While it might feel like the big corporations are the main targets, the alarming truth is that 43% of all cyber attacks are aimed squarely at small businesses, and the devastating financial and operational fallout can be a matter of survival.
Key Takeaways
- 43% of all cyber attacks target small businesses
- Small businesses account for 28% of all reported data breaches in 2023
- 60% of small businesses that suffer a cyber attack go out of business within six months
- The average cost of a data breach for small businesses is $25,000 to $100,000
- Small businesses lose an average of $184,000 per ransomware attack
- 60% of small businesses close within 6 months of a major cyber attack, costing billions annually
- Only 26% of small businesses encrypt data, despite 74% breach risk reduction potential saving millions
- 51% of small businesses use MFA, up from 28% in 2021
- Just 33% of small businesses have updated antivirus software
- 71% of small businesses experienced a successful phishing attack due to poor training
- 95% of cybersecurity issues in small businesses stem from human error
- Only 28% of small business employees receive regular cybersecurity training
- Multi-factor authentication (MFA) blocks 99.9% of account compromise attacks for small businesses
- AI-powered threat detection reduces breach detection time by 55% in small business EDR tools
- Managed Detection and Response (MDR) services cut incident response time by 92% for small firms
Small businesses face constant cyber threats that often force them to close.
Employee Training and Awareness
171% of small businesses experienced a successful phishing attack due to poor training
Verified295% of cybersecurity issues in small businesses stem from human error
Verified3Only 28% of small business employees receive regular cybersecurity training
Verified457% of employees in small businesses admit to clicking suspicious links
Directional5Phishing simulation training reduces clicks by 40% in trained small business staff
Single source682% of small business breaches involve weak or stolen passwords due to lack of awareness
Verified769% of small business owners do not discuss cybersecurity with employees regularly
Verified8Training improves small business incident reporting by 50%
Verified974% of employees share passwords in small businesses without training
Directional10Awareness programs cut social engineering success by 70%
Single source11Only 35% of small business staff can identify phishing emails accurately
Verified1291% of small businesses cite lack of time as reason for no training
Verified13Post-training, small business phishing susceptibility drops from 30% to 5%
Verified1462% of small employees use personal email for work without awareness of risks
Directional15Security champions programs boost awareness in 80% of implementing small businesses
Single source1648% of small business staff unaware of ransomware indicators
Verified17Annual training required by 89% less breached small businesses
Verified1855% of insider errors due to no awareness training
Verified19Gamified training increases retention by 90% in small business settings
Directional2066% of small businesses report improved culture post-awareness campaigns
Single source21Only 23% train on mobile security risks
Verified22Awareness reduces data exfiltration by employees by 65%
Verified2379% of small business CEOs overestimate employee awareness levels
Verified24Quarterly training cuts repeat phishing by 83%
Directional2541% of employees bypass security due to lack of understanding
Single source26Post-training quizzes show 75% knowledge gain in small firms
Verified2783% of small businesses see ROI from awareness training within 6 months
VerifiedEmployee Training and Awareness Interpretation
Our small businesses are being held hostage by a painfully preventable threat, as executives who balk at the ten minutes for training are somehow finding the endless hours to clean up the predictable, human-error-fueled breaches that follow.
Financial Impacts
1The average cost of a data breach for small businesses is $25,000 to $100,000
Verified2Small businesses lose an average of $184,000 per ransomware attack
Verified360% of small businesses close within 6 months of a major cyber attack, costing billions annually
Verified4Phishing costs small businesses $4.91 million on average per incident
Directional5BEC scams resulted in $2.7 billion losses for small firms in 2021
Single source6Downtime from cyber attacks costs small businesses $8,000 per hour
Verified7Insurance premiums for small businesses rose 25% due to cyber risks in 2023
Verified8Average recovery cost post-breach for small businesses is $1.2 million including lost business
Verified950% of small businesses face fines averaging $50,000 for non-compliance post-breach
Directional10Ransomware payments by small businesses averaged $1.54 million in 2023
Single source11Supply chain breaches cost small suppliers $4.45 million on average
Verified12Lost productivity from cyber incidents costs $1,000 per employee per day
Verified13Small retail loses 5% annual revenue to cyber fraud, equating to $2.1 million average
Verified14Legal fees post-breach average $200,000 for small businesses
Directional15Notification costs after breaches hit $250 per record for small firms
Single source1676% of small businesses uninsured for cyber risks, facing full costs
Verified17DDoS attacks cause $40,000 hourly revenue loss for small e-commerce
Verified18Malware cleanup costs small businesses $15,000-$30,000 per incident
Verified19Customer churn post-breach averages 30%, costing $500k in lifetime value
Directional20Small business cyber insurance claims rose 30% in 2023, averaging $35,000 payout
Single source21Forensic investigation post-attack costs $50,000 on average
Verified22Brand damage reduces small business valuation by 20-30% post-incident
Verified23Average BEC loss per small business victim is $120,000
Verified24Cloud breach recovery costs small businesses $3.5 million including data loss
Directional25Only 14% of small businesses have cyber insurance, leaving 86% exposed to full financial hit
Single source26IoT breach costs average $749,000 for small operations
Verified27Small firms spend 115% more on remediation than prevention annually
Verified2827% of small businesses spent over $100k on 2023 cyber recovery
Verified29Average small business cyber attack downtime is 24 days, costing $300k revenue
DirectionalFinancial Impacts Interpretation
You are essentially buying your digital demise on layaway, where each breach is a catastrophic installment payment and your eventual closure is the final, unaffordable balloon.
