7,256
Small and medium-sized business incidents
Verizon recorded 7,256 incidents involving small and medium-sized businesses, including 7,152 with confirmed data disclosure.
Verizon 2026 DBIR, small and medium-sized business findingsReference data
2026 small business cybersecurity statistics.
A current, sourced snapshot of the breach patterns, attack methods, and financial exposure that business leaders need to understand. Each figure links to its original source.
Last updated August 18, 2026
Small and medium-sized businesses
What the small business data shows.
Verizon’s 2026 findings show the same pressure points ShorePointIT sees in practical risk reviews: exposed systems, compromised credentials, third-party dependencies, and decisions made after an interruption has already started.
100%
External and financially motivated
In Verizon’s small and medium-sized business breach dataset, every reported breach involved an external actor and a financial motive.
Verizon 2026 DBIR, small and medium-sized business findings26%
Began with a vulnerability
Exploitation of a vulnerability was the leading initial access method for small and medium-sized business breaches, ahead of credential abuse at 13% and phishing at 9%.
Verizon 2026 DBIR, small and medium-sized business findings55%
Involved a third party
More than half of the small and medium-sized business breaches in Verizon’s dataset involved a third party. The human element appeared in 45%.
Verizon 2026 DBIR, small and medium-sized business findingsThe broader picture
Cybersecurity figures worth keeping in view.
These figures use different research methods and populations, so they are best read as evidence of where business risk is concentrated, not as a prediction of any one organization’s outcome.
31%
Of breaches began with a vulnerability
Across Verizon’s full 2026 reporting dataset, vulnerability exploitation became the most common initial access vector.
Verizon 2026 DBIR, incidents from November 2024 through October 202548%
Of breaches involved ransomware
Ransomware appeared in nearly half of all breaches in Verizon’s 2026 dataset.
Verizon 2026 DBIR, 2026 reporting dataset40%
Higher mobile click rates
Successful click rates in mobile-focused attack vectors, including voice and text messaging, were 40% higher than email.
Verizon 2026 DBIR, 2026 reporting dataset191,561
Phishing and spoofing complaints
The FBI’s Internet Crime Complaint Center received 191,561 phishing and spoofing complaints in 2025.
FBI Internet Crime Complaint Center, 2025 Internet Crime Report$3.05B
Reported business email compromise losses
Business email compromise accounted for $3,046,598,558 in reported losses to the FBI’s Internet Crime Complaint Center in 2025.
FBI Internet Crime Complaint Center, 2025 Internet Crime Report$4.99M
Average global data breach cost
IBM reported a global average data breach cost of $4.99 million in its 2026 study, a 12% increase from the prior year.
IBM Cost of a Data Breach Report 2026Sources and methodology
Built from current primary reporting.
This page uses publicly available reporting from Verizon, the FBI’s Internet Crime Complaint Center, and IBM. The underlying data sets differ in scope. Verizon’s 2026 report describes incidents that occurred from November 1, 2024 through October 31, 2025. FBI figures reflect complaints and reported losses from calendar year 2025. IBM’s figure is a global average from its 2026 research.
- Verizon 2026 Data Breach Investigations ReportPublished 2026. Small and medium-sized business findings and broader breach trends.
- FBI Internet Crime Complaint Center, 2025 Internet Crime ReportPublished 2026. Complaint volume and reported loss figures for 2025.
- IBM Cost of a Data Breach Report 2026Published 2026. Global average cost of a data breach.
Cite this page
Share the source behind the statistic.
Use the permanent link to this page when citing the collection, or link directly to an individual statistic using its heading.
ShorePointIT. “2026 Small Business Cybersecurity Statistics.” Updated August 18, 2026. https://shorepointit.com/cybersecurity-statistics
Discuss your organization’s cybersecurity priorities