GITNUXREPORT 2026

Small Business Cybersecurity Statistics

Small businesses face constant cyber threats that often force them to close.

Alexander Schmidt

Research Analyst specializing in technology and digital transformation trends.

First published: Feb 13, 2026

Our Commitment to Accuracy

Rigorous fact-checking · Reputable sources · Regular updatesLearn more

Statistic 1

71% of small businesses experienced a successful phishing attack due to poor training

Statistic 2

95% of cybersecurity issues in small businesses stem from human error

Statistic 3

Only 28% of small business employees receive regular cybersecurity training

Statistic 4

57% of employees in small businesses admit to clicking suspicious links

Statistic 5

Phishing simulation training reduces clicks by 40% in trained small business staff

Statistic 6

82% of small business breaches involve weak or stolen passwords due to lack of awareness

Statistic 7

69% of small business owners do not discuss cybersecurity with employees regularly

Statistic 8

Training improves small business incident reporting by 50%

Statistic 9

74% of employees share passwords in small businesses without training

Statistic 10

Awareness programs cut social engineering success by 70%

Statistic 11

Only 35% of small business staff can identify phishing emails accurately

Statistic 12

91% of small businesses cite lack of time as reason for no training

Statistic 13

Post-training, small business phishing susceptibility drops from 30% to 5%

Statistic 14

62% of small employees use personal email for work without awareness of risks

Statistic 15

Security champions programs boost awareness in 80% of implementing small businesses

Statistic 16

48% of small business staff unaware of ransomware indicators

Statistic 17

Annual training required by 89% less breached small businesses

Statistic 18

55% of insider errors due to no awareness training

Statistic 19

Gamified training increases retention by 90% in small business settings

Statistic 20

66% of small businesses report improved culture post-awareness campaigns

Statistic 21

Only 23% train on mobile security risks

Statistic 22

Awareness reduces data exfiltration by employees by 65%

Statistic 23

79% of small business CEOs overestimate employee awareness levels

Statistic 24

Quarterly training cuts repeat phishing by 83%

Statistic 25

41% of employees bypass security due to lack of understanding

Statistic 26

Post-training quizzes show 75% knowledge gain in small firms

Statistic 27

83% of small businesses see ROI from awareness training within 6 months

Statistic 28

The average cost of a data breach for small businesses is $25,000 to $100,000

Statistic 29

Small businesses lose an average of $184,000 per ransomware attack

Statistic 30

60% of small businesses close within 6 months of a major cyber attack, costing billions annually

Statistic 31

Phishing costs small businesses $4.91 million on average per incident

Statistic 32

BEC scams resulted in $2.7 billion losses for small firms in 2021

Statistic 33

Downtime from cyber attacks costs small businesses $8,000 per hour

Statistic 34

Insurance premiums for small businesses rose 25% due to cyber risks in 2023

Statistic 35

Average recovery cost post-breach for small businesses is $1.2 million including lost business

Statistic 36

50% of small businesses face fines averaging $50,000 for non-compliance post-breach

Statistic 37

Ransomware payments by small businesses averaged $1.54 million in 2023

Statistic 38

Supply chain breaches cost small suppliers $4.45 million on average

Statistic 39

Lost productivity from cyber incidents costs $1,000 per employee per day

Statistic 40

Small retail loses 5% annual revenue to cyber fraud, equating to $2.1 million average

Statistic 41

Legal fees post-breach average $200,000 for small businesses

Statistic 42

Notification costs after breaches hit $250 per record for small firms

Statistic 43

76% of small businesses uninsured for cyber risks, facing full costs

Statistic 44

DDoS attacks cause $40,000 hourly revenue loss for small e-commerce

Statistic 45

Malware cleanup costs small businesses $15,000-$30,000 per incident

Statistic 46

Customer churn post-breach averages 30%, costing $500k in lifetime value

Statistic 47

Small business cyber insurance claims rose 30% in 2023, averaging $35,000 payout

Statistic 48

Forensic investigation post-attack costs $50,000 on average

Statistic 49

Brand damage reduces small business valuation by 20-30% post-incident

Statistic 50

Average BEC loss per small business victim is $120,000

Statistic 51

Cloud breach recovery costs small businesses $3.5 million including data loss

Statistic 52

Only 14% of small businesses have cyber insurance, leaving 86% exposed to full financial hit

