Small Business Cybersecurity Statistics 2026

Following the pattern observed in previous years, medium (65%) and large (69%) businesses were more likely to have experienced a cyber breach or attack in the last 12 months compared to micro (42%) and small (46%) businesses.

Phishing attacks remained the most prevalent type of breach or attack by far (experienced by 38% of businesses and 25% of charities) and continued to be ascribed as the most disruptive type of breach or attack (69% of businesses and charities that experienced a breach or attack).

The larger the business, the more likely they were to experience cyber crime (17% of micro businesses, 24% of small businesses, 41% f medium businesses and 48% of large businesses).

Finally, turning our attention to victim organization size (Figure 87), more than 90% of breached organizations were SMBs with fewer than 1,000 employees.

In 2025, about one in six (16%) Canadian businesses were impacted by cyber security incidents, unchanged from 2023, but five percentage points lower than 2019 (21%).

In 2025, large businesses in Canada remained the most likely to be impacted by a cyber security incident (25%), compared with small (15%) and medium (21%) businesses.

Despite high awareness, most small businesses still believe they’re too small to be attractive targets for threat actors Although 79% of small businesses experienced at least one cyber attack in the last five years, 64% still don't think they're an attractive target for threat actors.

Most respondents (87%) expressed that they are very or somewhat concerned about exposure to cyber threats over the next 12 months.

In contrast almost a third of micro businesses (30%) deemed cyber security a low priority (compared to 8% of medium businesses and 0% of large businesses).

59% of SMEs said they experienced a cyber-attack in the last 12 months.

Nearly a third (29%) of organisations hit by at least one cyber attack in the last year.

64% of organizations are concerned about a cyberattack in the next 12 months, more concerned are those which had an incident or are part of critical infrastructure

Of the Ransomware cases where we have information on the organization size, we found that about 96% of Ransomware victims were SMBs.

Whereas large orgs see Ransomware only comprising 39% of the breaches, SMBs are experiencing Ransomware-related breaches to the tune of 88% overall.

The median amount of ransom paid also continues a downward trend: $139,875 in this year’s reporting dataset from $150,000 in the previous year.

Ransomware attacks among businesses have declined compared with the previous two years (1% this year down from 3% in both 2024/2025 and 2023/2024) and phishing attacks and impersonation breaches or attacks, whilst not significantly different to last year, have significantly declined compared to two years ago (38% this year down from 42% in 2023/2024).

In 2025, a record 86% of Coalition policyholders hit by ransomware attacks refused to pay the demand.

Perhaps even more surprising: 39% of FTF events occurred without any confirmed email compromise.

The top cybercrimes reported by businesses were: email compromise resulting in no financial loss (19%) business email compromise fraud resulting in financial loss (15%) identity fraud (11%).

Among those businesses impacted in 2025, over four in five (84%) of them did not make a ransom payment.

In 2025, 8% of impacted businesses indicated that an incident involved ransomware, a notable decline after increasing from 11% in 2021 to 13% in 2023.

27% experienced a ransomware attack and almost three-quarters (71%) believe companies should be required to disclose if they pay a ransom, and how much they paid.

In the SMB segment, the impact median approximates a modest $38,000, but this amount almost triples (growing roughly 150%) in the mid-market segment to approximately $96,000.

The ratio of the impact amounts in relation to the insured revenue in the SMB segment was as high as 3% of revenue in the top 10% of cases and over 7% in the more extreme top 2.5% of cases.

The average self-reported cost of cybercrime per report for small business rose by 14 per cent to $56,600, while the cost to individuals rose 8% to $33,000.

Looking at the perceived cost for the top 5% of cases (95th percentile), however, does show that in a minority of cases organisations can face high costs (£4,000 for all businesses and micro/small businesses, rising to £10,000 for medium/large businesses, and £1,000 for charities).

Accessibility description: 2025 complaint highlights: 1,008,597 complaints; $20.877 billion in losses; 26% increase in losses from 2024; $20,699 Average Loss.

