With 43% of small businesses reporting a data breach in the past 12 months, the numbers behind how attacks happen, how often they are detected, and which gaps create the biggest risk are worth a closer look.
Key Takeaways
- 43% of small businesses report they had experienced a data breach in the past 12 months
- 28% of breaches in the Verizon Data Breach Investigations Report (DBIR) involved small organizations
- 72% of breaches in the Verizon DBIR involved a human element (social engineering or other human action)
- 39% of small businesses do not patch systems or do so only occasionally (survey estimate)
- 33% of small businesses use encryption for data in transit (survey estimate)
- 50% of small businesses use antivirus software on endpoints (survey estimate)
- 1 in 5 organizations paid ransom in 2023 (Coveware/industry reports estimate)
- $5.2 billion total costs from cybercrime for the year 2021 globally (Cybersecurity Ventures / other global cybercrime cost studies)
- 68% of SMBs cannot detect a breach quickly (survey-based detection confidence)
- 44% of breaches involved a web application where attackers leveraged application-layer weaknesses (Verizon DBIR)
- 58% of breaches were discovered by an external party (Verizon DBIR)
Most small business breaches are driven by human error and weak credentials, often discovered late.
Industry Trends
143% of small businesses report they had experienced a data breach in the past 12 months[1]
Verified228% of breaches in the Verizon Data Breach Investigations Report (DBIR) involved small organizations[1]
Verified372% of breaches in the Verizon DBIR involved a human element (social engineering or other human action)[1]
Verified490% of breaches involved at least one of the following: weak passwords, compromised credentials, or insufficient system hardening[1]
Directional564% of breaches in the Verizon DBIR were financially motivated[1]
Single source646% of ransomware incidents involved the use of stolen credentials (e.g., brute force or credential stuffing patterns)[1]
Verified731% of reported breaches involved phishing/social engineering as the initial vector[1]
Verified822% of breaches involved malware[1]
Verified984% of breaches exploited known vulnerabilities (where a patch or workaround existed)[1]
Directional1061% of breaches involved a web application[1]
Single source1153% of breaches used cloud services or cloud hosting as part of the attack chain[1]
Verified1252% of cyber incidents involve credential theft or use[2]
Verified1322% of malware infections in small business environments originated from phishing emails[3]
Verified1458% of breaches were discovered by an external party (in Verizon DBIR)[1]
Directional1533% of incidents were classified as “crimeware” or fraud-related activity (Verizon DBIR)[1]
Single source1636% of organizations had no incident response plan (survey finding from Ponemon/IBM-type studies)[4]
Verified1748% of SMBs were not aware of their data exposure (survey-based)[5]
Verified1844% of small businesses shut down within a year of a cyberattack (survey-based / industry studies)[6]
Verified1960% of SMBs lack backups that can restore business-critical systems quickly after ransomware[7]
Directional2037% of organizations have had a breach due to employee mistakes (IBM/Verizon-type industry reports)[1]
Single source2125% of SMB breaches used stolen credentials as primary tactic (Verizon DBIR findings)[1]
Verified2214% of SMBs reported they were targeted by ransomware (survey estimate)[8]
Verified2357% of breaches involved compromised credentials or weak password patterns (Verizon DBIR)[1]
VerifiedIndustry Trends Interpretation
With 43% of small businesses reporting a data breach in the past 12 months and Verizon finding that 72% of breaches involve a human element, the clearest trend is that people and credential weaknesses drive many of these incidents rather than purely technical failures.