Statistic 53

IoT breach costs average $749,000 for small operations

Statistic 54

Small firms spend 115% more on remediation than prevention annually

Statistic 55

27% of small businesses spent over $100k on 2023 cyber recovery

Statistic 56

Average small business cyber attack downtime is 24 days, costing $300k revenue

Statistic 57

43% of all cyber attacks target small businesses

Statistic 58

Small businesses account for 28% of all reported data breaches in 2023

Statistic 59

60% of small businesses that suffer a cyber attack go out of business within six months

Statistic 60

Phishing attacks represent 36% of breaches affecting small businesses

Statistic 61

Ransomware attacks on small businesses increased by 37% in 2022

Statistic 62

66% of small business owners reported experiencing a cyber incident in the past year

Statistic 63

DDoS attacks against small businesses rose by 200% from 2020 to 2023

Statistic 64

82% of small businesses experienced email-based threats in 2023

Statistic 65

Malware infections hit 51% of small businesses annually

Statistic 66

Insider threats account for 34% of small business data losses

Statistic 67

Supply chain attacks impacted 23% of small businesses in 2023

Statistic 68

IoT vulnerabilities exploited in 29% of small business attacks

Statistic 69

Social engineering succeeds in 70% of small business phishing attempts

Statistic 70

55% of small businesses faced credential stuffing attacks last year

Statistic 71

Business email compromise (BEC) scams cost small businesses $2.4 billion in 2022

Statistic 72

71% of small businesses lack incident response plans, making them vulnerable

Statistic 73

Mobile device breaches affected 40% of small businesses in 2023

Statistic 74

Cloud misconfigurations lead to 88% of small business cloud breaches

Statistic 75

61% of small businesses hit by ransomware paid the ransom

Statistic 76

Account takeover incidents rose 65% among small businesses

Statistic 77

47% of small businesses reported AI-driven attacks in early 2024

Statistic 78

Zero-day exploits used in 22% of small business attacks

Statistic 79

75% of small businesses use unsupported software vulnerable to attacks

Statistic 80

Cryptojacking incidents up 150% in small businesses

Statistic 81

39% of small businesses faced deepfake phishing attempts

Statistic 82

Average small business faces 300 cyber attacks per week

Statistic 83

52% of small business breaches due to stolen credentials

Statistic 84

Healthcare small practices saw 92% attack increase

Statistic 85

Retail small businesses hit by 45% more POS malware

Statistic 86

68% of small manufacturers faced OT cybersecurity threats

Statistic 87

Only 26% of small businesses encrypt data, despite 74% breach risk reduction potential saving millions

Statistic 88

51% of small businesses use MFA, up from 28% in 2021

Statistic 89

Just 33% of small businesses have updated antivirus software

Statistic 90

59% of small businesses lack employee training programs for cybersecurity

Statistic 91

78% of small businesses do not conduct regular vulnerability scans

Statistic 92

Only 22% of small businesses have a formal cybersecurity policy in place

Statistic 93

46% of small businesses use firewalls consistently across all endpoints

Statistic 94

65% of small businesses fail to patch software within 30 days of updates

Statistic 95

Employee use of VPNs adopted by 41% of small businesses for remote work

Statistic 96

29% of small businesses segment their networks to limit breach spread

Statistic 97

Backup solutions implemented by 55% of small businesses with regular testing

Statistic 98

37% of small businesses use endpoint detection and response (EDR) tools

Statistic 99

Email filtering solutions cover 72% of small businesses

Statistic 100

19% of small businesses conduct annual penetration testing

Statistic 101

Zero-trust architecture adopted by 24% of small businesses in 2023

Statistic 102

48% of small businesses have cyber insurance as a risk mitigation measure

Statistic 103

Mobile device management (MDM) used by 35% of small businesses

Statistic 104

62% of small businesses enable disk encryption on devices

Statistic 105

Incident response plans exist in 31% of small businesses

Statistic 106

Cloud access security brokers (CASB) deployed by 28% of small cloud-using businesses

Statistic 107

44% of small businesses perform regular security awareness training

Statistic 108

SIEM tools adopted by only 15% of small businesses due to cost

Statistic 109

53% use password managers enterprise-wide

Statistic 110

Web application firewalls (WAF) protect 39% of small business websites

Statistic 111

Data loss prevention (DLP) tools in 26% of small businesses

Statistic 112

67% of small business leaders believe cybersecurity is a top priority

Statistic 113

Only 17% of small businesses have dedicated cybersecurity personnel

Statistic 114

Multi-factor authentication (MFA) blocks 99.9% of account compromise attacks for small businesses

