Cybersecurity statistics for small and mid-sized businesses in 2026

Most cybersecurity statistics posts recycle the same old numbers. This one uses only reports published in 2026 or covering 2025, and names the source next to each figure.

It’s written for small and mid-sized businesses, from about 20 people to about 1,000, and for the MSPs that look after them. Verizon’s breach report counts any organisation under 1,000 employees as “small”, so the line between a small business and a mid-market company matters less to attackers than it does to us. What matters is that both have more people, more cloud apps and now more AI tools than a small security team can watch.

The big picture

• Reported cybercrime losses in the US reached $20.877 billion in 2025, up 26% on 2024, across 1,008,597 complaints. (FBI IC3 2025 Annual Report)
• Business email compromise caused about $3.05 billion of those losses, from 24,768 complaints. It’s the costliest crime the FBI tracks that targets businesses directly. (FBI IC3 2025)
• For the first time, the FBI counted AI separately: more than 22,000 complaints mentioned AI, with losses above $893 million. That includes more than $30 million in email fraud that used AI. (FBI IC3 2025)

How attackers get in now

The way in has changed in the last year.

• Exploiting a software weakness is now the most common first step, in 31% of breaches. It’s the first time in the report’s 19 years that it has overtaken stolen passwords. (Verizon 2026 DBIR)
• Stolen credentials are still used, at 13% of first steps, and they show up again later in many attacks once someone is inside. (Verizon 2026 DBIR)
• A third party was involved in 48% of breaches, a 60% rise on the year before. Suppliers, software vendors and connected apps are now half the story. (Verizon 2026 DBIR)
• A person was part of 62% of breaches, by clicking, approving, mis-sending or being tricked. (Verizon 2026 DBIR)
• Phishing stayed at 16% of breaches, but text and voice lures were clicked about 40% more often than email in tests. (Verizon 2026 DBIR)

For a mid-sized company, “third party” now means more than suppliers. It includes the dozens of SaaS apps and AI tools connected to Microsoft 365 or Google Workspace, each holding access that someone approved once and nobody reviews.

Ransomware

• Ransomware was part of 48% of breaches, up from 44%. (Verizon 2026 DBIR)
• 69% of victims didn’t pay, and the median payment fell to $139,875. (Verizon 2026 DBIR)
• Verizon says small organisations are hit disproportionately by ransomware. (Verizon 2026 DBIR executive summary)

Fewer people are paying, but the outage, the rebuild and the lost weeks still land. A company of 200 rarely has a spare team to rebuild servers and laptops while the business tries to keep going.

AI changes the risk on both sides

AI now helps attackers and creates new openings inside the business.

• One in four malicious breaches was AI-enabled, a 56% rise in a year, and those breaches cost about $6 million on average. (IBM Cost of a Data Breach 2026)
• Of the organisations that had a breach involving AI, 92% didn’t have proper access controls on their AI tools. (IBM Cost of a Data Breach 2026)
• Verizon found that AI is shrinking the time between a weakness becoming known and attackers using it, from months to hours. (Verizon 2026 DBIR)

Inside the business, the bigger change is quieter. Staff connect AI note-takers, writing assistants and chatbots to mail and files with one click. Copilot and Gemini can find anything a person can already open. AI agents can send mail, move files and call other apps on their own. Each one is a new identity with access, and most have no owner. Read what is shadow AI and AI agent identity for more.

What a breach costs

• The global average cost of a data breach reached a record $4.99 million, up 12%. (IBM Cost of a Data Breach 2026, 602 organisations, March 2025 to February 2026)

That’s an average across mostly large organisations, so treat it as the top of the range, not a small business’s bill. The useful part is the trend: costs are rising, and AI-enabled breaches cost more than average.

What we see in the businesses we protect

Our own platform data adds three points that the big reports don’t show at this size. (Centeye platform data, October 2026; sign-in attempts counted over 30 days; no client named.)

• Sign-in attempts came from 63 countries in 30 days, and only one in five foreign attempts came from a known hosting, VPN or Tor network. Blocking countries or VPN lists misses most of them.
• At one 9-person business, one in three accounts held an admin role. Smaller teams tend to have the most admins for their size.
• Attacks came from more than one side in the same week: password guessing, MFA push-bombing and impossible-travel sign-ins at one business while its laptops raised their own alerts.

