Experiencing a cyberattack is a costly experience for businesses and one which many SMEs would find it hard to withstand. Too many SME leaders hold the dangerous misconception that they are too small or obscure to be targeted aggressively by cybercriminals. They believe that their existing defences are sufficient. Farooq Khan, VP of Software Security at Netgear Business, explores why this is a high-risk perspective.
Many small- and medium-sized enterprises (SMEs) assume they are too small to attract cybercriminals, but the reality is the opposite. For attackers, SMEs are often easier targets – and increasingly, they are the preferred ones.
Industry data shows that SMEs are a frequent target for attackers. In the UK, 42% of small businesses experienced a cybersecurity breach or attack in the previous 12 months, according to the Government’s Cyber Security Breaches Survey 2025. This is approximately 612,000 UK businesses and 61,000 UK charities. While it is a small decrease in prevalence among businesses compared to 2024, when 50% experienced a breach or attack, it still equates to hundreds of thousands of businesses impacted by the effects.
Nearly half of all reported breaches impact on organisations with fewer than 1,000 employees, a different study shows. Ransomware overwhelmingly targets smaller businesses, with the majority of attacks aimed at companies with under 1,000 employees on staff and many of them with fewer than 100. While we undoubtedly recall the ransomware attack on M&S last year, smaller retailers are equally vulnerable, due to the valuable customer and payment details held as well as inventory information. It’s no surprise that between 70% and 80% of retail businesses were reported to have faced an attack in 2025.
Why do attackers focus on SMEs? It’s because cybercriminals understand they can be an easy target. With restricted budgets, fewer IT resources and limited security skills, SMEs rely on generalists within the company and free or consumer-grade tools to secure their organisations. In fact, nearly half of small firms report having no dedicated cybersecurity budget at all. Cybercriminals are poised to exploit that weakness.
The Cybercrime-as-a-Service model
And while SMEs may be an easier target, the data they hold is just as valuable as that of larger enterprises. Customer payment details, personal information and intellectual property are valuable commodities in the underground market and are often resold to other criminals to use in more advanced attacks, demonstrating the sophistication of the Cybercrime-as-a-Service (CaaS) economy.
What does this mean? It is how cybercrime has evolved. It mimics other, legitimate industries, in terms of having a globalised, multi-tiered business model which promotes specialisation, efficiency and scale. This lowers the barrier for criminals, allowing attacks against poorly protected networks, such as those of many SMEs, to proliferate.
Yet despite the sophistication of the cybercrime economy, most breaches still begin with two very simple entry points:
- Phishing and social engineering
Human error is the biggest risk factor for any business, with phishing and social engineering the cause of most human-driven breaches. Employees at small businesses experience more than three times as many social engineering attempts as those at larger companies. Attackers exploit trust, urgency and familiarity, knowing that busy teams without regular security training are more likely to click, download or respond – meaning that often, a single untrained employee is all it takes to compromise credentials and cause devastating downstream attacks.
- Outdated software
Outdated and unpatched software is the second major entry point. Thousands of new vulnerabilities appear every year, and attackers actively look for businesses that delay updates. Many SMEs postpone updating or patching software because they lack time, fear disruption or simply don’t know which updates matter – leaving easy openings for would-be attackers.
Once a small business experiences a cyberattack, the impacts extend far beyond immediate technical clean-up. A single incident can cost anywhere from hundreds of thousands to over a million in damages once downtime, recovery, legal costs and fines are calculated. Operational disruption alone can cost thousands per hour.
For many small businesses, the damage is existential. Most SMEs say they couldn’t survive a major ransomware attack. And even if they manage to recover, they often face long-term fallout like lost customers, reputational damage and employee burnout or turnover.
Getting the basics right
The good news is that SMEs don’t need complex, enterprise-level tools to improve security – they just need the right mix of basics. Strong authentication and tight access controls dramatically reduce the damage that stolen credentials can cause. Regular patching and reliable backups limit how far attackers can get into the network and how quickly a business can recover. Ongoing security awareness training also helps to prevent mistakes at the source.
These measures are most effective when they are supported by modern, integrated security. Older, standalone tools are unable to keep up with today’s cloud-first, distributed and efficient workplaces. Cloud-managed, identity-centric security gives SMEs stronger protection while keeping management simple and scalable.
Cybersecurity is no longer just an IT issue – it is essential to the whole organisation and its resilience. SMEs that stop assuming they’re ‘too small to matter’ are far better positioned to withstand cyberattacks, recover quickly and protect customer trust. With the right guidance and modern, integrated security, even the smallest organisations can build resilience to stand up to today’s cyberthreats.
