Small Business Cyber Security isn’t just an IT checklist—it’s about how attacks exploit everyday operations, from people to exposed systems. In recent Verizon DBIR findings, 72% of breaches involved a human element, while 90% included weak passwords, compromised credentials, or insufficient hardening. Detection is often the weak spot: 68% of SMBs can’t detect a breach quickly, so planning for web-app risk and incident response matters.
Key Takeaways
- 43% of small businesses report they had experienced a data breach in the past 12 months
- 28% of breaches in the Verizon Data Breach Investigations Report (DBIR) involved small organizations
- 72% of breaches in the Verizon DBIR involved a human element (social engineering or other human action)
- 39% of small businesses do not patch systems or do so only occasionally (survey estimate)
- 33% of small businesses use encryption for data in transit (survey estimate)
- 50% of small businesses use antivirus software on endpoints (survey estimate)
- 1 in 5 organizations paid ransom in 2023 (Coveware/industry reports estimate)
- $5.2 billion total costs from cybercrime for the year 2021 globally (Cybersecurity Ventures / other global cybercrime cost studies)
- 68% of SMBs cannot detect a breach quickly (survey-based detection confidence)
- 44% of breaches involved a web application where attackers leveraged application-layer weaknesses (Verizon DBIR)
- 58% of breaches were discovered by an external party (Verizon DBIR)
Nearly half of small businesses faced breaches in the past year, largely driven by human error and weak security.
Related reading
01 · Category
Industry Trends29 stats
01
43% of small businesses report they had experienced a data breach in the past 12 months
02
28% of breaches in the Verizon Data Breach Investigations Report (DBIR) involved small organizations
03
72% of breaches in the Verizon DBIR involved a human element (social engineering or other human action)
04
90% of breaches involved at least one of the following: weak passwords, compromised credentials, or insufficient system hardening
05
64% of breaches in the Verizon DBIR were financially motivated
06
46% of ransomware incidents involved the use of stolen credentials (e.g., brute force or credential stuffing patterns)
07
31% of reported breaches involved phishing/social engineering as the initial vector
08
22% of breaches involved malware
09
84% of breaches exploited known vulnerabilities (where a patch or workaround existed)
10
61% of breaches involved a web application
11
53% of breaches used cloud services or cloud hosting as part of the attack chain
12
52% of cyber incidents involve credential theft or use
13
22% of malware infections in small business environments originated from phishing emails
14
58% of breaches were discovered by an external party (in Verizon DBIR)
15
33% of incidents were classified as “crimeware” or fraud-related activity (Verizon DBIR)
16
36% of organizations had no incident response plan (survey finding from Ponemon/IBM-type studies)
17
48% of SMBs were not aware of their data exposure (survey-based)
18
44% of small businesses shut down within a year of a cyberattack (survey-based / industry studies)
19
60% of SMBs lack backups that can restore business-critical systems quickly after ransomware
20
37% of organizations have had a breach due to employee mistakes (IBM/Verizon-type industry reports)
21
25% of SMB breaches used stolen credentials as primary tactic (Verizon DBIR findings)
22
14% of SMBs reported they were targeted by ransomware (survey estimate)
23
57% of breaches involved compromised credentials or weak password patterns (Verizon DBIR)
24
72% of breaches involved a human element (social engineering or other human action) — human element involvement in breach events
25
90% of breaches involved weak passwords, compromised credentials, or insufficient system hardening — security control weakness involvement in breach events
26
31% of reported breaches involved phishing/social engineering as the initial vector — human-driven initial access involvement in breach events
27
84% of breaches exploited known vulnerabilities (where a patch or workaround existed) — security control weakness involvement in breach events
28
58% of breaches were discovered by an external party — security/response process weakness involvement in breach events
29
53% of breaches used cloud services or cloud hosting as part of the attack chain — security/architectural exposure involvement in breach events
Interpretation
Industry Trends Interpretation
For the Industry Trends in small business cyber security, the data shows that 72% of breaches involve a human element and 90% involve weaknesses like weak passwords or poor hardening, suggesting that most risk is driven by everyday behaviors and configuration gaps rather than exotic technical attacks.
