SMB Cybersecurity: Half The Market Has Been Bitten

Estimated reading time: 4 minutes

At 2:13 p.m., the invoice printer jammed, phones kept ringing, and every screen froze at a login prompt. The owner tried their usual password, but it failed repeatedly. In that quiet moment, business stopped, and costs rose. According to Guardz, about half of U.S. SMBs have already faced a cyberattack. Guardz surveyed 800 U.S.-based SMB owners with more than ten employees across major industries. The results underscore a common operational threat: SMB Cybersecurity is now a daily risk organizations must manage across all workflows. Do you need a managed service provider (MSP)? What about cyber liability insurance? Do you have an incident response plan? How’s your cybersecurity training?

SMB Cybersecurity: Half The Market Has Already Felt The Impact

Guardz puts the issue simply. “In 2025, SMBs are confronting the reality that cyber threats are no longer distant possibilities,” said Guardz CEO Dor Eisner. He warned that handling security alone leaves companies at risk.

The report backs this up with numbers. “About half of SMBs have already experienced a cyber incident,” Guardz wrote. It also notes that attackers often move faster than most defenses.

When SMB leaders talk about weaknesses, people are the main concern. Human errors account for 45%. Outdated technology is next at 42%. Gaps in security policies are also a problem, with 32% lacking proper policies.

Guardz calls these issues solvable with operational rigor and attention. The firm points to time and expertise limits that weaken ongoing processes. For cyber liability insurance providers, weak controls undermine operational maturity, raising loss frequency and claim severity.

Preparation Separates “Disruption” From “Damage”

The report’s main finding shows the value of planning. Only 34% have a professional incident response plan, but 80% of those with a plan avoided major damage. Guardz puts it simply: “Preparation is everything.”

Who handles security is also a concern. About 33% of owners handle alerts themselves, 13% pass them to untrained staff, and only 14% use an external cybersecurity provider.

Guardz warns that this approach gives attackers more time. “When untrained staff or busy owners manage incidents, attackers gain time and leverage.” For insurers, this extra time can mean bigger losses, higher costs, and stricter limits.

The press release adds a coverage angle. It says 27% of SMBs lack cyber liability insurance. It also says 33% cite lower cyber insurance premiums as a reason to consider MSP help.

WATCH OUR PODCAST – SMBs Are Cyber Targets | Dan Candee on Cyber Resilience & AI

Tool Adoption Stays Uneven Across The Stack

Many SMBs use basic security tools. For example, 58% have network firewalls and 52% use email spam filters. Fewer offer advanced protections: 45% provide security training, 30% use cloud security tools, and 26% do regular testing or assessments.

Guardz connects this to fragmented operations. The report says, “Operational responsibility is dispersed across too many stakeholders.” It warns, “Fragmentation leads to blind spots. Blind spots lead to breaches.”

This fragmentation makes insurance underwriting and claims harder. Scattered tools slow down response and make evidence less clear.

2026: Identity Becomes The Frontline

Guardz expects the threat mix to keep shifting. The report highlights “identity misuse” and automation trends. It predicts attackers will push AI-driven scale. Automated phishing farms and synthetic identities will target SMBs.

The preface also warns about rising costs. “The financial blast radius of breaches expanded,” it says, and incidents can now reach “six and seven-figure territory.”

For 2026, the report calls identity management the new frontline. Attacks against cloud identities and session tokens are expected to rise, making identity controls a key focus for insurers through stronger MFA and better governance.

Get The Cyber Insurance Upload Delivered
Subscribe to our newsletter!

MSPs Move From “Nice to Have” to “Security Backbone”

MSPs for SMBs. Guardz sees a shift for managed service providers. Fear is a big reason to call them, with 52% choosing MSPs to avoid attacks. Responsibility also matters, as 40% want to protect customers. Compliance is another factor, with 36% citingrequirements.

Guardz argues MSPs close key gaps, including incident planning and insurance readiness. The main takeaway: the biggest challenge is not awareness, but limits in daily operations.

For cyber insurance readers, that line matters. Insurers price operational maturity, which MSPs can standardize and document.

Martin Hinton

Martin Hinton is the Executive Editor and Publisher of Cyber Insurance News and Information. With over three decades of journalism experience across six continents, his work encompasses investigative reporting, documentaries, and coverage of cultural, political, and business news. To learn more about his career, click on his name to visit his LinkedIn page.