Small Business Cyber Security isn’t just an IT checklist—it’s about how attacks exploit everyday operations, from people to exposed systems. In recent Verizon DBIR findings, 72% of breaches involved a human element, while 90% included weak passwords, compromised credentials, or insufficient hardening. Detection is often the weak spot: 68% of SMBs can’t detect a breach quickly, so planning for web-app risk and incident response matters.
Key Takeaways
- 43% of small businesses report they had experienced a data breach in the past 12 months
- 28% of breaches in the Verizon Data Breach Investigations Report (DBIR) involved small organizations
- 72% of breaches in the Verizon DBIR involved a human element (social engineering or other human action)
- 39% of small businesses do not patch systems or do so only occasionally (survey estimate)
- 33% of small businesses use encryption for data in transit (survey estimate)
- 50% of small businesses use antivirus software on endpoints (survey estimate)
- 1 in 5 organizations paid ransom in 2023 (Coveware/industry reports estimate)
- $5.2 billion total costs from cybercrime for the year 2021 globally (Cybersecurity Ventures / other global cybercrime cost studies)
- 68% of SMBs cannot detect a breach quickly (survey-based detection confidence)
- 44% of breaches involved a web application where attackers leveraged application-layer weaknesses (Verizon DBIR)
- 58% of breaches were discovered by an external party (Verizon DBIR)
Nearly half of small businesses faced breaches in the past year, largely driven by human error and weak security.
Related reading
01 · Category
Industry Trends29 stats
01
43% of small businesses report they had experienced a data breach in the past 12 monthshttps://www.verizon.com/business/resources/reports/dbir/
02
28% of breaches in the Verizon Data Breach Investigations Report (DBIR) involved small organizationshttps://www.verizon.com/business/resources/reports/dbir/
03
72% of breaches in the Verizon DBIR involved a human element (social engineering or other human action)https://www.verizon.com/business/resources/reports/dbir/
04
90% of breaches involved at least one of the following: weak passwords, compromised credentials, or insufficient system hardeninghttps://www.verizon.com/business/resources/reports/dbir/
05
64% of breaches in the Verizon DBIR were financially motivatedhttps://www.verizon.com/business/resources/reports/dbir/
06
46% of ransomware incidents involved the use of stolen credentials (e.g., brute force or credential stuffing patterns)https://www.verizon.com/business/resources/reports/dbir/
07
31% of reported breaches involved phishing/social engineering as the initial vectorhttps://www.verizon.com/business/resources/reports/dbir/
08
22% of breaches involved malwarehttps://www.verizon.com/business/resources/reports/dbir/
09
84% of breaches exploited known vulnerabilities (where a patch or workaround existed)https://www.verizon.com/business/resources/reports/dbir/
10
61% of breaches involved a web applicationhttps://www.verizon.com/business/resources/reports/dbir/
11
53% of breaches used cloud services or cloud hosting as part of the attack chainhttps://www.verizon.com/business/resources/reports/dbir/
12
52% of cyber incidents involve credential theft or usehttps://www.ibm.com/reports/threat-intelligence
13
22% of malware infections in small business environments originated from phishing emailshttps://www.ibm.com/security/data-breach/threat-intelligence
14
58% of breaches were discovered by an external party (in Verizon DBIR)https://www.verizon.com/business/resources/reports/dbir/
15
33% of incidents were classified as “crimeware” or fraud-related activity (Verizon DBIR)https://www.verizon.com/business/resources/reports/dbir/
16
36% of organizations had no incident response plan (survey finding from Ponemon/IBM-type studies)https://www.ibm.com/security/security-services/incident-response
17
48% of SMBs were not aware of their data exposure (survey-based)https://www.darkreading.com/risk-management/most-smbs-dont-know-their-data-exposure
18
44% of small businesses shut down within a year of a cyberattack (survey-based / industry studies)https://www.cisa.gov/resources-tools/resources/business-cybersecurity
19
60% of SMBs lack backups that can restore business-critical systems quickly after ransomwarehttps://www.cisa.gov/resources-tools/resources/ransomware-guide
20
37% of organizations have had a breach due to employee mistakes (IBM/Verizon-type industry reports)https://www.verizon.com/business/resources/reports/dbir/
21
25% of SMB breaches used stolen credentials as primary tactic (Verizon DBIR findings)https://www.verizon.com/business/resources/reports/dbir/
22
14% of SMBs reported they were targeted by ransomware (survey estimate)https://www.cybersecurity-insiders.com/ransomware-statistics/
23
57% of breaches involved compromised credentials or weak password patterns (Verizon DBIR)https://www.verizon.com/business/resources/reports/dbir/
24
72% of breaches involved a human element (social engineering or other human action) — human element involvement in breach eventshttps://www.verizon.com/business/resources/reports/dbir/
25
90% of breaches involved weak passwords, compromised credentials, or insufficient system hardening — security control weakness involvement in breach eventshttps://www.verizon.com/business/resources/reports/dbir/
26
31% of reported breaches involved phishing/social engineering as the initial vector — human-driven initial access involvement in breach eventshttps://www.verizon.com/business/resources/reports/dbir/
27
84% of breaches exploited known vulnerabilities (where a patch or workaround existed) — security control weakness involvement in breach eventshttps://www.verizon.com/business/resources/reports/dbir/
28
58% of breaches were discovered by an external party — security/response process weakness involvement in breach eventshttps://www.verizon.com/business/resources/reports/dbir/
29
53% of breaches used cloud services or cloud hosting as part of the attack chain — security/architectural exposure involvement in breach eventshttps://www.verizon.com/business/resources/reports/dbir/
Interpretation
Industry Trends Interpretation
For the Industry Trends in small business cyber security, the data shows that 72% of breaches involve a human element and 90% involve weaknesses like weak passwords or poor hardening, suggesting that most risk is driven by everyday behaviors and configuration gaps rather than exotic technical attacks.
