Small business cybersecurity is driven as much by people and processes as by technology. This page explains how phishing, ransomware, and account takeovers take hold—especially when training is inconsistent and human error is left unchecked. You’ll see which controls make the biggest difference, from regular cybersecurity training and MFA to better endpoint defenses like antivirus, plus what happens when these gaps aren’t addressed.
Key Takeaways
- 71% of small businesses experienced a successful phishing attack due to poor training
- 95% of cybersecurity issues in small businesses stem from human error
- Only 28% of small business employees receive regular cybersecurity training
- The average cost of a data breach for small businesses is $25,000 to $100,000
- Small businesses lose an average of $184,000 per ransomware attack
- 60% of small businesses close within 6 months of a major cyber attack, costing billions annually
- 43% of all cyber attacks target small businesses
- Small businesses account for 28% of all reported data breaches in 2023
- 60% of small businesses that suffer a cyber attack go out of business within six months
- Only 26% of small businesses encrypt data, despite 74% breach risk reduction potential saving millions
- 51% of small businesses use MFA, up from 28% in 2021
- Just 33% of small businesses have updated antivirus software
- Multi-factor authentication (MFA) blocks 99.9% of account compromise attacks for small businesses
- AI-powered threat detection reduces breach detection time by 55% in small business EDR tools
- Managed Detection and Response (MDR) services cut incident response time by 92% for small firms
Poor training and human error leave small businesses vulnerable, with phishing and ransomware driving major losses and closures.
Related reading
01 · Category
Employee Training And Awareness27 stats
01
71% of small businesses experienced a successful phishing attack due to poor training
02
95% of cybersecurity issues in small businesses stem from human error
03
Only 28% of small business employees receive regular cybersecurity training
04
57% of employees in small businesses admit to clicking suspicious links
05
Phishing simulation training reduces clicks by 40% in trained small business staff
06
82% of small business breaches involve weak or stolen passwords due to lack of awareness
07
69% of small business owners do not discuss cybersecurity with employees regularly
08
Training improves small business incident reporting by 50%
09
74% of employees share passwords in small businesses without training
10
Awareness programs cut social engineering success by 70%
11
Only 35% of small business staff can identify phishing emails accurately
12
91% of small businesses cite lack of time as reason for no training
13
Post-training, small business phishing susceptibility drops from 30% to 5%
14
62% of small employees use personal email for work without awareness of risks
15
Security champions programs boost awareness in 80% of implementing small businesses
16
48% of small business staff unaware of ransomware indicators
17
Annual training required by 89% less breached small businesses
18
55% of insider errors due to no awareness training
19
Gamified training increases retention by 90% in small business settings
20
66% of small businesses report improved culture post-awareness campaigns
21
Only 23% train on mobile security risks
22
Awareness reduces data exfiltration by employees by 65%
23
79% of small business CEOs overestimate employee awareness levels
24
Quarterly training cuts repeat phishing by 83%
25
41% of employees bypass security due to lack of understanding
26
Post-training quizzes show 75% knowledge gain in small firms
27
83% of small businesses see ROI from awareness training within 6 months
Interpretation
Employee Training And Awareness Interpretation
With only 28% of small business employees receiving regular cybersecurity training, the data shows that weak or stolen passwords and phishing success are driven by human error, with 71% falling for phishing and 95% of issues stemming from people mistakes.
