A cyber attack in a small business rarely starts with sirens. More often, it starts with a letter that looks like an invoice, a login to a cloud service from an unknown device, or a password used over and over again. A few weeks later, access has been sold, systems are locked, and the owner realizes that the problem is not with one computer, but with the entire business.
This is the invisible cyber threat to small businesses: it doesn't look like an attack until it's too late. Verizon data shows that small and medium-sized businesses were among the victims of breaches almost four times more often than large organizations in the 2025 analysis. In the same study, 88% of their breaches were related to ransomware – malware that blocks access to data and demands a ransom.
Size does not reduce the interest of attackers
The myth that criminal groups only target large corporations is dispelled by the numbers. Small companies have banking data, customer lists, contracts, access to payment systems and relationships with larger partners. They often have fewer employees, fewer backups and no one to constantly monitor unusual behavior on the network.
For small and medium-sized businesses, 33% of breaches involved stolen credentials, and 18% involved social engineering. This means that an attacker does not necessarily have to break complex protection. Sometimes it is enough to get an employee's password, impersonate a supplier or send a convincing request for payment. In a separate analysis, Verizon found that about 12 percent of authentication attempts at small businesses were related to “credential stuffing” attacks – the automated testing of previously stolen passwords.
That’s why the threat remains invisible. A stolen password may not be used immediately. An attacker can wait, monitor communications, find out who approves payments, and only then act. According to Verizon data, the median time from initial intrusion to discovery of the breach was 24 days, and the median ransom paid in business ransomware attacks was $115,000.
Weak security is often a matter of resources, not indifference
For a microbusiness, cybersecurity competes with rent, payroll, supplies, and taxes. There is no dedicated specialist to monitor updates, test backups and investigate suspicious logins. ENISA reports that 63% of small and medium-sized enterprises have difficulty regularly testing their security, and 51% - with timely installation of critical updates. The same study indicates that the most difficult for them remain accessible tools, practical guidelines and finding qualified personnel.
In this context, technological dependence creates another hidden risk. Small businesses use accounting software, cloud platforms, courier systems, external IT providers and payment operators. If one of these partners is compromised, the attack can reach the company without directly penetrating its network. ENISA identifies attacks through the supply chain as the second most frequently cited future risk - 47% of organizations list them among their main concerns.
Regulations will not replace daily discipline
European rules are gradually expanding digital security requirements. In January 2026, the European Commission proposed changes to the NIS2 Directive, which should bring more clarity and ease the regime for 28,700 companies, including 6,200 micro and small enterprises. This does not eliminate the risk, but shows how difficult it is to apply the common rules equally to a corporation with a security team and a company with five employees.
ENISA's survey on the readiness of small businesses for the Cyber Resilience Act is indicative: 66% of 194 organizations in 31 countries have heard of the regulation, but practical preparation is lagging behind. The weakest areas are incident response and security management throughout the product lifecycle. 142 participants indicated a need for financial support.
“There is no magic pill that will take away the pain of cyberattacks,“ says Craig Robinson, research vice president for security services at IDC. His words are important not because they offer an easy solution, but because they describe the reality: protection is a collection of small, consistent actions - different passwords, multi-factor authentication, updates, backups and a response plan.
For a small business, this is not a matter of prestige, nor is it just a technical task. It is a question of whether it will be able to issue an invoice, pay salaries, and open the doors of the store tomorrow. The cyber threat remains invisible until the business is forced to prove how dependent it is on the systems it has taken for granted.
Sources: verizon.com, enisa.europa.eu, digital-strategy.ec.europa.eu