# Cybersecurity threats and resilience for SMEs

> Live situation record from CLSTR: https://clstr.news/situations/cybersecurity-threats-to-small-and-medium-businesses
> Updated: 2026-08-31T05:00:08.000Z. Sources: 7. Developments: 2.

Small and medium-sized enterprises (SMEs) are facing escalating cybersecurity threats, particularly through the targeting of payroll software and business communication tools. Criminals exploit these systems to steal sensitive banking and personal data for fraud or identity theft. Reports from 2025 suggest that four out of five small businesses were victims of a breach, experiencing 350% more social engineering or impersonation attacks than large enterprises.

As the threat landscape evolves, cybercriminals are employing sophisticated methods typically used against large corporations, such as phishing and software vulnerability exploitation. Research indicates that only 14% of global businesses with 100 to 499 employees avoided a cyber incident in the past year.

Regional authorities have begun issuing warnings regarding the financial impact of these attacks. In the United Kingdom, officials noted that a significant attack can cost a single business nearly £195,000. In South Africa, high rates of social engineering, phishing, and business email compromise have been observed as smaller organizations continue to digitalize.

By late 2026, the cybersecurity focus has shifted toward resilience and the ability to maintain operations and recover quickly during incidents. Experts suggest SMEs can reduce risk by implementing fundamental controls, such as multi-factor authentication (MFA) and consistent patch management, rather than relying on expensive, complex tooling. 

In the insurance sector, cyber insurance is becoming a key metric for preparedness, though a lack of basic security controls may restrict coverage options. In New Zealand, concerns have been raised regarding a “forgotten middle” of medium-sized businesses facing growing regulatory responsibilities without adequate resources, especially as potential legal changes could hold directors personally liable for critical breaches.

## Timeline

### 2026-08-31: Cybersecurity focus shifts toward resilience and SME protection

Cybersecurity focus is shifting toward resilience and preparedness as SMEs struggle with resource gaps, evolving insurance requirements, and increasing regulatory accountability.

7 sources. https://clstr.news/cluster/cybersecurity-threats-increasingly-target-small-and-mid-sized-businesses

### 2026-08-17: Cybersecurity risks threaten small business payroll and communications

Small businesses face heightened cybersecurity risks, with payroll software and unencrypted business communications serving as primary targets for data theft and social engineering attacks.

4 sources. https://clstr.news/cluster/cybersecurity-risks-threaten-small-business-payroll-and-communications

---
Cite as: Cybersecurity threats and resilience for SMEs. CLSTR, https://clstr.news/situations/cybersecurity-threats-to-small-and-medium-businesses