Statistic 115

AI-powered threat detection reduces breach detection time by 55% in small business EDR tools

Statistic 116

Managed Detection and Response (MDR) services cut incident response time by 92% for small firms

Statistic 117

Password managers reduce credential theft by 81% in adopting small businesses

Statistic 118

Email security gateways stop 97% of phishing emails before reaching inboxes

Statistic 119

Cloud backup with immutability prevents 100% of ransomware encryption on backups

Statistic 120

Zero-trust solutions reduce lateral movement in breaches by 50%

Statistic 121

Vulnerability management tools fix 85% of critical issues within 7 days

Statistic 122

SIEM with UEBA detects 70% more insider threats automatically

Statistic 123

Web Application Firewalls (WAF) block 94% of OWASP Top 10 attacks

Statistic 124

Endpoint protection platforms (EPP) stop 99% of known malware variants

Statistic 125

CASB tools prevent 88% of shadow IT data exfiltration risks

Statistic 126

DLP solutions recover 95% of sensitive data at risk of loss

Statistic 127

Patch management automation reduces exploit windows by 90%

Statistic 128

DDoS mitigation services absorb 100% of volumetric attacks under 1 Tbps

Statistic 129

Behavioral analytics in MDR flags 82% of anomalous activities pre-breach

Statistic 130

MFA push notifications resist 99.98% of automated attacks

Statistic 131

Ransomware rollback tools restore data in 70% of cases without payment

Statistic 132

Network segmentation tools limit breach scope to 11% of assets

Statistic 133

Security awareness platforms reduce phishing clicks by 55% long-term

Statistic 134

Managed firewall services block 98% of inbound threats

Statistic 135

IoT security gateways detect 96% of anomalous device behaviors

Statistic 136

Cyber insurance with risk assessment tools lowers premiums by 20%

Statistic 137

Automated compliance tools ensure 92% adherence to GDPR/CCPA for small businesses

Statistic 138

Threat intelligence feeds improve detection accuracy by 40% in small SIEMs

Statistic 139

Mobile threat defense apps block 99% of mobile malware

Statistic 140

Backup verification tools confirm recoverability in 100% of tests for protected data

Statistic 141

AI email filters achieve 99.5% spam/phishing accuracy

Statistic 142

Penetration testing as a service uncovers 3x more vulnerabilities than manual checks

Statistic 143

Unified endpoint management secures 87% faster policy enforcement across devices

1/143

Sources

Trusted by 500+ publications

+497

While it might feel like the big corporations are the main targets, the alarming truth is that 43% of all cyber attacks are aimed squarely at small businesses, and the devastating financial and operational fallout can be a matter of survival.

Key Takeaways

43% of all cyber attacks target small businesses
Small businesses account for 28% of all reported data breaches in 2023
60% of small businesses that suffer a cyber attack go out of business within six months
The average cost of a data breach for small businesses is $25,000 to $100,000
Small businesses lose an average of $184,000 per ransomware attack
60% of small businesses close within 6 months of a major cyber attack, costing billions annually
Only 26% of small businesses encrypt data, despite 74% breach risk reduction potential saving millions
51% of small businesses use MFA, up from 28% in 2021
Just 33% of small businesses have updated antivirus software
71% of small businesses experienced a successful phishing attack due to poor training
95% of cybersecurity issues in small businesses stem from human error
Only 28% of small business employees receive regular cybersecurity training
Multi-factor authentication (MFA) blocks 99.9% of account compromise attacks for small businesses
AI-powered threat detection reduces breach detection time by 55% in small business EDR tools
Managed Detection and Response (MDR) services cut incident response time by 92% for small firms

Small businesses face constant cyber threats that often force them to close.

Employee Training and Awareness

71% of small businesses experienced a successful phishing attack due to poor training
95% of cybersecurity issues in small businesses stem from human error
Only 28% of small business employees receive regular cybersecurity training
57% of employees in small businesses admit to clicking suspicious links
Phishing simulation training reduces clicks by 40% in trained small business staff
82% of small business breaches involve weak or stolen passwords due to lack of awareness
69% of small business owners do not discuss cybersecurity with employees regularly
Training improves small business incident reporting by 50%
74% of employees share passwords in small businesses without training
Awareness programs cut social engineering success by 70%
Only 35% of small business staff can identify phishing emails accurately
91% of small businesses cite lack of time as reason for no training
Post-training, small business phishing susceptibility drops from 30% to 5%
62% of small employees use personal email for work without awareness of risks
Security champions programs boost awareness in 80% of implementing small businesses
48% of small business staff unaware of ransomware indicators
Annual training required by 89% less breached small businesses
55% of insider errors due to no awareness training
Gamified training increases retention by 90% in small business settings
66% of small businesses report improved culture post-awareness campaigns
Only 23% train on mobile security risks
Awareness reduces data exfiltration by employees by 65%
79% of small business CEOs overestimate employee awareness levels
Quarterly training cuts repeat phishing by 83%
41% of employees bypass security due to lack of understanding
Post-training quizzes show 75% knowledge gain in small firms
83% of small businesses see ROI from awareness training within 6 months