report visual · Comparison
What drives SMB-relevant breaches (Verizon DBIR 2024)
In 2024 DBIR data, security control weaknesses dominate breach involvement: weak passwords/credential issues or insufficient hardening lead at 90%, far above known-vulnerability ex
90% of breaches involved weak passwords, compromised credentials, or insufficient system hardening — security control we90%
84% of breaches exploited known vulnerabilities (where a patch or workaround existed) — security control weakness involv84%
72% of breaches involved a human element (social engineering or other human action) — human element involvement in breac72%
source-verifiedverizon.com2024
02 · Category
User Adoption12 stats
01
39% of small businesses do not patch systems or do so only occasionally (survey estimate)
02
33% of small businesses use encryption for data in transit (survey estimate)
03
50% of small businesses use antivirus software on endpoints (survey estimate)
04
26% of small businesses use dedicated incident response services (survey estimate)
05
34% of SMBs have an established cybersecurity plan (survey estimate)
06
41% of SMBs use a password policy with minimum password length requirements (survey estimate)
07
23% of SMBs have deployed an EDR solution (survey estimate)
08
62% of SMBs have firewalls installed (survey estimate)
09
12% of SMBs have a SOC monitoring service (survey estimate)
10
39% of SMBs use endpoint encryption (survey estimate)
11
22% of SMBs use continuous monitoring/detection tools (survey estimate)
12
24% of SMBs encrypt backups (survey estimate)
Interpretation
User Adoption Interpretation
Within the user adoption category, large gaps remain in core cyber hygiene since 39% of small businesses rarely patch their systems and just 34% have an established cybersecurity plan, indicating many are not consistently adopting even basic protections.
More related reading
03 · Category
Cost Analysis2 stats
01
1 in 5 organizations paid ransom in 2023 (Coveware/industry reports estimate)
02
$5.2 billion total costs from cybercrime for the year 2021 globally (Cybersecurity Ventures / other global cybercrime cost studies)
Interpretation
Cost Analysis Interpretation
Under the Cost Analysis lens, the data suggests cyber incidents are financially crushing for small businesses because about 1 in 5 organizations paid ransoms in 2023 and global cybercrime costs reached roughly $5.2 billion in 2021.
04 · Category
Performance Metrics10 stats
01
68% of SMBs cannot detect a breach quickly (survey-based detection confidence)
02
44% of breaches involved a web application where attackers leveraged application-layer weaknesses (Verizon DBIR)
03
58% of breaches were discovered by an external party (Verizon DBIR)
04
46% of the breaches had a breach discovery time longer than 2 weeks (Verizon DBIR timing distribution)
05
83% reduction in malware incidents after deploying centralized endpoint protection (case study benchmark)
06
49% of organizations report that tabletop exercises improve readiness (survey estimate)
07
27% of organizations have a documented ransomware playbook (survey estimate)
08
63% of organizations report using endpoint telemetry to investigate incidents (survey estimate)
09
75% of organizations report that patching within 14 days reduces exposure to known vulnerabilities (industry benchmark)
10
14-day window is the most common goal for remediation of critical vulnerabilities (CISA vulnerability guidance benchmark)
Interpretation
Performance Metrics Interpretation
For performance metrics, the data shows that SMBs are often slow and reactive, with 68% unable to detect breaches quickly and 46% taking over two weeks to discover them, while discovery is frequently external at 58%, underscoring the need to improve detection and response speed.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Marcus Afolabi. (2026, February 13). Small Business Cyber Security Statistics. Gitnux. https://gitnux.org/small-business-cyber-security-statistics
MLA
Marcus Afolabi. "Small Business Cyber Security Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/small-business-cyber-security-statistics.
Chicago
Marcus Afolabi. 2026. "Small Business Cyber Security Statistics." Gitnux. https://gitnux.org/small-business-cyber-security-statistics.
Sources & references
27 datasets cited across this report · attribution is report-level
+14 additional datasets cited (not shown individually)