Forty-three percent of small businesses reported a data breach in the past 12 months, and Verizon found 72% of breaches included a human element such as social engineering. Credential weaknesses and known vulnerabilities keep showing up as the starting point, not just technical failures. Faster detection and better patching targets the gaps that let incidents grow before teams can respond.
Key Takeaways
- 43% of small businesses report they had experienced a data breach in the past 12 months
- 28% of breaches in the Verizon Data Breach Investigations Report (DBIR) involved small organizations
- 72% of breaches in the Verizon DBIR involved a human element (social engineering or other human action)
- 39% of small businesses do not patch systems or do so only occasionally (survey estimate)
- 33% of small businesses use encryption for data in transit (survey estimate)
- 50% of small businesses use antivirus software on endpoints (survey estimate)
- 1 in 5 organizations paid ransom in 2023 (Coveware/industry reports estimate)
- $5.2 billion total costs from cybercrime for the year 2021 globally (Cybersecurity Ventures / other global cybercrime cost studies)
- 68% of SMBs cannot detect a breach quickly (survey-based detection confidence)
- 44% of breaches involved a web application where attackers leveraged application-layer weaknesses (Verizon DBIR)
- 58% of breaches were discovered by an external party (Verizon DBIR)
Small businesses face frequent breaches driven by people and stolen credentials, with weak patching and backups compounding ransomware risk.
Related reading
01 · Category
Industry Trends23 stats
01
43% of small businesses report they had experienced a data breach in the past 12 months
02
28% of breaches in the Verizon Data Breach Investigations Report (DBIR) involved small organizations
03
72% of breaches in the Verizon DBIR involved a human element (social engineering or other human action)
04
90% of breaches involved at least one of the following: weak passwords, compromised credentials, or insufficient system hardening
05
64% of breaches in the Verizon DBIR were financially motivated
06
46% of ransomware incidents involved the use of stolen credentials (e.g., brute force or credential stuffing patterns)
07
31% of reported breaches involved phishing/social engineering as the initial vector
08
22% of breaches involved malware
09
84% of breaches exploited known vulnerabilities (where a patch or workaround existed)
10
61% of breaches involved a web application
11
53% of breaches used cloud services or cloud hosting as part of the attack chain
12
52% of cyber incidents involve credential theft or use
13
22% of malware infections in small business environments originated from phishing emails
14
58% of breaches were discovered by an external party (in Verizon DBIR)
15
33% of incidents were classified as “crimeware” or fraud-related activity (Verizon DBIR)
16
36% of organizations had no incident response plan (survey finding from Ponemon/IBM-type studies)
17
48% of SMBs were not aware of their data exposure (survey-based)
18
44% of small businesses shut down within a year of a cyberattack (survey-based / industry studies)
19
60% of SMBs lack backups that can restore business-critical systems quickly after ransomware
20
37% of organizations have had a breach due to employee mistakes (IBM/Verizon-type industry reports)
21
25% of SMB breaches used stolen credentials as primary tactic (Verizon DBIR findings)
22
14% of SMBs reported they were targeted by ransomware (survey estimate)
23
57% of breaches involved compromised credentials or weak password patterns (Verizon DBIR)
Interpretation
Industry Trends Interpretation
With 43% of small businesses reporting a data breach in the past 12 months and Verizon finding that 72% of breaches involve a human element, the clearest trend is that people and credential weaknesses drive many of these incidents rather than purely technical failures.
02 · Category
User Adoption12 stats
01
39% of small businesses do not patch systems or do so only occasionally (survey estimate)
02
33% of small businesses use encryption for data in transit (survey estimate)
03
50% of small businesses use antivirus software on endpoints (survey estimate)
04
26% of small businesses use dedicated incident response services (survey estimate)
05
34% of SMBs have an established cybersecurity plan (survey estimate)
06
41% of SMBs use a password policy with minimum password length requirements (survey estimate)
07
23% of SMBs have deployed an EDR solution (survey estimate)
08
62% of SMBs have firewalls installed (survey estimate)
09
12% of SMBs have a SOC monitoring service (survey estimate)
10
39% of SMBs use endpoint encryption (survey estimate)
11
22% of SMBs use continuous monitoring/detection tools (survey estimate)
12
24% of SMBs encrypt backups (survey estimate)
Interpretation
User Adoption Interpretation
With only 34% of SMBs having a cybersecurity plan and just 23% using EDR, the data shows that most small businesses are still missing key, proactive protections, even though 62% have firewalls and 50% run antivirus.
More related reading
03 · Category
Cost Analysis2 stats
01
1 in 5 organizations paid ransom in 2023 (Coveware/industry reports estimate)
02
$5.2 billion total costs from cybercrime for the year 2021 globally (Cybersecurity Ventures / other global cybercrime cost studies)
Interpretation
Cost Analysis Interpretation
With 1 in 5 organizations paying ransomware in 2023 and cybercrime costing $5.2 billion globally in 2021, the data shows that ransomware is a persistent and expensive threat for small businesses.
04 · Category
Performance Metrics10 stats
01
68% of SMBs cannot detect a breach quickly (survey-based detection confidence)
02
44% of breaches involved a web application where attackers leveraged application-layer weaknesses (Verizon DBIR)
03
58% of breaches were discovered by an external party (Verizon DBIR)
04
46% of the breaches had a breach discovery time longer than 2 weeks (Verizon DBIR timing distribution)
05
83% reduction in malware incidents after deploying centralized endpoint protection (case study benchmark)
06
49% of organizations report that tabletop exercises improve readiness (survey estimate)
07
27% of organizations have a documented ransomware playbook (survey estimate)
08
63% of organizations report using endpoint telemetry to investigate incidents (survey estimate)
09
75% of organizations report that patching within 14 days reduces exposure to known vulnerabilities (industry benchmark)
10
14-day window is the most common goal for remediation of critical vulnerabilities (CISA vulnerability guidance benchmark)
Interpretation
Performance Metrics Interpretation
With 68% of SMBs unable to detect breaches quickly and 46% of incidents taking more than 2 weeks to discover, the data shows that faster detection and investigation are still the biggest gaps even as 83% report fewer malware incidents after centralized endpoint protection.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Marcus Afolabi. (2026, February 13). Small Business Cyber Security Statistics. Gitnux. https://gitnux.org/small-business-cyber-security-statistics
MLA
Marcus Afolabi. "Small Business Cyber Security Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/small-business-cyber-security-statistics.
Chicago
Marcus Afolabi. 2026. "Small Business Cyber Security Statistics." Gitnux. https://gitnux.org/small-business-cyber-security-statistics.
Sources & references
27 datasets cited across this report · attribution is report-level
+14 additional datasets cited (not shown individually)