The numbers below come from Verizon, the FBI and IBM. We pulled them because the ones floating around most vendor sites are five years old and half of them were never sourced at all.
Search for small business cybersecurity statistics and you’ll hit the same recycled claim on forty different pages: “60% of small businesses close within six months of a cyber attack.” Nobody can trace that one to a real study. It gets repeated because it’s scary and it sells.
So here’s a page built the other way around. Every number has a named source, a year, and a link. If a stat isn’t in a published report from an organization that actually collects breach data, it isn’t here. Where a figure comes from a sample that skews a certain way, we say so.
We’re an IT company in Fort Myers, so the second half of this page is about what these numbers mean for a business with fifteen employees and no security team. That’s who we work with, and most of the published research isn’t written with them in mind.
Pulled from the Verizon 2026 Data Breach Investigations Report, the Verizon 2026 Breach Impact Study, the FBI’s 2025 Internet Crime Report, and IBM’s 2025 Cost of a Data Breach Report.
Exploiting an unpatched software vulnerability is now the top way attackers get in, at 31% of breaches. That’s a 55% jump in one year, and it pushed stolen passwords out of the number one spot for the first time. Patching stopped being housekeeping and became the front door. Verizon 2026 DBIR.
Up from 44% the year before. The good news buried in that figure: ransom payments keep shrinking because more victims refuse to pay. In the prior report the median payment had already dropped to $115,000 from $150,000, with 64% of victims paying nothing. Verizon 2026 DBIR.
The most recent size breakdown Verizon published found ransomware in 88% of small and medium business breaches, against 39% at large organizations. Attackers don’t skip you for being small. They just size the ransom to fit, and they know your backups are less likely to be current. Verizon 2025 DBIR SMB Snapshot.
In the worst 2.5% of cases studied across roughly 70,000 cyber insurance claims, the financial hit to a small or medium business came to more than 7% of its revenue. Not profit. Revenue. Verizon 2026 Breach Impact Study.
Breaches involving a third party jumped 60% in a year and now account for 48% of the total. Your practice management vendor, your cloud backup provider, your payroll service. Their security is part of yours. Verizon 2026 DBIR.
In phishing simulations, attacks arriving by text or voice call got click rates 40% higher than the same attacks sent by email. People have learned to squint at a suspicious email. Nobody squints at a text. Verizon 2026 DBIR.
The FBI logged 1,008,597 complaints in 2025 with $20.9 billion in reported losses. Business email compromise alone accounted for $3.046 billion of that. Add phishing and government impersonation and email based fraud clears $4 billion, up 46% in a year. FBI IC3 2025 Internet Crime Report.
158 days to notice it, another 83 to shut it down. That’s the fastest in nine years of IBM tracking it, which tells you how bad it used to be. Breaches caught before the 200 day mark cost about $1.1 million less. IBM 2025 Cost of a Data Breach.
A few caveats, because a statistics page that doesn’t include them isn’t worth much.
The breach cost figures you see quoted everywhere, the $4.44 million global average and $10.22 million US average from IBM’s 2025 report, are not your number. Those samples are dominated by large organizations. IBM stopped breaking out companies under 500 employees after 2023, when that figure sat around $3.31 million. For a fifteen person office in Fort Myers the realistic cost of a bad week is measured in downtime, payroll, a forensics bill and lost work, not eight figures. The Verizon revenue percentage is a far more useful yardstick for you.
Second caveat: breach data is collected from organizations that noticed and reported. Small businesses under-report badly, partly because many never find out. So treat the small business share of every dataset as a floor.
The pattern that actually matters across all of this is boring and it hasn’t changed in three years. Attackers walk through unpatched software, reused passwords and email. Not zero days. Not movie hacking. The 31% vulnerability figure is the whole story in one number: somebody didn’t install an update, and 43 days is the median time a critical one sits unfixed.
Which is the part small companies can actually win. Patching, multi factor authentication, tested backups and filtered email are not exotic. They’re just tedious enough that nobody gets to them, which is most of why we exist.
It’s the number one entry point now and the one most small offices ignore. Workstations, servers, firewalls, switches, the wireless gear. Edge devices matter most, since that’s where attackers found the biggest gains. If updates aren’t automated and verified, they aren’t happening.
Stolen credentials fell to second place, not off the list. Microsoft 365 is the account that matters most because email is how invoices get rerouted and $3 billion goes missing. Watch for prompt bombing too, where staff get spammed with approval requests until somebody taps yes.
Ransomware is in nearly half of breaches and small companies get hit hardest because restores fail when it counts. A backup nobody has restored from is a hope, not a plan. We do test restores on managed clients for exactly this reason.
Third party involvement doubled and it’s now half of all breaches. You don’t need a compliance program to email your practice software vendor and ask how they handle security and what happens to your data if they get breached. Their answer, or lack of one, tells you plenty.
Verizon 2026 Data Breach Investigations Report and 2026 Breach Impact Study, published May and June 2026, covering more than 22,000 breaches across 145 countries and roughly 70,000 cyber insurance claims (verizon.com/dbir). Verizon 2025 DBIR Small and Medium Business Snapshot for the size comparison. FBI Internet Crime Complaint Center 2025 Internet Crime Report (ic3.gov). IBM Cost of a Data Breach Report 2025.
If you want the underlying reports instead of our summary, all four are free. We’d rather you read them.
There’s no credible source for it. The claim gets attributed to the National Cyber Security Alliance or the SBA depending on who’s repeating it, and neither has published the study. We don’t use it and you should be skeptical of anyone who does. The Verizon revenue loss figure, over 7% of revenue in the worst cases, is a real number from real insurance claims and it’s alarming enough on its own.
Mostly nobody targets you personally. Attacks are automated and opportunistic, scanning for a specific unpatched vulnerability or spraying stolen passwords at Microsoft 365 logins. You get hit because your firewall answered, not because someone picked you. Verizon’s small business data shows 98% of breaches come from external actors and 99% are financially motivated.
Ignore the multi million dollar averages, those are enterprise numbers. For a small office the real costs are days of downtime, staff sitting idle, an incident response bill, possible notification requirements, and clients who find out. The Verizon study puts the worst cases above 7% of annual revenue. Do that math on your own revenue and you’ll get a more useful figure than any headline average.
It wasn’t enough five years ago either, but the gap is wider now. Antivirus doesn’t patch your software, and 31% of breaches start there. It doesn’t stop an attacker who logs in with a real password. And it does nothing about a vendor breach. Layers matter more than any single product, which is what our cybersecurity work is really about.
Sometimes, and increasingly with conditions. Insurers now ask whether you have MFA, tested backups and patching in place, and claims get disputed when the answers on the application don’t match reality. We’re not insurance advisors, but we’ve helped clients answer those questionnaires which occasionally means fixing something first.
Annually. The DBIR lands each May, IBM’s cost report in the summer, the FBI’s crime report in the spring. We update this page when they do. If you’re reading a security stats page that doesn’t say when it was updated, assume it’s old.
That’s what the free assessment is. We review your network, security, backups and hardware age, then give you a written summary of what’s solid, what’s risky and what to fix first. No charge and no obligation. It’s a more useful exercise than reading statistics, which we say fully aware of what page you’re on.
Statistics describe everyone else. A free assessment tells you about your network, your backups and your actual exposure. Businesses in Fort Myers, Cape Coral, Estero, Bonita Springs and North Naples.