Prevalence of Threats
143% of all cyber attacks target small businesses
Verified2Small businesses account for 28% of all reported data breaches in 2023
Verified360% of small businesses that suffer a cyber attack go out of business within six months
Verified4Phishing attacks represent 36% of breaches affecting small businesses
Directional5Ransomware attacks on small businesses increased by 37% in 2022
Single source666% of small business owners reported experiencing a cyber incident in the past year
Verified7DDoS attacks against small businesses rose by 200% from 2020 to 2023
Verified882% of small businesses experienced email-based threats in 2023
Verified9Malware infections hit 51% of small businesses annually
Directional10Insider threats account for 34% of small business data losses
Single source11Supply chain attacks impacted 23% of small businesses in 2023
Verified12IoT vulnerabilities exploited in 29% of small business attacks
Verified13Social engineering succeeds in 70% of small business phishing attempts
Verified1455% of small businesses faced credential stuffing attacks last year
Directional15Business email compromise (BEC) scams cost small businesses $2.4 billion in 2022
Single source1671% of small businesses lack incident response plans, making them vulnerable
Verified17Mobile device breaches affected 40% of small businesses in 2023
Verified18Cloud misconfigurations lead to 88% of small business cloud breaches
Verified1961% of small businesses hit by ransomware paid the ransom
Directional20Account takeover incidents rose 65% among small businesses
Single source2147% of small businesses reported AI-driven attacks in early 2024
Verified22Zero-day exploits used in 22% of small business attacks
Verified2375% of small businesses use unsupported software vulnerable to attacks
Verified24Cryptojacking incidents up 150% in small businesses
Directional2539% of small businesses faced deepfake phishing attempts
Single source26Average small business faces 300 cyber attacks per week
Verified2752% of small business breaches due to stolen credentials
Verified28Healthcare small practices saw 92% attack increase
Verified29Retail small businesses hit by 45% more POS malware
Directional3068% of small manufacturers faced OT cybersecurity threats
Single sourcePrevalence of Threats Interpretation
Despite the glaring statistics that paint small businesses as the digital world's favorite punching bag—from ransomware shaking them down to phishing luring them in—their pervasive "it won't happen to me" mindset is essentially a signed invitation for cybercriminals to drive them out of business.
Security Measures Adoption
1Only 26% of small businesses encrypt data, despite 74% breach risk reduction potential saving millions
Verified251% of small businesses use MFA, up from 28% in 2021
Verified3Just 33% of small businesses have updated antivirus software
Verified459% of small businesses lack employee training programs for cybersecurity
Directional578% of small businesses do not conduct regular vulnerability scans
Single source6Only 22% of small businesses have a formal cybersecurity policy in place
Verified746% of small businesses use firewalls consistently across all endpoints
Verified865% of small businesses fail to patch software within 30 days of updates
Verified9Employee use of VPNs adopted by 41% of small businesses for remote work
Directional1029% of small businesses segment their networks to limit breach spread
Single source11Backup solutions implemented by 55% of small businesses with regular testing
Verified1237% of small businesses use endpoint detection and response (EDR) tools
Verified13Email filtering solutions cover 72% of small businesses
Verified1419% of small businesses conduct annual penetration testing
Directional15Zero-trust architecture adopted by 24% of small businesses in 2023
Single source1648% of small businesses have cyber insurance as a risk mitigation measure
Verified17Mobile device management (MDM) used by 35% of small businesses
Verified1862% of small businesses enable disk encryption on devices
Verified19Incident response plans exist in 31% of small businesses
Directional20Cloud access security brokers (CASB) deployed by 28% of small cloud-using businesses
Single source2144% of small businesses perform regular security awareness training
Verified22SIEM tools adopted by only 15% of small businesses due to cost
Verified2353% use password managers enterprise-wide
Verified24Web application firewalls (WAF) protect 39% of small business websites
Directional25Data loss prevention (DLP) tools in 26% of small businesses
Single source2667% of small business leaders believe cybersecurity is a top priority
Verified27Only 17% of small businesses have dedicated cybersecurity personnel
VerifiedSecurity Measures Adoption Interpretation
The statistics paint a picture of a small business community earnestly trying to lock its digital doors but, in a classic comedy of errors, often forgetting the windows, handing out keys to strangers, and then being shocked when the rain gets in.
