where a $25,000 breach can be the overture to a $1.85 million ransomware symphony and a final curtain of insolvency, sings a simple truth for small businesses: cybersecurity isn't a line item, it's your survival's bottom line.
Prevalence and Incidence
143% of all cyber attacks target small businesses despite them representing only 20% of the market
Verified2In 2023, 74% of small and medium-sized businesses (SMBs) reported experiencing at least one cyber incident
Verified3Small businesses account for 31% of all data breaches reported in 2023
Verified460% of SMBs faced phishing attempts in the past year, leading to higher incidence rates
Directional5UK small businesses saw a 190% increase in cyber attacks from 2022 to 2023
Single source682% of small business owners believe they are targets but only 14% feel prepared, increasing vulnerability incidence
Verified7In the US, 1 in 10 small businesses suffer a cyber attack daily
Verified8SMBs experienced 2,200 cyber attacks per business on average in 2023
Verified946% of small businesses reported a breach in the last 12 months as per 2024 surveys
Directional10Ransomware attacks on small businesses rose by 37% year-over-year in 2023
Single source1128% of small businesses closed permanently after a cyber attack
Verified12EU SMBs faced 15% higher attack rates than large firms in 2023
Verified1367% of small retailers reported cyber incidents in 2023 holiday season
Verified14Phishing incidents affected 83% of small businesses in Q1 2024
Directional15SMB cloud misconfigurations led to 40% of breaches in 2023
Single source1655% of small businesses in healthcare sector hit by attacks in 2023
Verified17DDoS attacks targeted 39% of small businesses globally in 2023
Verified1871% of SMBs in finance reported incidents, highest sector rate
Verified19Cyber attacks on small manufacturers up 25% in 2023
Directional2062% of small businesses in APAC faced ransomware in 2023
Single source21US small businesses saw 300% spike in supply chain attacks
Verified2249% of SMBs experienced BEC scams leading to incidents
Verified23IoT vulnerabilities caused 22% of small business breaches
Verified2476% of small construction firms hit by cyber events in 2023
Directional25Hybrid work increased SMB attack incidence by 35%
Single source2658% of small nonprofits faced cyber incidents annually
Verified27SMB e-commerce sites breached at 41% rate in 2023
Verified2865% of small law firms reported data exposures
Verified29Cyber incidents in small transport businesses up 28%
Directional3053% of SMB accountants hit by attacks in tax season 2023
Single sourcePrevalence and Incidence Interpretation
Small businesses are disproportionately under siege in cyberspace, with a stubborn and widespread belief in their own immunity creating a tragically ironic reality where their lack of preparedness makes them the favorite target for criminals.
Recovery and Response
1Businesses with backups recover 60% faster from ransomware
Verified2SMBs with incident response plans reduce breach costs by 35%
Verified3MFA adoption cuts account compromise recovery time by 50%
Verified4Trained employees report 70% more phishing attempts early
Directional5Network segmentation limits breach scope to 40% of systems
Single source6Regular patching reduces exploit success by 65%
Verified7Cyber insurance claims processed 80% faster with preparedness
Verified8EDR tools detect 90% of ransomware before encryption
Verified9Tested backups restore data in 24 hours for 75% of cases
Directional10Zero-trust cuts lateral movement recovery by 45%
Single source11Phishing simulations improve detection rates to 92%
Verified12Cloud backups enable 55% quicker recovery vs on-prem
Verified13Incident response teams form in 2 days for prepared SMBs
Verified14DLP prevents 78% of data exfiltration attempts
Directional15Pen testing identifies 85% of vulnerabilities pre-attack
Single source16MDM wipes lost devices recovering 60% of data remotely
Verified17SIEM alerts reduce response time to 1 hour average
Verified18Third-party audits improve supply chain recovery by 40%
Verified19Password managers prevent 81% of credential breaches
Directional20AI threat hunting shortens dwell time to 1 day
Single source21Dark web monitoring alerts before 70% of identity thefts
Verified22Immutable backups thwart 95% of ransomware deletions
Verified23Cyber drills cut panic response errors by 50%
Verified24Endpoint protection blocks 99% of known malware
Directional25Post-incident reviews prevent 62% of repeat attacks
Single source26Automated backups achieve 100% uptime recovery in tests
Verified27MFA recovery from compromises takes 30% less effort
Verified28Vulnerability management programs restore ops 2x faster
VerifiedRecovery and Response Interpretation
If your small business cybersecurity strategy is merely an afterthought dressed as a password sticky note, these statistics are your intervention, proving that a little preparation is essentially a cheat code for surviving the digital thunderdome.