02 · Category
Financial Impacts30 stats
01
The average cost of a data breach for small businesses is $25,000to $100,000
02
Small businesses lose an average of $184,000per ransomware attack
03
60% of small businesses close within 6 months of a major cyber attack, costing billions annually
04
Phishing costs small businesses $4.91 million on average per incident
05
BEC scams resulted in $2.7 billion losses for small firms in 2021
06
Downtime from cyber attacks costs small businesses $8,000per hour
07
Insurance premiums for small businesses rose 25% due to cyber risks in 2023
08
Average recovery cost post-breach for small businesses is $1.2 million including lost business
09
50% of small businesses face fines averaging $50,000 for non-compliance post-breach
10
Ransomware payments by small businesses averaged $1.54 million in 2023
11
Supply chain breaches cost small suppliers $4.45 million on average
12
Lost productivity from cyber incidents costs $1,000per employee per day
13
Small retail loses 5% annual revenue to cyber fraud, equating to $2.1 million average
14
Legal fees post-breach average $200,000for small businesses
15
Notification costs after breaches hit $250per record for small firms
16
76% of small businesses uninsured for cyber risks, facing full costs
17
DDoS attacks cause $40,000hourly revenue loss for small e-commerce
18
Malware cleanup costs small businesses $15,000-$30,000 per incident
19
Customer churn post-breach averages 30%, costing $500k in lifetime value
20
Small business cyber insurance claims rose 30% in 2023, averaging $35,000 payout
21
Forensic investigation post-attack costs $50,000on average
22
Brand damage reduces small business valuation by 20-30% post-incident
23
Average BEC loss per small business victim is $120,000
24
Cloud breach recovery costs small businesses $3.5 million including data loss
25
Only 14% of small businesses have cyber insurance, leaving 86% exposed to full financial hit
26
IoT breach costs average $749,000for small operations
27
Small firms spend 115% more on remediation than prevention annually
28
27% of small businesses spent over $100k on 2023 cyber recovery
29
Average small business cyber attack downtime is 24 days, costing $300k revenue
30
$420,000average cost of a data breach (small business with 11–100 employees)
Interpretation
Financial Impacts Interpretation
For small businesses, cyber financial losses are severe and fast, with downtime averaging $8,000 per hour and ransomware hits costing around $184,000 on average, while major attacks can still drive 60% of companies to close within 6 months, making the financial impacts of cyber risk both immediate and existential.
report visual · Comparison
Average data breach cost by business size (2024)
Average data breach cost rises with business size: the largest businesses (1001+ employees) lead at the highest average cost, with a clear gap versus smaller businesses (11–100 emp
$1.55 million average cost of a data breach (large business with 1001+ employees)$1.55 million
$1.05 million average cost of a data breach (mid-sized business with 101–1000 employees)
$1.05 million
$420,000 average cost of a data breach (small business with 11–100 employees)
$420,000
source-verifiedibm.com2024
03 · Category
Prevalence Of Threats30 stats
01
43% of all cyber attacks target small businesses
02
Small businesses account for 28% of all reported data breaches in 2023
03
60% of small businesses that suffer a cyber attack go out of business within six months
04
Phishing attacks represent 36% of breaches affecting small businesses
05
Ransomware attacks on small businesses increased by 37% in 2022
06
66% of small business owners reported experiencing a cyber incident in the past year
07
DDoS attacks against small businesses rose by 200% from 2020 to 2023
08
82% of small businesses experienced email-based threats in 2023
09
Malware infections hit 51% of small businesses annually
10
Insider threats account for 34% of small business data losses
11
Supply chain attacks impacted 23% of small businesses in 2023
12
IoT vulnerabilities exploited in 29% of small business attacks
13
Social engineering succeeds in 70% of small business phishing attempts
14
55% of small businesses faced credential stuffing attacks last year
15
Business email compromise (BEC) scams cost small businesses $2.4 billion in 2022
16
71% of small businesses lack incident response plans, making them vulnerable
17
Mobile device breaches affected 40% of small businesses in 2023
18
Cloud misconfigurations lead to 88% of small business cloud breaches
19
61% of small businesses hit by ransomware paid the ransom
20
Account takeover incidents rose 65% among small businesses
21
47% of small businesses reported AI-driven attacks in early 2024
22
Zero-day exploits used in 22% of small business attacks
23
75% of small businesses use unsupported software vulnerable to attacks
24
Cryptojacking incidents up 150% in small businesses
25
39% of small businesses faced deepfake phishing attempts
26
Average small business faces 300 cyber attacks per week
27
52% of small business breaches due to stolen credentials
28
Healthcare small practices saw 92% attack increase
29
Retail small businesses hit by 45% more POS malware
30
68% of small manufacturers faced OT cybersecurity threats
Interpretation
Prevalence Of Threats Interpretation
Under the Prevalence Of Threats angle, small businesses are hit with a large share of real-world incidents, with 43% of cyber attacks targeting them and 28% of 2023 data breaches, while phishing accounts for 36% of those breach cases.