Tools and Solutions Effectiveness
1Multi-factor authentication (MFA) blocks 99.9% of account compromise attacks for small businesses
Verified2AI-powered threat detection reduces breach detection time by 55% in small business EDR tools
Verified3Managed Detection and Response (MDR) services cut incident response time by 92% for small firms
Verified4Password managers reduce credential theft by 81% in adopting small businesses
Directional5Email security gateways stop 97% of phishing emails before reaching inboxes
Single source6Cloud backup with immutability prevents 100% of ransomware encryption on backups
Verified7Zero-trust solutions reduce lateral movement in breaches by 50%
Verified8Vulnerability management tools fix 85% of critical issues within 7 days
Verified9SIEM with UEBA detects 70% more insider threats automatically
Directional10Web Application Firewalls (WAF) block 94% of OWASP Top 10 attacks
Single source11Endpoint protection platforms (EPP) stop 99% of known malware variants
Verified12CASB tools prevent 88% of shadow IT data exfiltration risks
Verified13DLP solutions recover 95% of sensitive data at risk of loss
Verified14Patch management automation reduces exploit windows by 90%
Directional15DDoS mitigation services absorb 100% of volumetric attacks under 1 Tbps
Single source16Behavioral analytics in MDR flags 82% of anomalous activities pre-breach
Verified17MFA push notifications resist 99.98% of automated attacks
Verified18Ransomware rollback tools restore data in 70% of cases without payment
Verified19Network segmentation tools limit breach scope to 11% of assets
Directional20Security awareness platforms reduce phishing clicks by 55% long-term
Single source21Managed firewall services block 98% of inbound threats
Verified22IoT security gateways detect 96% of anomalous device behaviors
Verified23Cyber insurance with risk assessment tools lowers premiums by 20%
Verified24Automated compliance tools ensure 92% adherence to GDPR/CCPA for small businesses
Directional25Threat intelligence feeds improve detection accuracy by 40% in small SIEMs
Single source26Mobile threat defense apps block 99% of mobile malware
Verified27Backup verification tools confirm recoverability in 100% of tests for protected data
Verified28AI email filters achieve 99.5% spam/phishing accuracy
Verified29Penetration testing as a service uncovers 3x more vulnerabilities than manual checks
Directional30Unified endpoint management secures 87% faster policy enforcement across devices
Single sourceTools and Solutions Effectiveness Interpretation
Small businesses may feel like perpetual underdogs in cybersecurity, but these statistics prove that with the right stack of modern tools, they can build a defense so annoyingly effective it would make even a persistent hacker sigh and reluctantly move on.
