SMEs aren’t too small to target for cybercriminals, they’re too exposed to ignore

Small and medium-sized enterprises (SMEs) are no longer too small to be targeted by cybercriminals, but rather too vulnerable to ignore. These businesses often operate with the same connectivity and reliance on supply chains as larger organizations, but lack the necessary security budget and staffing. Consequently, cybercriminals exploit this imbalance when targeting SMEs.

According to the Cyber Security Breaches Survey 2025/2026, 46% of small businesses and 65% of medium-sized businesses reported a cyber breach or attack in the last year. The economic risk faced by SMEs is significant, as they account for 99% of the UK's business population, employing three-fifths of the private sector workforce and generating half of the private sector's turnover.

When an SME falls victim to a cyber incident, they may experience revenue loss, reputational damage, and extended business disruption, which can have a substantial impact on their wider supply chain. The rise of industrialized cyber threats, driven by easy access to phishing kits, ransomware-as-a-service, and AI-driven social engineering, has made attacking SMEs more accessible and cost-effective for cybercriminals.

These threats can be launched at scale with minimal time investment, automated reconnaissance, and personalized attacks. Even with existing security tools in place, visibility and response capabilities are crucial. To address this growing threat, SMEs must focus on autonomous security systems that can quickly identify and respond to breaches or software failures, restricting access, revoking credentials, and alerting human teams for oversight.

By adopting such systems, SMEs can better protect themselves from increasingly sophisticated cyber attacks.