The global average cost of a data breach fell to $4.44 million , the first decline in five years, while the average U.S. cost of a breach reached a record $10.22 million .

However, the report did reveal that organizations using AI and automation extensively throughout their security operations saved an average $1.9 million in breach costs and reduced the breach lifecycle by an average of 80 days.

Scams and fraud were identified as a method of attack for over half (55%) of the businesses impacted by cyber security incidents in 2025.

The Study found that 30% of respondents expected an attack to cost less than $500,000, 39% expected it to cost between $500,000 and $2 million, and 31% expected it to cost more than $2 million.

The 10th annual Hiscox Cyber Readiness Report, based on a survey of 6,800 cyber security decision-makers across the UK, Europe and the US, found that, on average, cyber incidents now cost organisations around $52,000 annually, in addition to approximately 32 hours of operational disruption.

The majority of businesses and charities have implemented basic technical controls, such as updated malware protection (81% businesses and 63% charities), backing up data securely via a cloud service (74% businesses and 57% charities), password policies (74% businesses and 56% charities), network firewalls (74% businesses and 45% charities) and restricted admin rights (73% businesses and 65% charities).

However, despite improvements in several cyber hygiene practices last year, small businesses saw a return to 2023/2024 levels, including undertaking cyber security risk assessments (41%, a decrease from 48% in 2024/2025), having a formal cyber security policy covering cyber security risks (52% down from 59% in 2024/2025), and business continuity plans that address cyber security (44% down from 53% in 2024/2025).

Results (Figure 3.7) show that in the last 12 months, around a fifth of businesses (19%) and charities (17%) have provided some form of staff training.

The ICT security measure strong password authentication was used by almost all large enterprises (96.78%), by 90.66% of medium-sized ones and more than 8 in 10 small enterprises (82.03%).

Similar figures were reported for the second most popular ICT security measure – the data backup to a separate location , which was used by 94.95% of the large enterprises, 88.48% of the medium size enterprises and 77.09% of small enterprises.

The ICT risk assessment was used by 75.62% of large enterprises, while the share of small enterprises using this particular measure was more than 2 times less (29.35%).

The most commonly used was email security (73%), followed by anti-malware software (69%) and network security (67%).

Motivation and prioritization: The keys to improvement The biggest challenge in changing this widespread credential management problem and implementing password best practices is finding a way to motivate employees to change their habits, as reported by 68% of respondents.

The Study found that most small businesses (59%) spend less than 10 hours per week on cybersecurity activities, and 74% allocate less than 10% of their total business budget to cybersecurity.

According to the survey, 69% of organizations have already implemented policies to limit unapproved or shadow AI usage.

As Figure 3.8 shows, outsourcing of cyber security was substantially higher among small (64%) and medium (70%) businesses, as opposed to micro (44%) and large (42%) businesses.

As in previous years, small (55%) and medium (61%) businesses were more likely than businesses overall (47%) to have some form of cyber insurance.

There were some notable statistically significant differences by business size: Use of external consultants/providers rose sharply with size: 24% of micro, 39% of small and 51% of medium businesses.

In 2025, 64% of closed claims were resolved with zero out-of-pocket loss for the policyholder.

FAQ Q The £25,000 limit of indemnity might be sufficient for a small breach or incident but inadequate for a serious problem or more than one incident.

In 2025, over one-third (34%) of businesses indicated having cyber risk insurance, a rate that has increased from 2023 (22%) and more than doubled from 2021 (16%).

Businesses spent an average of $54,772 on all prevention measures in 2025, up from 2023 ($53,907).

Just over 1 in 10 (11%) of businesses impacted by cyber security incidents reported them to police services in 2025, down slightly from 2023 (13%).

The Study found that most small businesses (59%) spend less than 10 hours per week on cybersecurity activities, and 74% allocate less than 10% of their total business budget to cybersecurity.

49% of companies expect a higher cybersecurity budget next year, as increasing threats and regulatory pressure push organizations to invest more in protection, resilience, and risk management.