Sources & References
- Reference 1VERIZONverizon.comVisit source
- Reference 2IBMibm.comVisit source
- Reference 3NATIONALCYBERSECURITYALLIANCEnationalcybersecurityalliance.orgVisit source
- Reference 4SOPHOSsophos.comVisit source
- Reference 5KEEPERSECURITYkeepersecurity.comVisit source
- Reference 6CLOUDFLAREcloudflare.comVisit source
- Reference 7PROOFPOINTproofpoint.comVisit source
- Reference 8MALWAREBYTESmalwarebytes.comVisit source
- Reference 9PONEMONponemon.orgVisit source
- Reference 10CISAcisa.govVisit source
- Reference 11UPGUARDupguard.comVisit source
- Reference 12KNOWBE4knowbe4.comVisit source
- Reference 13AKAMAIakamai.comVisit source
- Reference 14IC3ic3.govVisit source
- Reference 15CYBEREASONcybereason.comVisit source
- Reference 16LOOKOUTlookout.comVisit source
- Reference 17CHECKPOINTcheckpoint.comVisit source
- Reference 18DARKTRACEdarktrace.comVisit source
- Reference 19MANDIANTmandiant.comVisit source
- Reference 20IVANTIivanti.comVisit source
- Reference 21CROWDSTRIKEcrowdstrike.comVisit source
- Reference 22RAPID7rapid7.comVisit source
- Reference 23HIPAAJOURNALhipaajournal.comVisit source
- Reference 24SECURITYMETRICSsecuritymetrics.comVisit source
- Reference 25DRAGOSdragos.comVisit source
- Reference 26FBIfbi.govVisit source
- Reference 27MARSHmarsh.comVisit source
- Reference 28GDPRgdpr.euVisit source
- Reference 29CHAINALYSISchainalysis.comVisit source
- Reference 30RESILIENTXresilientx.comVisit source
- Reference 31NRSCnrsc.usVisit source
- Reference 32HISCOXhiscox.co.ukVisit source
- Reference 33INCAPSULAincapsula.comVisit source
- Reference 34CHUBBchubb.comVisit source
- Reference 35FIREEYEfireeye.comVisit source
- Reference 36MCKINSEYmckinsey.comVisit source
- Reference 37SBAsba.govVisit source
- Reference 38IOT-ANALYTICSiot-analytics.comVisit source
- Reference 39CISCOcisco.comVisit source
- Reference 40DARKREADINGdarkreading.comVisit source
- Reference 41UPTIMEINSTITUTEuptimeinstitute.comVisit source
- Reference 42MICROSOFTmicrosoft.comVisit source
- Reference 43AVASTavast.comVisit source
- Reference 44CSOONLINEcsoonline.comVisit source
- Reference 45BALBIXbalbix.comVisit source
- Reference 46NINJAONEninjaone.comVisit source
- Reference 47TENABLEtenable.comVisit source
- Reference 48ZDNETzdnet.comVisit source
- Reference 49ACRONISacronis.comVisit source
- Reference 50MIMECASTmimecast.comVisit source
- Reference 51BREACHLOCKbreachlock.comVisit source
- Reference 52ZSCALERzscaler.comVisit source
- Reference 53INSURANCETHOUGHTLEADERSHIPinsurancethoughtleadership.comVisit source
- Reference 54JAMFjamf.comVisit source
- Reference 55BITDEFENDERbitdefender.comVisit source
- Reference 56NISTnist.govVisit source
- Reference 57NETSKOPEnetskope.comVisit source
- Reference 58ALIENVAULTalienvault.comVisit source
- Reference 59LASTPASSlastpass.comVisit source
- Reference 60IMPERVAimperva.comVisit source
- Reference 61FORCEPOINTforcepoint.comVisit source
- Reference 62DELOITTEdeloitte.comVisit source
- Reference 63STANLEYBLACKANDDECKERstanleyblackanddecker.comVisit source
- Reference 64SANSsans.orgVisit source
- Reference 65TEAMBLINDteamblind.comVisit source
- Reference 66GOOGLEgoogle.comVisit source
- Reference 67CYBERSECURITYINSIDERScybersecurityinsiders.comVisit source
- Reference 68CODE42code42.comVisit source
- Reference 69HACKTHEBOXhackthebox.comVisit source
- Reference 70DIGITALGUARDIANdigitalguardian.comVisit source
- Reference 71ROI-CYBERroi-cyber.comVisit source
- Reference 721PASSWORD1password.comVisit source
- Reference 73VEEAMveeam.comVisit source
- Reference 74QUALYSqualys.comVisit source
- Reference 75EXABEAMexabeam.comVisit source
- Reference 76AV-TESTav-test.orgVisit source
- Reference 77SYMANTECsymantec.comVisit source
- Reference 78BLACKBERRYblackberry.comVisit source
- Reference 79PAGESpages.nist.govVisit source
- Reference 80ILLUSIVEillusive.ioVisit source
- Reference 81PALOALTONETWORKSpaloaltonetworks.comVisit source
- Reference 82ARMISarmis.comVisit source
- Reference 83AONaon.comVisit source
- Reference 84ONE-TRUSTone-trust.comVisit source
- Reference 85ANOMALIanomali.comVisit source
- Reference 86ZIMPERIUMzimperium.comVisit source
- Reference 87VAULTvault.comVisit source
- Reference 88BARRACUDAbarracuda.comVisit source
- Reference 89BUGCROWDbugcrowd.comVisit source
- Reference 90VMWAREvmware.comVisit source