ESET 2026 SMB Cyber Readiness Index Finds 45% of Small Firms Experienced Cyber Incidents

ESET released its 2026 SMB Cyber Readiness Index, based on a global survey of 4,400 small‑business decision makers representing organisations with 25 to 1,000 endpoints across 13 countries in North America, Europe and Asia. The index shows that 45% of SMBs experienced a cybersecurity incident in the past 12 months, with 14% reporting more than one incident. A majority (61%) are seriously concerned about cyberattacks, and 75% consider cyber‑warfare and global conflicts real threats to their operations. The greatest concern among surveyed firms is AI‑powered malware, although such threats remain relatively rare.

The report also highlights positive trends: insurance and compliance requirements are driving stronger security practices, and many SMBs acknowledge that size does not protect them from threats. Consequently, 68% feel confident in preventing attacks and 75% trust their resilience when responding to incidents. About 65% are satisfied with their cybersecurity budgets, with an additional 15% “more than satisfied”. Only 11% operate with minimal protection, while 87% view employee education as very important, and 67% conduct training more than once a year. However, 6% rely solely on basic awareness programmes and 2% provide no training at all. More than a third of SMBs investigated incidents within two weeks, but concerns remain about supply‑chain attacks and the risks of AI‑enabled tools, including “shadow AI”.