45 Small Business Cybersecurity Statistics for 2026

Short answer: Small businesses face a mix of phishing, business email compromise, ransomware, exploited vulnerabilities, third-party exposure, identity risk, and recovery gaps. These 45 statistics come from named primary sources—the FBI, Verizon, the UK government, and CISA—and keep each source's geography, denominator, year, and methodology visible.

This is a reference asset, not a prediction that every statistic applies to every organization. FBI figures are complaint-based and undercount total harm. UK survey findings are not U.S. prevalence estimates. Verizon findings retain their original study qualifiers. CISA figures are a dated catalog snapshot, not a count of every vulnerability affecting every business.

FBI cybercrime and reported-loss statistics

Source: FBI Internet Crime Complaint Center, 2024 IC3 Annual Report. Complaint and adjusted-loss figures reflect reports received by IC3, not the full universe of cybercrime.

1. STAT-001: Losses reported to FBI IC3 reached $16.6 billion in 2024. Source: FBI IC3.
2. STAT-002: IC3 recorded 193,407 phishing/spoofing complaints in 2024. Source: FBI IC3.
3. STAT-004: IC3 recorded 64,882 personal data breach complaints in 2024. Source: FBI IC3.
4. STAT-005: IC3 recorded 21,442 Business Email Compromise complaints in 2024. Source: FBI IC3.
5. STAT-006: Business Email Compromise produced $2,770,151,146 in reported losses in 2024. Source: FBI IC3.
6. STAT-007: IC3 recorded 3,156 ransomware complaints in 2024. Source: FBI IC3.
7. STAT-008: Reported ransomware adjusted losses were $12,473,156 in 2024. The FBI says that figure excludes lost business, time, wages, files, equipment, third-party remediation, and complaints without a reported loss amount. Source: FBI IC3.

Verizon breach-impact and threat-pattern statistics

Source: Verizon, Cybersecurity insights for SMBs, drawing on the 2026 Data Breach Investigations Report and 2026 Breach Impact Study. Except where the source specifically says SMB, these are broader breach-pattern findings.

8. STAT-012: In the most extreme 2.5% of SMB cases studied, breach-related financial loss exceeded 7% of revenue. Source: Verizon.
9. STAT-013: Vulnerability exploitation represented up to 31% of initial access, a 55% year-over-year increase in the cited DBIR-backed material. Source: Verizon.
10. STAT-014: The median time to fully resolve a critical vulnerability was 43 days, almost two weeks longer than the prior year. Source: Verizon.
11. STAT-015: Breaches involving third parties increased 60% year over year and represented 48% of breaches in the cited material. Source: Verizon.
12. STAT-016: Mobile-entry phishing simulations had a 40% higher median successful click rate than email-entry simulations. This is a simulation finding, not a real-world breach rate. Source: Verizon.

UK small-business security, governance, and recovery statistics

Source: UK Department for Science, Innovation and Technology and Home Office, Cyber security breaches survey 2025. These are UK survey results and should not be read as U.S. or global SMB prevalence.

13. STAT-018: 43% of UK businesses reported identifying a cyber breach or attack in the prior 12 months. Source: UK government survey.
14. STAT-019: The survey estimated that the 43% rate represented about 612,000 UK businesses. Source: UK government survey.
15. STAT-020: Breach/attack identification among UK small businesses was 50% in 2025, down from 58% in 2024. Source: UK government survey.
16. STAT-021: Identification rates were 67% for medium businesses and 74% for large businesses. Source: UK government survey.
17. STAT-022: Information and communications businesses reported the highest sector rate at 69%. Source: UK government survey.
18. STAT-023: Professional, scientific, and technical businesses reported a 55% identification rate. Source: UK government survey.
19. STAT-024: Among organizations identifying a breach or attack, phishing was reported by 85% of businesses and 86% of charities. Source: UK government survey.
20. STAT-025: Impersonation emails or online impersonation affected 34% of businesses and 35% of charities that identified a breach or attack. Source: UK government survey.
21. STAT-026: Among businesses identifying a breach or attack, 18% reported malware and 6% reported ransomware targeting devices. Source: UK government survey.
22. STAT-027: Among UK businesses identifying a breach or attack, temporary loss of access to files or networks was reported by 7%, up from 4% in 2024. Source: UK government survey.
23. STAT-028: The average self-reported cost of the most disruptive breach was £1,600 per business, including £0 responses; the survey notes self-reported costs may underestimate full impact. Source: UK government survey.
24. STAT-029: Excluding zero-cost incidents, the average self-reported cost was £3,550 per business. Source: UK government survey.
25. STAT-030: UK small businesses conducting cybersecurity risk assessments increased to 48% in 2025 from 41% in 2024. Source: UK government survey.
26. STAT-031: UK small businesses reporting some form of cyber insurance increased to 62% in 2025 from 49% in 2024. This is adoption, not claims experience. Source: UK government survey.
27. STAT-032: UK small businesses with a formal cybersecurity policy increased to 59% in 2025 from 51% in 2024. Source: UK government survey.
28. STAT-033: UK small businesses with continuity plans addressing cybersecurity increased to 53% in 2025 from 44% in 2024. Source: UK government survey.
29. STAT-034: Only 11% of micro businesses and 21% of small businesses reviewed immediate-supplier cybersecurity risks. Source: UK government survey.
30. STAT-035: Board-level cybersecurity responsibility among UK businesses declined from 38% in 2021 to 27% in 2025. Source: UK government survey.
31. STAT-036: Awareness of Cyber Essentials was 12% among businesses overall and 9% among micro businesses. Source: UK government survey.
32. STAT-037: An estimated 20% of businesses were victims of at least one cybercrime in the prior year—about 283,000 businesses. Cybercrime is a narrower category than all breaches or attacks in this survey. Source: UK government survey.
33. STAT-038: Estimated ransomware crime among all businesses increased from less than 0.5% in 2024 to 1% in 2025, about 19,000 businesses. Source: UK government survey.
34. STAT-039: Business victims of cybercrime experienced a mean of 30 cybercrimes and a median of 4 during the prior 12 months. Source: UK government survey.

