Cyber attacks aren’t just a Fortune 500 problem – they’re everyone’s problem. In fact, small and mid-sized businesses (SMBs) around the world are now squarely in the crosshairs of cybercriminals. Dr. Eyal Pinko, CEO of Saifort, put it bluntly during his lecture at the Digital Horizons conference: “Every SME is now a potential target. True business resilience in the hybrid threat landscape begins with digital security.” In other words, no business is “too small” to attract hackers.
Why SMBs are in the crosshairs
Not long ago, many small business owners assumed hackers had “bigger fish to fry” and that their own companies flew under the radar. That era is over. Cybercriminals have shifted focus to SMBs in recent years, recognizing that smaller firms often have valuable data and weaker security. According to the 2024 Data Breach Investigations Report, 43% of all cyberattacks in 2023 targeted small businesses, and nearly half of all data breaches involved organizations with under 1,000 employees. In Dr. Pinko’s words, every small or medium enterprise is now a potential target, and the numbers bear that out.
Why do attackers love targeting SMBs? Several factors make smaller enterprises attractive prey:
- Weaker defenses: Over half of small businesses have no cybersecurity measures in place at all. Hackers know this. Many SMBs lack dedicated IT security staff, and basic protections like multi-factor authentication (MFA) or up-to-date firewalls are often missing. In one study, 59% of owners with no cybersecurity in place believed their business was too small to be attacked – a dangerous misconception. Attackers exploit these gaps.
- Easy entry, less Noise: With limited security, SMBs present a “soft target.” Cybercriminals can often breach a small firm’s network with far less effort than a large enterprise’s, and do so without attracting much media or law enforcement attention. As Dr. Pinko has emphasized, the scale of the threat has grown – today’s hackers use automation to attack thousands of small businesses in bulk, rather than one big corporation. For them, it’s a numbers game: hitting many little targets can be easier (and safer) than one large, fortified target.
- Profit in volume: Each small business might yield a modest ransom or payout, but those payouts add up. Ransomware gangs and phishing crews increasingly operate on a “quantity over quality” model, launching mass attacks via Ransomware-as-a-Service and phishing kits. It’s often more profitable to extort 100 small companies for $5,000 each than to score one $500,000 heist – and it carries less risk for the criminals.
- Valuable data & supply chain access: Don’t underestimate what you have. 87% of small businesses hold sensitive customer data that hackers want (credit cards, personal info, financial records, etc.). Additionally, attackers increasingly use SMBs as a stepping stone to larger targets – for example, breaching a small business that is a vendor to a big corporation, then working up the supply chain. To a hacker, your company might be the weakest link that opens the door to a bigger prize.
In short, cybercriminals see SMBs as low-hanging fruit. As one cybersecurity report put it, small companies “often have valuable data but lack the strong security defenses of larger corporations”, making them soft targets. Dr. Pinko warns that the threat landscape today is indiscriminate – every business owner, from a 10-person startup to a 500-employee manufacturer, must assume that attackers are probing their defenses. The first step in fighting back is recognizing that the risk is real.
The scale of the threat: Eye-opening cyber attack statistics
How bad is the situation? The numbers tell a sobering story:
- Nearly half of attacks hit SMBs: As noted, roughly 43–46% of cyberattacks globally now strike small businesses. This isn’t a minor slice – it means almost half of malicious activity out there is aimed at companies with limited resources. If you thought hackers only chase giants, think again.
- 61% of SMBs targeted per year: In one recent survey, a majority (61%) of SMBs reported being the target of a cyberattack in 2024. Not all were successful breaches, but this shows how common attack attempts have become. Attempted intrusions are the new normal for small business IT environments.
- Rising ransomware on SMBs: Ransomware actors have refocused on smaller victims. A staggering 82% of ransomware attacks in 2024 were against organizations with fewer than 1,000 employees. In practice, that means if you’re an SMB, the odds are high that ransomware crews consider you fair game. (More on ransomware examples in the next section.)
- “One in X” odds: Email threats rain down on small companies. SMB employees receive the highest rate of malicious emails, with about 1 in every 323 emails being malicious – the highest rate for any business size. Likewise, staff at companies <100 employees face 350% more social engineering attacks (phishing, baiting, etc.) than those at large firms. The onslaught of scam emails, fake invoices, and phishing lures is a daily reality.
- Data breaches and costs: When breaches do happen, they hurt. IBM’s 2024 Cost of a Data Breach report found that a severe breach can cost a small business around $3.31 million on average – factoring in downtime, recovery, lost business, and reputational damage. Even more routine incidents often cost tens of thousands. 95% of SMB security incidents incur costs between $800 and $650,000, which can be ruinous for a small company. It’s not unusual for an attack to wipe out months or years of profit.
- SMBs going out of business: The most frightening stat of all: an estimated 60% of small companies go out of business within six months of a major cyber attack or data breach. Imagine building your dream business, only to see it bankrupted by a single breach. Unfortunately, this happens with alarming frequency, as many small firms are simply unable to absorb the financial and operational shock of a serious cyber incident.
- Hundreds of thousands of attacks: The scale isn’t just in percentages, but raw numbers. In 2020 alone, over 700,000 attacks struck small businesses, causing $2.8 billion in damages. Year after year, that rate has only increased. Cybercrime has become a multi-trillion-dollar industry globally, predicted to cost the world $10.5 trillion annually by 2025. Small businesses make up a big chunk of that crime wave.
The inevitable conclusion
All of these statistics point to one conclusion: the cyber threat to SMBs is not hype – it’s a clear and present danger. As the Cybersecurity Almanac bluntly put it, if current trends hold, cybercrime could become the world’s third-largest economy by sheer cost. And small businesses are at the epicenter of this storm.
Dr. Pinko assesses that resilience – not blind hope – is the way forward. He advocates for proactive defense, noting that business leaders can no longer treat cybersecurity as a “later” priority.
Talk to Saifort
Don’t become part of the statistic. If you want a fast, practical path to SMB cybersecurity – from risk assessment to ransomware protection for small business and ongoing monitoring – Saifort can help. We design and implement multi-layer defense programs tailored to your size, industry, and regulatory needs. Contact us today and get the process started.