Employee Training and Awareness Interpretation

Our small businesses are being held hostage by a painfully preventable threat, as executives who balk at the ten minutes for training are somehow finding the endless hours to clean up the predictable, human-error-fueled breaches that follow.

Financial Impacts

The average cost of a data breach for small businesses is $25,000 to $100,000
Small businesses lose an average of $184,000 per ransomware attack
60% of small businesses close within 6 months of a major cyber attack, costing billions annually
Phishing costs small businesses $4.91 million on average per incident
BEC scams resulted in $2.7 billion losses for small firms in 2021
Downtime from cyber attacks costs small businesses $8,000 per hour
Insurance premiums for small businesses rose 25% due to cyber risks in 2023
Average recovery cost post-breach for small businesses is $1.2 million including lost business
50% of small businesses face fines averaging $50,000 for non-compliance post-breach
Ransomware payments by small businesses averaged $1.54 million in 2023
Supply chain breaches cost small suppliers $4.45 million on average
Lost productivity from cyber incidents costs $1,000 per employee per day
Small retail loses 5% annual revenue to cyber fraud, equating to $2.1 million average
Legal fees post-breach average $200,000 for small businesses
Notification costs after breaches hit $250 per record for small firms
76% of small businesses uninsured for cyber risks, facing full costs
DDoS attacks cause $40,000 hourly revenue loss for small e-commerce
Malware cleanup costs small businesses $15,000-$30,000 per incident
Customer churn post-breach averages 30%, costing $500k in lifetime value
Small business cyber insurance claims rose 30% in 2023, averaging $35,000 payout
Forensic investigation post-attack costs $50,000 on average
Brand damage reduces small business valuation by 20-30% post-incident
Average BEC loss per small business victim is $120,000
Cloud breach recovery costs small businesses $3.5 million including data loss
Only 14% of small businesses have cyber insurance, leaving 86% exposed to full financial hit
IoT breach costs average $749,000 for small operations
Small firms spend 115% more on remediation than prevention annually
27% of small businesses spent over $100k on 2023 cyber recovery
Average small business cyber attack downtime is 24 days, costing $300k revenue

Financial Impacts Interpretation

You are essentially buying your digital demise on layaway, where each breach is a catastrophic installment payment and your eventual closure is the final, unaffordable balloon.

Prevalence of Threats

43% of all cyber attacks target small businesses
Small businesses account for 28% of all reported data breaches in 2023
60% of small businesses that suffer a cyber attack go out of business within six months
Phishing attacks represent 36% of breaches affecting small businesses
Ransomware attacks on small businesses increased by 37% in 2022
66% of small business owners reported experiencing a cyber incident in the past year
DDoS attacks against small businesses rose by 200% from 2020 to 2023
82% of small businesses experienced email-based threats in 2023
Malware infections hit 51% of small businesses annually
Insider threats account for 34% of small business data losses
Supply chain attacks impacted 23% of small businesses in 2023
IoT vulnerabilities exploited in 29% of small business attacks
Social engineering succeeds in 70% of small business phishing attempts
55% of small businesses faced credential stuffing attacks last year
Business email compromise (BEC) scams cost small businesses $2.4 billion in 2022
71% of small businesses lack incident response plans, making them vulnerable
Mobile device breaches affected 40% of small businesses in 2023
Cloud misconfigurations lead to 88% of small business cloud breaches
61% of small businesses hit by ransomware paid the ransom
Account takeover incidents rose 65% among small businesses
47% of small businesses reported AI-driven attacks in early 2024
Zero-day exploits used in 22% of small business attacks
75% of small businesses use unsupported software vulnerable to attacks
Cryptojacking incidents up 150% in small businesses
39% of small businesses faced deepfake phishing attempts
Average small business faces 300 cyber attacks per week
52% of small business breaches due to stolen credentials
Healthcare small practices saw 92% attack increase
Retail small businesses hit by 45% more POS malware
68% of small manufacturers faced OT cybersecurity threats

Prevalence of Threats Interpretation

Despite the glaring statistics that paint small businesses as the digital world's favorite punching bag—from ransomware shaking them down to phishing luring them in—their pervasive "it won't happen to me" mindset is essentially a signed invitation for cybercriminals to drive them out of business.