Security Practices
1Only 26% of SMBs use multi-factor authentication (MFA), exposing to account takeovers
Verified251% of small businesses lack employee cybersecurity training programs
Verified3Just 14% of SMBs have incident response plans in place
Verified469% of small firms do not encrypt sensitive data
Directional5Only 28% conduct regular vulnerability scans
Single source645% of SMBs fail to patch software within 30 days
Verified7Cyber insurance held by only 34% of small businesses
Verified862% lack endpoint detection and response (EDR) tools
Verified9Backup testing done quarterly by just 22% of SMBs
Directional10Zero-trust architecture adopted by 17% of small firms
Single source1173% do not segment networks to limit breach spread
Verified12Employee phishing simulations run by 31% annually
Verified13Cloud security posture management used by 25% of SMBs
Verified14Password managers implemented in 39% of small businesses
Directional15Regular penetration testing by 19% of SMBs
Single source1655% have no mobile device management (MDM)
Verified17SIEM tools deployed in 12% of small operations
Verified18Data loss prevention (DLP) software in 27% of firms
Verified1941% conduct third-party risk assessments yearly
Directional20Firewall updates automated in 33% of SMB networks
Single source21Cyber hygiene audits done by 24% semi-annually
Verified22MFA enforced on all accounts in 29% of SMBs
Verified23Incident reporting to authorities by 38% post-event
Verified2467% lack AI-driven threat detection
Directional25Employee offboarding security checks in 44%
Single source26IoT security policies in 21% of connected SMBs
Verified27Dark web monitoring subscribed by 15%
VerifiedSecurity Practices Interpretation
It is statistically more secure to run a medieval castle with a moat and a drawbridge than it is to run a modern small business, given that the castle's defense plan doesn't hinge on whether someone clicked a suspicious link offering a free PDF on proper chainmail maintenance.
Sources & References
- Reference 1VERIZONverizon.comVisit source
- Reference 2HISCOXGROUPhiscoxgroup.comVisit source
- Reference 3IBMibm.comVisit source
- Reference 4KEEPERSECURITYkeepersecurity.comVisit source
- Reference 5HISCOXhiscox.co.ukVisit source
- Reference 6NATIONWIDEnationwide.comVisit source
- Reference 7FORBESforbes.comVisit source
- Reference 8CISCOcisco.comVisit source
- Reference 9PONEMONponemon.orgVisit source
- Reference 10SOPHOSsophos.comVisit source
- Reference 11NATIONALCYBERSECURITYALLIANCEnationalcybersecurityalliance.orgVisit source
- Reference 12ENISAenisa.europa.euVisit source
- Reference 13STATISTAstatista.comVisit source
- Reference 14APWGapwg.orgVisit source
- Reference 15CHECKPOINTcheckpoint.comVisit source
- Reference 16HHShhs.govVisit source
- Reference 17CLOUDFLAREcloudflare.comVisit source
- Reference 18PWCpwc.comVisit source
- Reference 19NAMnam.orgVisit source
- Reference 20ACSCacsc.gov.auVisit source
- Reference 21CISAcisa.govVisit source
- Reference 22IC3ic3.govVisit source
- Reference 23PTSECURITYptsecurity.comVisit source
- Reference 24AGCagc.orgVisit source
- Reference 25ZDNETzdnet.comVisit source
- Reference 26COUNCILOFNONPROFITScouncilofnonprofits.orgVisit source
- Reference 27SHOPIFYshopify.comVisit source
- Reference 28AMERICANBARamericanbar.orgVisit source
- Reference 29TTNEWSttnews.comVisit source
- Reference 30AICPAaicpa.orgVisit source
- Reference 31CROWDSTRIKEcrowdstrike.comVisit source
- Reference 32MARSHmarsh.comVisit source
- Reference 33MALWAREBYTESmalwarebytes.comVisit source
- Reference 34OAGoag.ca.govVisit source
- Reference 35UPTIMEINSTITUTEuptimeinstitute.comVisit source
- Reference 36AKAMAIakamai.comVisit source
- Reference 37PROOFPOINTproofpoint.comVisit source
- Reference 38EXPERIANexperian.comVisit source