The myth to stop repeating

You’ll still see “60% of small businesses close within six months of a cyberattack”. Don’t use it. The National Cybersecurity Alliance, the group usually named as its source, has said it didn’t produce the figure and can’t trace where it came from. The real numbers above make the point without it.

A worked example: a 180-person engineering firm

This is an illustrative example, not a real client.

The firm runs Microsoft 365, 40 SaaS apps and a co-managed setup with its MSP. In one month:

1. A supplier’s mailbox is taken over and sends a real-looking invoice change. Nothing on the firm’s side was hacked, but a payment almost goes out.
2. An exposed VPN device is probed the week a weakness in it is announced.
3. A project manager connects an AI note-taker that can read every meeting and mailbox they can reach.
4. A service account created for an automation still has admin rights two years after the project ended.

None of these is exotic. Each sits in a different tool, which is why most firms of this size see them one at a time, if at all.

Checklist for small and mid-sized businesses

• MFA required for everyone, with old sign-in methods blocked.
• Admin roles cut to the few who need them, with separate admin accounts.
• Sign-ins judged by behaviour, not just country.
• Internet-facing devices (VPN, firewall, remote access) patched within days, not months.
• Payment and bank-detail changes confirmed by phone, every time.
• Every connected app and AI tool listed, with an owner and a reason, or removed.
• AI agents and service accounts treated as identities, with an owner and a review date.
• Laptops covered by behaviour-based protection, not just signatures.
• Identity, email, laptop and AI alerts joined into one view, so a chain shows up as one incident.
• Someone watching outside office hours, in-house or through an MSP.

How Centeye helps

Centeye is one platform for the people and the AI agents in a business, run by the MSP or a small in-house team:

• Gatewatch watches sign-ins and admin changes in Microsoft 365 and Google Workspace.
• Ironwatch protects laptops and servers.
• Lighthouse catches email fraud and account takeover.
• Lumen is the AI governance and registry layer: every AI tool your people use, with an owner and a review date.
• Synthwatch (early access) secures the AI agents and copilots inside your SaaS platforms.
• Praxis joins what they find into one case and responds within the rules you set.

See where one tenant stands today with the free Identity Exposure Check or AI Exposure Check. Read more for MSPs or for businesses.

Frequently asked questions

How often are small and mid-sized businesses attacked?

Often enough that the big reports treat it as normal. Verizon says small organisations, which it defines as under 1,000 employees, are hit disproportionately by ransomware. The FBI logged more than a million cybercrime complaints in 2025.

What is the most common way attackers get in?

In 2026, exploiting a software weakness, at 31% of breaches, just ahead of stolen credentials. Third parties were involved in 48% of breaches. (Verizon 2026 DBIR)

How much does a data breach cost a small or mid-sized business?

There’s no reliable public average for this size. IBM’s global average is $4.99 million, but that’s mostly large organisations. For smaller firms the bigger costs are often downtime, the rebuild and lost work.

How does AI change cybersecurity for small businesses?

It works both ways. Attackers use AI to move faster: one in four malicious breaches was AI-enabled, according to IBM’s 2026 report. Inside the business, AI tools and agents connect to mail and files and add identities that need an owner and limits.

Where should a business with 50 to 500 people start?

Start with identity and email: MFA, fewer admins and payment checks. Then list every connected app and AI tool. Then make sure someone sees alerts as one incident, not five.

New to the terms? See ITDR, shadow AI, OAuth grant and non-human identity in our glossary.

Figures from the FBI IC3 2025 Annual Report (published 2026); the Verizon 2026 Data Breach Investigations Report and its executive summary (incidents from 1 November 2024 to 31 October 2025); IBM Cost of a Data Breach Report 2026 (Ponemon Institute, 602 organisations, March 2025 to February 2026); and Centeye platform data, October 2026. The IBM cost figures are global averages across mostly large organisations. The “60% close within six months” claim is debunked per the National Cybersecurity Alliance. The worked example is illustrative. Microsoft 365, Copilot and Entra are trademarks of the Microsoft group of companies. Google Workspace and Gemini are trademarks of Google LLC.