Small business data is easy money. The FBI's 2020 Internet Crime Report put cybercrime losses at $4 billion last year, a low estimate that still captures only the value lost to threat actors. A separate cited finding reports that 60% of small businesses will be closed after a data breach. The cost of getting it wrong is not a line item; it is the lights going out.
The number of attackers is smaller than you think. The number of soft targets inside your company is larger.
Key facts
- The FBI's 2020 Internet Crime Report put cybercrime losses at $4 billion.
- A cited report found 60% of small businesses close after a breach.
- Nearly 20% of CEOs cite cyber as the top threat for the next three years, per cited research.
- 75% of business leaders call cyber a top recovery priority post-pandemic, per cited research.
- 94% of malware is delivered by email; 80% of reported incidents start with phishing.
- 60% of breaches exploit known vulnerabilities with patches available.
Background: how the threat got here
Small business has always been a soft target because the security budget has always been small. The board hears about cyber risk in headlines, then moves on to revenue. The UK National Cyber Security Center has put the diagnosis plainly: many boardrooms do not actively prioritize cyber security until after an incident has already happened.
The pandemic changed the second response. Workers went home, SaaS proliferated, and identity became the new control plane. Old network perimeters dissolved into a cloud of unmanaged laptops, personal Wi-Fi and shared credentials. Defenders who were still drawing trust boundaries around the office had to redraw them around the user.
Our analysis
The reframing of the employee as the perimeter is the message security teams have been sending for years, and the message the board still struggles to buy. The reason is simple: a firewall is a line item, and a line item is a budget conversation. A trained, monitored human workforce is a behaviour change, and behaviour change is harder to fund and harder to measure.
The numbers that matter are the ones the reference surfaces. 94% of malware delivered by email, 80% of incidents starting with phishing, 60% of breaches exploiting vulnerabilities that already had a fix. Each of these is a process failure, not a technology failure. Vendors will keep selling tools; the use for a small business sits in the boring middle: identity hygiene, patching discipline, and teaching people to slow down on a wire transfer request.
The other quiet shift is the third-party surface. More than half of cited legal and compliance leaders flagged third-party vendors as a new and significant threat during the pandemic, per the reference. That is the soft underbelly of the soft target: the small business becomes an entry point into a larger partner, exactly the pattern that drove several supply-chain compromises in recent years.
Say you run a small business with no dedicated CISO
You start where the use is. Turn on MFA on every cloud app, push a password manager, and ship a short phishing simulation once a quarter. You set a patch SLA you can actually keep and you back it with a vulnerability scan on a recurring cadence. You baseline normal email flow and alert on bulk outbound mail, the classic precursor to a compromised mailbox.
You measure the program on one thing: reduction in click rate quarter over quarter. Headcount does not scale; behaviour does.
Original element: comparison table of common employee-driven risks
| Risk vector | Typical delivery | Typical fix |
|---|---|---|
| Phishing | Email link or attachment | MFA, training, mail filtering |
| Malware | Email-borne payload | Endpoint protection, patching |
| Weak passwords | Credential reuse across sites | Password manager, MFA |
| Unpatched software | Known CVEs in apps and OS | Patch SLA, vulnerability scanning |
| Accidental data loss | Mis-sent email, misconfigured share | DLP, data classification |
| Inadvertent privilege abuse | Legitimate access used carelessly | Behaviour baselining, audit logs |
What to watch next
Watch the talent market. Small business cannot outbid enterprise for a dedicated security team, so the question is which managed services and which platform consolidations close the gap. The companies that win the next two years will be the ones that treat the employee as a control surface and fund it like one, with a budget line, a metric, and a named owner. Everyone else will keep funding the firewall and hoping.
Key takeaways
- Treat the employee as the perimeter, with a budget line and a metric.
- Phishing, weak credentials and unpatched software dominate the incident list.
- Third-party vendors are a fast-growing risk vector, per cited research.
- Managed services and platform consolidation are the realistic talent gap-closers for small business.
Frequently asked questions
How much did cybercrime cost last year?
The FBI's 2020 Internet Crime Report put cybercrime losses at $4 billion.
Why do employees keep showing up in breach reports?
The reference highlights phishing, weak passwords, careless data handling and unpatched software as employee-level factors that feed most incidents.
What is the cheapest cyber investment for a small business?
MFA on every cloud app, a password manager, consistent patching and recurring phishing simulations are the cheapest use points.
Are small businesses really closing after breaches?
A cited report found 60% of small businesses close after a data breach, underscoring the financial stakes of getting it wrong.
Where should a small business start if it has no security team?
Start with identity hygiene, patch discipline, and a short recurring phishing simulation; measure reduction in click rate over time.