/find@mail

Articles, write-ups, and musings concerning the world of cybersecurity and technology.

Why Small Businesses Are Falling Behind on Cybersecurity

Opinionated  · 1,871 words · 9 min read · by QiO:~$ ·

Why Small Businesses Are Falling Behind on Cybersecurity

JPMorgan Chase spends roughly $600 million a year on cybersecurity. Meanwhile, just 5% of small business owners surveyed in 2022 called it their biggest risk.

The information for this post was gathered and sourced in 2024 when most of the content was written. Though the information is still highly relevant today, an outlook for 2026 and beyond has been added with updated information.

The internet has been revolutionary in every facet of society. Every day the world becomes more interconnected as new people and new devices from across the globe are added to the sprawling network that is the World Wide Web. With such a revolution, advantages and challenges will always emerge. Nowhere is this dichotomy more evident than in the world of business and industry. The global connectivity afforded by the digital revolution has allowed corporations to expand to new markets, forge alliances with far-removed suppliers, and track logistics within a global supply chain. The opportunities and advantages can seem limitless; however, such an interconnected world can breed new threats and present new challenges.

Cybercrime has now become a persistent threat that businesses must contend with. In fact, cybersecurity spending was projected to exceed $1 trillion worldwide between 2017 and 2021. Unsurprisingly, most cyber defense spending comes from large corporations like Fortune 500 firms and tech industry giants. For example, JPMorgan Chase spends roughly $600 million each year, while Microsoft spends a staggering $1 billion annually on information and cyber security. With such spending, it is evident that the large corporations are taking serious measures to prevent cybercrime against their businesses. This raises the question: where do American small businesses stand when it comes to preventing cyber-attacks? Unlike large corporations and institutions, the small business community in the United States has yet to address the importance of strong information security practices, and the need for cybersecurity measures, even as threats from cybercrime are on the rise.

The Awareness Gap

The first step to meeting any challenge is acknowledgement. Unfortunately, a substantial portion of small business owners are oblivious to the threats posed by hackers and malicious threat actors. According to a CNBC|SurveyMonkey poll conducted in 2022, "just 5% of small business owners report cybersecurity to be the biggest risk to their business right now." Moreover, the same poll ranked cybersecurity the lowest of the five risks it asked about.

The argument could be made that business owners, though they may rank cyber threats lower than other concerns, aren't apathetic toward the threat posed by cybercriminals; however, a CNBC/Momentive Small Business Survey revealed that, "among America's small business owners, a net 56% said they are not concerned about being the victim of a hack in the next 12 months, and among those, 24% said they were 'not concerned at all.'" These numbers are troubling, as they echo a Forbes article by BullGuard CEO Paul Lipman reporting on a survey his company commissioned of more than 3,000 small business owners in the US and UK: "Our survey indicated that 57% of SMBs believe they won't be targeted by online criminals; however, nearly 20% reported an attack in the past year."

No Business Is Too Small

Considering the poor attitudes expressed in surveys like the ones above, it isn't a surprise that cyberattacks against SMBs are on the rise. The stark reality is that although no business is too large to be breached, no business is so small that it is invisible. Dave Kennedy, founder of cybersecurity firm TrustedSec, echoed this idea, telling CNBC, "We've seen one-person family pizza shops be fully compromised. We've seen one-person retail shops compromised. Independent Uber drivers targeted."

Such small targets may not be as lucrative as attacking a multi-national corporation for cybercriminals, but for many of them, unprotected SMBs are a starting point. Unsophisticated hackers will often target SMBs to make small, yet easily earned profits, that they reinvest into their criminal enterprise. "They will go after mom-and-pops and may only get $3,000 or $5,000, but that's how it all starts. That's how ransomware started, grandma and grandpa in churches, and how they invested more in hacking infrastructure," said Kennedy, pointing out the trend.

A Growing Attack Surface, Thin Defenses

SMBs are also increasingly adopting technology to conquer business challenges like using IoT devices to track inventory or take payments via kiosk or tablet. Each of these new innovations brings a needed solution, but it introduces a new attack vector and widens the overall attack surface for malicious intrusion. Speaking about this, Derek Manky, chief of security insights and global threat alliances at FortiGuard Labs said, "Small businesses are increasingly in a vulnerable position as the attack surface continues to grow with IoT, remote work, and the explosion of endpoints that must be managed. And, small businesses are often in one of the least favorable positions based on the in-house resources available to them to resolve an attack."

