SMEs arent too small to target for cybercriminals, theyre too exposed to ignore

Date:
Wed, 19 Aug 2026 08:45:07 +0000

Description:
SMEs are an open door to big cyber breaches.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter When cybercriminals look at a small and medium-sized enterprise ( SME ), they see a route into a larger organization or supply chain with a bigger payout.

SMEs operate with the same level of connectivity, supply chain reliance and regulatory responsibilities as larger organizations, but nowhere near the security budget or cyber staffing. Raj Maghani Social Links Navigation

Co-Founder of BlockAPT. That imbalance, and connection to a larger environment, is what cybercriminals are exploiting. The Cyber Security Breaches Survey 2025/2026 found that 46% of small businesses and 65% of
medium businesses reported a cyber breach or attack over the past 12 months. Latest Videos From TechRadar Watch full video here:

SMEs are now targeted based on how exposed they are and the bigger payout
they can lead to. The economic risk caused by the SME cyber gap SMEs account for 99% of the UKs business population, employing three-fifths of the private sector workforce and generating half of the private sectors turnover, according to the Federation of Small Businesses. You may like The shocking reason 43% of UK businesses have been hit by cyber attacks last year Closing the security blind spots that are a prime entry point for attacks Most ransomware attacks are opportunistic. Heres how you can stop attackers

A fifth of those breached by a cyber incident reported revenue loss and reputational damage, while suffering from extended business disruption.

Temporary loss of access and interruption to online services can have a significant impact not only on the SME impacted but their wider supply chain. Especially in sectors such as banking, retail and public services, which hold vast amounts of customer data and process payments, the knock-on effect of a cyber incident within a connected SME can be huge. Are you a pro? Subscribe
to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

One compromise from a supplier account can be the catalyst for a much larger breach, which in turn can have a wider economic impact, as we saw with JLR. Connected SMEs are valuable to the UK economy, but that also makes them a greater risk. Attackers have industrialized cyber threats Cybercriminals dont have to spend lots of time building sophisticated attack campaigns anymore. Access to phishing kits, ransomware-as-a-service and AI-driven social engineering have made it easier to launch attacks at scale, without a high cost.

It means that attackers can automate reconnaissance and personalize attacks
at machine speed, only to encounter SMEs relying on a patchwork of tools such as firewalls and email filtering. Even if the tools are in place, visibility and understanding what to do when an alert comes in are vital. What to read next AI is making cyber threats faster, but trust will define which
businesses survive The biggest cyber threats businesses face in 2026 The
cyber risk hiding in plain sight

Verizons 2025 DBIR SMB Snapshot found that credential abuse, vulnerability
and phishing are among the leading initial access points for cybercriminals.

With the economics of cyber threats skewed towards attackers, they dont have to beat every defense layer. They just need one unpatched system or usable identity to gain access, before moving through the supply chain to cause a much bigger compromise. Phishing is more than a badly written email Phishing remains a primary tactic for cybercriminals, exploiting busy staff who may
not have sufficient protection. It can be a founder checking emails off their phone, finance handling an invoice, a HR manager opening a CV, or a supplier message from a familiar-looking address.

These attacks have become more convincing with AI, due to language and sentence structure being more polished, and the content more accurately relating to the targets role or current activity. Thats also taken further with voice and impact manipulation.

The Cyber Security Breaches Survey 2025/2026 found that UK businesses experienced approximately 5.13 million phishing cybercrimes in the past 12 months. Targeting an unsuspecting or unprotected person is often easier for a cybercriminal than hacking a firewall.

Even if a phishing attempt is unsuccessful, the scale of these threats can take away attention and resources from an SME, making them easier to target
in future.

As a result, SMEs need to be prepared to recover when one of these attacks slips through. Prevention isnt enough anymore. They need to be able to
quickly identify if a credential was stolen, what was accessed and if the attacker has moved across the network, all of which is tricky with limited resources. Moving towards autonomous security The current focus for SMEs bolstering their cyber defenses is what happens in the first minutes after a potential breach or software failure happens.

Existing security tools will likely flag an alert to a central dashboard, but with the volume of threats made possible by AI, thatll only create a sea of noise for real attacks to hide in. What SMEs really need is an autonomous system that takes action on alerts, assessing the risk, restricting access, revoking credentials and flagging to human teams for oversight and auditability.

When a phishing attempt is detected, for example, when a suspicious link is clicked, an autonomous system should isolate the account, block the unusual activity and alert the security team with a recommendation within minutes.

Guided by a human-in-the-loop, good automation should be able to distinguish between low-risk alerts and serious threats, with the ability to advise, or even action, the next phase of containment. Cyber resilience must become accessible So much is said about cyber resilience but SMEs, who make up the largest proportion of the business world in the UK, have limited time,
limited budgets and limited cybersecurity expertise.

Since cybercriminals have automated and industrialized their threats, SMEs need access to autonomous defenses to match. They need simple deployment, greater visibility, clear recovery and automation that doesnt overwhelm them.

SMEs have become a lucrative target and its important they get greater protection. We've featured the best malware removal. This article was
produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit



======================================================================
Link to news story: https://www.techradar.com/pro/smes-arent-too-small-to-target-for-cybercriminal s-theyre-too-exposed-to-ignore


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)