More related reading
04 · Category
Security Measures Adoption27 stats
01
Only 26% of small businesses encrypt data, despite 74% breach risk reduction potential saving millions
02
51% of small businesses use MFA, up from 28% in 2021
03
Just 33% of small businesses have updated antivirus software
04
59% of small businesses lack employee training programs for cybersecurity
05
78% of small businesses do not conduct regular vulnerability scans
06
Only 22% of small businesses have a formal cybersecurity policy in place
07
46% of small businesses use firewalls consistently across all endpoints
08
65% of small businesses fail to patch software within 30 days of updates
09
Employee use of VPNs adopted by 41% of small businesses for remote work
10
29% of small businesses segment their networks to limit breach spread
11
Backup solutions implemented by 55% of small businesses with regular testing
12
37% of small businesses use endpoint detection and response (EDR) tools
13
Email filtering solutions cover 72% of small businesses
14
19% of small businesses conduct annual penetration testing
15
Zero-trust architecture adopted by 24% of small businesses in 2023
16
48% of small businesses have cyber insurance as a risk mitigation measure
17
Mobile device management (MDM) used by 35% of small businesses
18
62% of small businesses enable disk encryption on devices
19
Incident response plans exist in 31% of small businesses
20
Cloud access security brokers (CASB) deployed by 28% of small cloud-using businesses
21
44% of small businesses perform regular security awareness training
22
SIEM tools adopted by only 15% of small businesses due to cost
23
53% use password managers enterprise-wide
24
Web application firewalls (WAF) protect 39% of small business websites
25
Data loss prevention (DLP) tools in 26% of small businesses
26
67% of small business leaders believe cybersecurity is a top priority
27
Only 17% of small businesses have dedicated cybersecurity personnel
Interpretation
Security Measures Adoption Interpretation
Despite clear gains from security measures adoption, only 26% of small businesses encrypt their data while major basics remain weak, with 78% not running regular vulnerability scans and just 22% having a formal cybersecurity policy.
05 · Category
Tools And Solutions Effectiveness30 stats
01
Multi-factor authentication (MFA) blocks 99.9% of account compromise attacks for small businesses
02
AI-powered threat detection reduces breach detection time by 55% in small business EDR tools
03
Managed Detection and Response (MDR) services cut incident response time by 92% for small firms
04
Password managers reduce credential theft by 81% in adopting small businesses
05
Email security gateways stop 97% of phishing emails before reaching inboxes
06
Cloud backup with immutability prevents 100% of ransomware encryption on backups
07
Zero-trust solutions reduce lateral movement in breaches by 50%
08
Vulnerability management tools fix 85% of critical issues within 7 days
09
SIEM with UEBA detects 70% more insider threats automatically
10
Web Application Firewalls (WAF) block 94% of OWASP Top 10 attacks
11
Endpoint protection platforms (EPP) stop 99% of known malware variants
12
CASB tools prevent 88% of shadow IT data exfiltration risks
13
DLP solutions recover 95% of sensitive data at risk of loss
14
Patch management automation reduces exploit windows by 90%
15
DDoS mitigation services absorb 100% of volumetric attacks under 1 Tbps
16
Behavioral analytics in MDR flags 82% of anomalous activities pre-breach
17
MFA push notifications resist 99.98% of automated attacks
18
Ransomware rollback tools restore data in 70% of cases without payment
19
Network segmentation tools limit breach scope to 11% of assets
20
Security awareness platforms reduce phishing clicks by 55% long-term
21
Managed firewall services block 98% of inbound threats
22
IoT security gateways detect 96% of anomalous device behaviors
23
Cyber insurance with risk assessment tools lowers premiums by 20%
24
Automated compliance tools ensure 92% adherence to GDPR/CCPA for small businesses
25
Threat intelligence feeds improve detection accuracy by 40% in small SIEMs
26
Mobile threat defense apps block 99% of mobile malware
27
Backup verification tools confirm recoverability in 100% of tests for protected data
28
AI email filters achieve 99.5% spam/phishing accuracy
29
Penetration testing as a service uncovers 3x more vulnerabilities than manual checks
30
Unified endpoint management secures 87% faster policy enforcement across devices
Interpretation
Tools And Solutions Effectiveness Interpretation
Under the Tools And Solutions Effectiveness lens, small businesses are seeing dramatic security gains as MFA stops 99.9% of account compromises, phishing gateways block 97% of harmful emails, and immutable cloud backups prevent 100% of ransomware encryption on backups.
Reference
Cite This Report
This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.
APA
Min-ji Park. (2026, February 13). Small Business Cybersecurity Statistics. Gitnux. https://gitnux.org/small-business-cybersecurity-statistics
MLA
Min-ji Park. "Small Business Cybersecurity Statistics." Gitnux, 13 Feb 2026, https://gitnux.org/small-business-cybersecurity-statistics.
Chicago
Min-ji Park. 2026. "Small Business Cybersecurity Statistics." Gitnux. https://gitnux.org/small-business-cybersecurity-statistics.