Security Measures Adoption

Only 26% of small businesses encrypt data, despite 74% breach risk reduction potential saving millions
51% of small businesses use MFA, up from 28% in 2021
Just 33% of small businesses have updated antivirus software
59% of small businesses lack employee training programs for cybersecurity
78% of small businesses do not conduct regular vulnerability scans
Only 22% of small businesses have a formal cybersecurity policy in place
46% of small businesses use firewalls consistently across all endpoints
65% of small businesses fail to patch software within 30 days of updates
Employee use of VPNs adopted by 41% of small businesses for remote work
29% of small businesses segment their networks to limit breach spread
Backup solutions implemented by 55% of small businesses with regular testing
37% of small businesses use endpoint detection and response (EDR) tools
Email filtering solutions cover 72% of small businesses
19% of small businesses conduct annual penetration testing
Zero-trust architecture adopted by 24% of small businesses in 2023
48% of small businesses have cyber insurance as a risk mitigation measure
Mobile device management (MDM) used by 35% of small businesses
62% of small businesses enable disk encryption on devices
Incident response plans exist in 31% of small businesses
Cloud access security brokers (CASB) deployed by 28% of small cloud-using businesses
44% of small businesses perform regular security awareness training
SIEM tools adopted by only 15% of small businesses due to cost
53% use password managers enterprise-wide
Web application firewalls (WAF) protect 39% of small business websites
Data loss prevention (DLP) tools in 26% of small businesses
67% of small business leaders believe cybersecurity is a top priority
Only 17% of small businesses have dedicated cybersecurity personnel

Security Measures Adoption Interpretation

The statistics paint a picture of a small business community earnestly trying to lock its digital doors but, in a classic comedy of errors, often forgetting the windows, handing out keys to strangers, and then being shocked when the rain gets in.

Tools and Solutions Effectiveness

Multi-factor authentication (MFA) blocks 99.9% of account compromise attacks for small businesses
AI-powered threat detection reduces breach detection time by 55% in small business EDR tools
Managed Detection and Response (MDR) services cut incident response time by 92% for small firms
Password managers reduce credential theft by 81% in adopting small businesses
Email security gateways stop 97% of phishing emails before reaching inboxes
Cloud backup with immutability prevents 100% of ransomware encryption on backups
Zero-trust solutions reduce lateral movement in breaches by 50%
Vulnerability management tools fix 85% of critical issues within 7 days
SIEM with UEBA detects 70% more insider threats automatically
Web Application Firewalls (WAF) block 94% of OWASP Top 10 attacks
Endpoint protection platforms (EPP) stop 99% of known malware variants
CASB tools prevent 88% of shadow IT data exfiltration risks
DLP solutions recover 95% of sensitive data at risk of loss
Patch management automation reduces exploit windows by 90%
DDoS mitigation services absorb 100% of volumetric attacks under 1 Tbps
Behavioral analytics in MDR flags 82% of anomalous activities pre-breach
MFA push notifications resist 99.98% of automated attacks
Ransomware rollback tools restore data in 70% of cases without payment
Network segmentation tools limit breach scope to 11% of assets
Security awareness platforms reduce phishing clicks by 55% long-term
Managed firewall services block 98% of inbound threats
IoT security gateways detect 96% of anomalous device behaviors
Cyber insurance with risk assessment tools lowers premiums by 20%
Automated compliance tools ensure 92% adherence to GDPR/CCPA for small businesses
Threat intelligence feeds improve detection accuracy by 40% in small SIEMs
Mobile threat defense apps block 99% of mobile malware
Backup verification tools confirm recoverability in 100% of tests for protected data
AI email filters achieve 99.5% spam/phishing accuracy
Penetration testing as a service uncovers 3x more vulnerabilities than manual checks
Unified endpoint management secures 87% faster policy enforcement across devices

Tools and Solutions Effectiveness Interpretation

Small businesses may feel like perpetual underdogs in cybersecurity, but these statistics prove that with the right stack of modern tools, they can build a defense so annoyingly effective it would make even a persistent hacker sigh and reluctantly move on.

Sources & References

Logos provided by Logo.dev