report visual · Comparison
What drives SMB-relevant breaches (Verizon DBIR 2024)
In 2024 DBIR data, security control weaknesses dominate breach involvement: weak passwords/credential issues or insufficient hardening lead at 90%, far above known-vulnerability ex
90% of breaches involved weak passwords, compromised credentials, or insufficient system hardening — security control we90%
84% of breaches exploited known vulnerabilities (where a patch or workaround existed) — security control weakness involv84%
72% of breaches involved a human element (social engineering or other human action) — human element involvement in breac72%
source-verifiedverizon.com2024
02 · Category
User Adoption12 stats
01
39% of small businesses do not patch systems or do so only occasionally (survey estimate)https://www.cisa.gov/news-events/news/patch-management
02
33% of small businesses use encryption for data in transit (survey estimate)https://www.cisa.gov/resources-tools/resources/encryption
03
50% of small businesses use antivirus software on endpoints (survey estimate)https://www.statista.com/statistics/203599/antivirus-software-adoption-rate-worldwide/
04
26% of small businesses use dedicated incident response services (survey estimate)https://www.hiscox.com/insights/articles/cyber-insurance-incident-response
05
34% of SMBs have an established cybersecurity plan (survey estimate)https://www.ready.gov/business-cybersecurity-plan
06
41% of SMBs use a password policy with minimum password length requirements (survey estimate)https://www.cisa.gov/resources-tools/resources/password-guidance
07
23% of SMBs have deployed an EDR solution (survey estimate)https://www.gartner.com/en/newsroom/press-releases/2023-01-31-gartner-says-security
08
62% of SMBs have firewalls installed (survey estimate)https://www.cisa.gov/resources-tools/resources/firewalls
09
12% of SMBs have a SOC monitoring service (survey estimate)https://www.ibm.com/security/security-services/soc
10
39% of SMBs use endpoint encryption (survey estimate)https://www.cisa.gov/resources-tools/resources/encryption
11
22% of SMBs use continuous monitoring/detection tools (survey estimate)https://www.forrester.com/report/security-operations-platforms-2023/
12
24% of SMBs encrypt backups (survey estimate)https://www.cisa.gov/resources-tools/resources/backup-and-recovery
Interpretation
User Adoption Interpretation
Within the user adoption category, large gaps remain in core cyber hygiene since 39% of small businesses rarely patch their systems and just 34% have an established cybersecurity plan, indicating many are not consistently adopting even basic protections.
More related reading
03 · Category
Cost Analysis2 stats
01
1 in 5 organizations paid ransom in 2023 (Coveware/industry reports estimate)https://www.coveware.com/ransomware-report
02
$5.2 billion total costs from cybercrime for the year 2021 globally (Cybersecurity Ventures / other global cybercrime cost studies)https://www.cnbc.com/2017/03/21/cybercrime-is-expected-to-cost-6-trillion-by-2021.html
Interpretation
Cost Analysis Interpretation
Under the Cost Analysis lens, the data suggests cyber incidents are financially crushing for small businesses because about 1 in 5 organizations paid ransoms in 2023 and global cybercrime costs reached roughly $5.2 billion in 2021.
04 · Category
Performance Metrics10 stats
01
68% of SMBs cannot detect a breach quickly (survey-based detection confidence)https://www.cisa.gov/resources-tools/resources/understanding-and-improving-cybersecurity
02
44% of breaches involved a web application where attackers leveraged application-layer weaknesses (Verizon DBIR)https://www.verizon.com/business/resources/reports/dbir/
03
58% of breaches were discovered by an external party (Verizon DBIR)https://www.verizon.com/business/resources/reports/dbir/
04
46% of the breaches had a breach discovery time longer than 2 weeks (Verizon DBIR timing distribution)https://www.verizon.com/business/resources/reports/dbir/
05
83% reduction in malware incidents after deploying centralized endpoint protection (case study benchmark)https://www.cisa.gov/case-studies/endpoint-protection-reduced-malware
06
49% of organizations report that tabletop exercises improve readiness (survey estimate)https://www.gartner.com/en/newsroom/press-releases/2023-02-13-gartner-says-cybersecurity
07
27% of organizations have a documented ransomware playbook (survey estimate)https://www.cisa.gov/resources-tools/resources/ransomware-guide
08
63% of organizations report using endpoint telemetry to investigate incidents (survey estimate)https://www.crowdstrike.com/resources/reports/global-threat-report/
09
75% of organizations report that patching within 14 days reduces exposure to known vulnerabilities (industry benchmark)https://www.cisa.gov/resources-tools/resources/vulnerability-management
10
14-day window is the most common goal for remediation of critical vulnerabilities (CISA vulnerability guidance benchmark)https://www.cisa.gov/news-events/news/vaules
Interpretation
Performance Metrics Interpretation
For performance metrics, the data shows that SMBs are often slow and reactive, with 68% unable to detect breaches quickly and 46% taking over two weeks to discover them, while discovery is frequently external at 58%, underscoring the need to improve detection and response speed.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Marcus Afolabi. (2026, February 13). Small Business Cyber Security Statistics. Gitnux. https://gitnux.org/small-business-cyber-security-statistics
MLA
Marcus Afolabi. "Small Business Cyber Security Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/small-business-cyber-security-statistics.
Chicago
Marcus Afolabi. 2026. "Small Business Cyber Security Statistics." Gitnux. https://gitnux.org/small-business-cyber-security-statistics.
Sources & references
27 datasets cited across this report
+14 additional datasets cited (not shown individually)