This illustrates the dire position that many SMBs find themselves in. While they quickly adopt technology to remain competitive on a small budget, such technology without safeguards is a growing risk. Additionally, without the budget for information security training, something common for employees of large corporations, SMBs are particularly vulnerable to more common attacks like email phishing campaigns. Between January 2021 and December 2021, researchers at cloud security company Barracuda Networks analyzed millions of emails across thousands of companies. They found that "on average, an employee of a small business with less than 100 employees will experience 350% more social engineering attacks than an employee of a larger enterprise."

Factoring in the growth of cyberattacks against SMBs and the general apathy towards the issue of network and information security within their business, it isn't hard to understand why they have become such fertile ground for cybercriminals. Weighing in on the issue, Don MacLennan, Barracuda Networks' senior vice president of engineering and product management email protection, told Forbes:

Small businesses often have fewer resources and lack security expertise, which leaves them more vulnerable to spear-phishing attacks, and cybercriminals are taking advantage. That's why it's important for businesses of all sizes not to overlook investing in security, both technology and user education. The damage caused by a breach or a compromised account can be even more costly.

Continued ignorance on the part of SMBs to the persistent threats, as well as devastating consequences, posed by a cybersecurity breach will only invite further attention from cybercriminals and hackers. "Small businesses are not immune to cyber attacks and data breaches, and are often targeted specifically because they often fail to prioritize security," said Paul Lipman, CEO of BullGuard, in a 2020 press release. "Caught between inadequate consumer solutions and overly complex enterprise software, many small business owners may be inclined to skip cybersecurity. It only takes one attack, however, to bring a business to its knees."

Signs of Change

While the numbers paint a somber picture for small businesses in terms of cybersecurity defense, there is some reason to be optimistic. A survey conducted by MetLife and the U.S. Chamber of Commerce in the first quarter of 2024 found that attitudes may be shifting. The survey found, "A majority (60%) of small businesses say cybersecurity threats, including phishing, malware, and ransomware, are a top concern. A majority also say supply chain breakdowns (58%) and another pandemic (54%) are top concerns." This survey is encouraging; however, there is still work to be done as the same survey also found that 27% of small businesses say they are one disaster or threat away from shutting down.

Outlook for 2026 and Beyond

When this paper was written, there was reason to hope that attitudes among small business owners were beginning to shift. The more recent data suggests that the shift was real, but that the threat has not waited for them to catch up.

Awareness, at least, appears to be improving. Verizon's 2025 State of Small Business Survey found that 47% of small businesses had implemented new technology platforms to bolster their security, and 52% acknowledged that business growth likely increases the threat of cyberattacks. A quarter admitted they were not investing enough, and 25% were already using AI to boost their cybersecurity efforts. That is a noticeably different tone from the owners who, only a few years earlier, ranked cyber risk dead last.

Unfortunately, the threat environment has not softened. Verizon's 2025 Data Breach Investigations Report found that ransomware was involved in 88% of breaches affecting SMBs, compared with 39% for large organizations, and that there were almost four times as many SMB victims as large-organization victims. Zooming out, the FBI's Internet Crime Complaint Center logged nearly $20.9 billion in reported cybercrime losses in 2025, a 26% increase over the year before, across more than a million complaints. Those figures cover victims of every size, but they show the scale of the criminal economy that Kennedy warned small targets help to feed.

Artificial intelligence will likely cut both ways. Small businesses are beginning to use it for defense, but IBM's 2026 Cost of a Data Breach report points to a 56% increase in AI-driven attacks, led by deepfake impersonation and AI-enabled malware. For a business with no security staff and little training budget, more convincing phishing is an especially unwelcome development.

Acknowledgement was the first step, and many owners have taken it. The next steps are less dramatic: training employees, locking down the basics, and having a plan for the day something goes wrong. The owners who take them will be far better positioned than those who wait to learn the lesson the hard way.

Conclusion

Laying the recent optimism aside, it is clear that Small and Medium-sized businesses in the United States are on shaky ground when it comes to addressing cyber threats. Owners of SMBs have fallen behind their corporate counterparts in recognizing and addressing the threat posed by hackers, malware and other forms of malicious cybercrime. In fact, this inability to address the problem has made SMBs an even more attractive target for bad actors. Although attitudes recently may have begun to shift, education and preparedness will be key moving forward if American small businesses hope to shore up their footing and protect themselves from threats.

Sources

Read next

Burp Suite Community Edition: A Hands-On Look at the Free Web App Testing Tool