Cybersecurity Basics Small Businesses Get Wrong

Cybersecurity coverage tends to focus on large, dramatic breaches — but small and mid-sized businesses accounted for over 70% of data breaches in 2025, and small businesses now experience a cyberattack roughly every 7 seconds. The financial consequence is real and specific: average losses of around $254,000 per breach, and 60% of small companies that get breached close within six months of the attack. This isn't a large-enterprise problem that occasionally spills over. It's primarily a small-business problem.

Why small businesses specifically get targeted

Not because attackers think small businesses have more money — because attackers know small businesses typically have less IT staff, weaker security controls, and teams too busy running the business to treat a suspicious email with the suspicion it deserves. Phishing and credential theft remain the dominant attack vector, responsible for roughly 73% of breaches — this is fundamentally a human-error problem before it's a technology problem.

What's changed in 2026 specifically

The attacks themselves have gotten harder to spot. AI-generated phishing emails now achieve a 54% click-through rate, compared to 12% for traditional human-written phishing — the obviously-fake email full of typos is being replaced by something that reads exactly like a normal, legitimate message. Ransomware attacks rose 45% year over year, increasingly delivered through Ransomware-as-a-Service kits that let low-skilled attackers rent professional-grade tools. The barrier to attacking a small business has gone down at the same time the attacks have gotten more convincing.

The unglamorous basics that actually matter

Rate-limit anything that accepts a password. A login form with no throttling lets an attacker try thousands of password guesses in the time it takes to notice. This is one of the cheapest defenses to implement and one of the most commonly skipped.

Scope access to what a role actually needs. Not everyone who can raise an invoice needs to be able to also approve and pay one. Permission granularity isn't bureaucracy — it's the difference between one compromised login being a contained problem versus a total one.

Keep a real audit trail. If a financial record is changed or deleted, knowing who did it, when, and what it said before is the difference between catching fraud early and not knowing it happened until an outside audit finds it, potentially years later.

Separate data properly if you operate across teams or entities. Access scope should be enforced at the point data is fetched, not just hidden in what a menu happens to show — a determined or careless user shouldn't be able to reach data outside their scope just because the interface didn't happen to display a link to it.

Why this belongs in the same conversation as "which software to use"

Security is usually treated as a separate line item from the everyday software a small business picks for payroll, invoicing or client data — evaluated later, if at all. Given that financial and HR data is exactly what a breach targets, the tools already handling that data deserve the same basic questions any security review would ask: is access actually scoped by role, is login attempt throttled, is there a real record of who changed what. Asking those questions once, when choosing the software, is considerably cheaper than asking them for the first time after an incident.