Guardz

31% of users in monitored SMB environments are exposed to compromised passwords each month.

Confirmed business email compromise (BEC) losses range from $140,000 to $1.5 million, compared to an average of roughly $40,000 in early 2025.

Session hijacking incidents increased by 23% over a 180-day period.

In one-third (33%) of cases, the SMB business owner personally handles alerts and incident resolution.

16% of SMBs allocate less than $50 per user on security annually.

43% of SMBs report they experienced a cyberattack in the past 5 years.

89% of monitored SMBs have at least one user with confirmed credential compromise at any given time.

AI-driven detection achieves 92.4% accuracy compared to 67% accuracy for human analysts alone.

Remote monitoring and management (RMM) tool abuse accounted for 26% of all detections in monitored SMB environments.

Machine identities outnumber human users by 25:1 in Microsoft 365 environments.

58% of SMBs use network firewalls.

52% of SMBs employ email/spam filters.

17% of SMBs significantly increased their cybersecurity spend.

27% of SMBs said they were targeted in the past 12 months.

64% of SMB owners reportedly recovered quickly from a cyber attack.

Half of SMBs reported increasing their cybersecurity budgets.

80% of SMBs with a formal incident response plan in place were able to avoid major damage during an attack.

31% of SMB owners don't know exactly how much they spend on cybersecurity.

Only 34% of SMB owners have a formal incident response or continuity plan developed with a cybersecurity professional.

45% of SMBs cite employee negligence as their biggest cybersecurity concern, particularly acute in the education sector.

13% of SMBs rely on untrained employees to handle alerts.

41% of SMBs have endpoint protection.

27% of SMBs lack cyber insurance.

26% of SMBs do not conduct regular penetration tests or security assessments.

3% of SMB owners faced severe, lasting damage following a cyber attack.

42% of SMBs are worried about outdated technologies, with healthcare businesses the most concerned.

The leading motivations for working with a managed service provider (MSP) for SMBs are a fear of cyberattacks (52%) and a sense of responsibility to customers and stakeholders (40%).