User Adoption
139% of small businesses do not patch systems or do so only occasionally (survey estimate)[9]
Verified233% of small businesses use encryption for data in transit (survey estimate)[10]
Verified350% of small businesses use antivirus software on endpoints (survey estimate)[11]
Verified426% of small businesses use dedicated incident response services (survey estimate)[12]
Directional534% of SMBs have an established cybersecurity plan (survey estimate)[13]
Single source641% of SMBs use a password policy with minimum password length requirements (survey estimate)[14]
Verified723% of SMBs have deployed an EDR solution (survey estimate)[15]
Verified862% of SMBs have firewalls installed (survey estimate)[16]
Verified912% of SMBs have a SOC monitoring service (survey estimate)[17]
Directional1039% of SMBs use endpoint encryption (survey estimate)[10]
Single source1122% of SMBs use continuous monitoring/detection tools (survey estimate)[18]
Verified1224% of SMBs encrypt backups (survey estimate)[19]
VerifiedUser Adoption Interpretation
With only 34% of SMBs having a cybersecurity plan and just 23% using EDR, the data shows that most small businesses are still missing key, proactive protections, even though 62% have firewalls and 50% run antivirus.
Cost Analysis
Cost Analysis Interpretation
With 1 in 5 organizations paying ransomware in 2023 and cybercrime costing $5.2 billion globally in 2021, the data shows that ransomware is a persistent and expensive threat for small businesses.
Performance Metrics
168% of SMBs cannot detect a breach quickly (survey-based detection confidence)[22]
Verified244% of breaches involved a web application where attackers leveraged application-layer weaknesses (Verizon DBIR)[1]
Verified358% of breaches were discovered by an external party (Verizon DBIR)[1]
Verified446% of the breaches had a breach discovery time longer than 2 weeks (Verizon DBIR timing distribution)[1]
Directional583% reduction in malware incidents after deploying centralized endpoint protection (case study benchmark)[23]
Single source649% of organizations report that tabletop exercises improve readiness (survey estimate)[24]
Verified727% of organizations have a documented ransomware playbook (survey estimate)[7]
Verified863% of organizations report using endpoint telemetry to investigate incidents (survey estimate)[25]
Verified975% of organizations report that patching within 14 days reduces exposure to known vulnerabilities (industry benchmark)[26]
Directional1014-day window is the most common goal for remediation of critical vulnerabilities (CISA vulnerability guidance benchmark)[27]
Single sourcePerformance Metrics Interpretation
With 68% of SMBs unable to detect breaches quickly and 46% of incidents taking more than 2 weeks to discover, the data shows that faster detection and investigation are still the biggest gaps even as 83% report fewer malware incidents after centralized endpoint protection.
References
- 1verizon.com/business/resources/reports/dbir/
- 2ibm.com/reports/threat-intelligence
- 3ibm.com/security/data-breach/threat-intelligence
- 4ibm.com/security/security-services/incident-response
- 17ibm.com/security/security-services/soc
- 5darkreading.com/risk-management/most-smbs-dont-know-their-data-exposure
- 6cisa.gov/resources-tools/resources/business-cybersecurity
- 7cisa.gov/resources-tools/resources/ransomware-guide
- 9cisa.gov/news-events/news/patch-management
- 10cisa.gov/resources-tools/resources/encryption
- 14cisa.gov/resources-tools/resources/password-guidance
- 16cisa.gov/resources-tools/resources/firewalls
- 19cisa.gov/resources-tools/resources/backup-and-recovery
- 22cisa.gov/resources-tools/resources/understanding-and-improving-cybersecurity
- 23cisa.gov/case-studies/endpoint-protection-reduced-malware
- 26cisa.gov/resources-tools/resources/vulnerability-management
- 27cisa.gov/news-events/news/vaules
- 8cybersecurity-insiders.com/ransomware-statistics/
- 11statista.com/statistics/203599/antivirus-software-adoption-rate-worldwide/
- 12hiscox.com/insights/articles/cyber-insurance-incident-response
- 13ready.gov/business-cybersecurity-plan
- 15gartner.com/en/newsroom/press-releases/2023-01-31-gartner-says-security
- 24gartner.com/en/newsroom/press-releases/2023-02-13-gartner-says-cybersecurity
- 18forrester.com/report/security-operations-platforms-2023/
- 20coveware.com/ransomware-report
- 21cnbc.com/2017/03/21/cybercrime-is-expected-to-cost-6-trillion-by-2021.html
- 25crowdstrike.com/resources/reports/global-threat-report/