CISA known-exploited-vulnerability statistics

Source: CISA, Known Exploited Vulnerabilities Catalog CSV, retrieved July 19, 2026. These figures describe that dated catalog snapshot; they do not mean every entry affects every SMB.

35. STAT-040: The catalog snapshot contained 1,647 vulnerabilities. Source: CISA KEV, July 19, 2026 snapshot.
36. STAT-041: 329 entries were marked as having known ransomware-campaign use. “Unknown” does not mean “not used.” Source: CISA KEV, July 19, 2026 snapshot.
37. STAT-042: CISA had added 186 entries in 2024 and 245 in 2025 to the catalog snapshot. Source: CISA KEV, July 19, 2026 snapshot.
38. STAT-043: Of entries added in 2024, 42 were marked for known ransomware-campaign use; the equivalent count for 2025 additions was 26. Source: CISA KEV, July 19, 2026 snapshot.
39. STAT-044: Microsoft was the vendor/project on 381 catalog entries. This is prioritization context, not a vendor-blame statement. Source: CISA KEV, July 19, 2026 snapshot.
40. STAT-045: Of those Microsoft entries, 104 were marked for known ransomware-campaign use. Source: CISA KEV, July 19, 2026 snapshot.
41. STAT-046: Other common vendor/project counts included 94 Cisco, 93 Apple, 80 Adobe, 72 Google, and 45 Oracle entries. Source: CISA KEV, July 19, 2026 snapshot.
42. STAT-047: A derived calculation of dueDate - dateAdded found 21 days was the most common remediation due-date window, appearing on 1,025 entries. Source data: CISA KEV, July 19, 2026 snapshot.

MFA, backup, and recovery survey statistics

43. STAT-048: In the UK survey, 40% of businesses required two-factor authentication for network or application access; rates were 74% for medium businesses and 92% for large businesses. This measures requirements/adoption, not effectiveness or universal account coverage. Source: UK government survey, Table 3.1.
44. STAT-049: 83% of businesses reported cloud or other backups, compared with 88% in 2024; rates were 94% for medium businesses and 96% for large businesses. Backup presence does not prove restore testing, immutability, completeness, or recovery success. Source: UK government survey, Table 3.1.
45. STAT-050: Among 1,032 affected UK businesses able to specify an incident, 92% reported restoring operations within 24 hours after their most disruptive incident; the 77% reporting no recovery time is included within that 92%. This is self-reported and not a guarantee or SMB-only benchmark. Source: UK government survey, Figure 4.7.

What small-business leaders should do with these numbers

Use statistics to prioritize questions, not to manufacture certainty. A practical review should connect cybersecurity services to the systems your team actually operates:

• Require MFA for privileged and user access, then review coverage and exceptions.
• Prioritize vulnerabilities with known exploitation and document patch ownership.
• Review email security, impersonation defenses, and phishing-reporting paths.
• Verify backup scope, access, alerting, and restore-test evidence instead of assuming backup presence equals recoverability.
• Map third-party access, supplier risk, and incident-escalation responsibilities.
• Give leadership a recurring risk-review cadence with named owners.

Small business cybersecurity statistics FAQ

What is the most common cyberattack on small businesses?

Phishing and impersonation are consistently prominent in the cited complaint and survey data. The exact rate depends on source, geography, and denominator, so compare like-for-like measures rather than combining unrelated datasets.

How many small businesses experience cyberattacks?

There is no single defensible global or U.S. figure in this collection. The UK government survey found 50% of UK small businesses identified a breach or attack in the prior year, but that figure should not be generalized to U.S. businesses.

Do backups guarantee ransomware recovery?

No. Backup presence is different from tested recovery. Review protected systems, access controls, alerting, retention, isolation or immutability where appropriate, and documented restore tests.

How often should small businesses review cybersecurity statistics?

Review source data when a new annual report or official dataset is published, and verify the original methodology before reusing a number. Dated catalogs such as CISA KEV should always show the snapshot date.

How K3 supports practical cybersecurity planning

K3 Technology helps Denver and Dallas businesses connect risk evidence to Denver cybersecurity services, Dallas cybersecurity services, Microsoft 365 security, patch and vulnerability management, backup planning, incident-response preparation, and managed IT operations under a defined scope.

Contact K3 Technology to discuss a scoped cybersecurity review.