When cybercriminals look at a small and medium-sized enterprise (SME), they see a route into a larger organization or supply chain with a bigger payout.
SMEs operate with the same level of connectivity, supply chain reliance and regulatory responsibilities as larger organizations, but nowhere near the security budget or cyber staffing.
Co-Founder of BlockAPT.
That imbalance, and connection to a larger environment, is what cybercriminals are exploiting. The Cyber Security Breaches Survey 2025/2026 found that 46% of small businesses and 65% of medium businesses reported a cyber breach or attack over the past 12 months.
SMEs are now targeted based on how exposed they are and the bigger payout they can lead to.
The economic risk caused by the SME cyber gap
SMEs account for 99% of the UK’s business population, employing three-fifths of the private sector workforce and generating half of the private sector’s turnover, according to the Federation of Small Businesses.
A fifth of those breached by a cyber incident reported revenue loss and reputational damage, while suffering from extended business disruption.
Temporary loss of access and interruption to online services can have a significant impact not only on the SME impacted but their wider supply chain. Especially in sectors such as banking, retail and public services, which hold vast amounts of customer data and process payments, the knock-on effect of a cyber incident within a connected SME can be huge.
One compromise from a supplier account can be the catalyst for a much larger breach, which in turn can have a wider economic impact, as we saw with JLR. Connected SMEs are valuable to the UK economy, but that also makes them a greater risk.
Attackers have industrialized cyber threats
Cybercriminals don’t have to spend lots of time building sophisticated attack campaigns anymore. Access to phishing kits, ransomware-as-a-service and AI-driven social engineering have made it easier to launch attacks at scale, without a high cost.
It means that attackers can automate reconnaissance and personalize attacks at machine speed, only to encounter SMEs relying on a patchwork of tools such as firewalls and email filtering. Even if the tools are in place, visibility and understanding what to do when an alert comes in are vital.
Verizon’s 2025 DBIR SMB Snapshot found that credential abuse, vulnerability and phishing are among the leading initial access points for cybercriminals.
With the economics of cyber threats skewed towards attackers, they don’t have to beat every defense layer. They just need one unpatched system or usable identity to gain access, before moving through the supply chain to cause a much bigger compromise.
Phishing is more than a badly written email
Phishing remains a primary tactic for cybercriminals, exploiting busy staff who may not have sufficient protection. It can be a founder checking emails off their phone, finance handling an invoice, a HR manager opening a CV, or a supplier message from a familiar-looking address.
These attacks have become more convincing with AI, due to language and sentence structure being more polished, and the content more accurately relating to the target’s role or current activity. That’s also taken further with voice and impact manipulation.
The Cyber Security Breaches Survey 2025/2026 found that UK businesses experienced approximately 5.13 million phishing cybercrimes in the past 12 months. Targeting an unsuspecting or unprotected person is often easier for a cybercriminal than hacking a firewall.
Even if a phishing attempt is unsuccessful, the scale of these threats can take away attention and resources from an SME, making them easier to target in future.
As a result, SMEs need to be prepared to recover when one of these attacks slips through. Prevention isn’t enough anymore. They need to be able to quickly identify if a credential was stolen, what was accessed and if the attacker has moved across the network, all of which is tricky with limited resources.
Moving towards autonomous security
The current focus for SMEs bolstering their cyber defenses is what happens in the first minutes after a potential breach or software failure happens.
Existing security tools will likely flag an alert to a central dashboard, but with the volume of threats made possible by AI, that’ll only create a sea of noise for real attacks to hide in. What SMEs really need is an autonomous system that takes action on alerts, assessing the risk, restricting access, revoking credentials and flagging to human teams for oversight and auditability.
When a phishing attempt is detected, for example, when a suspicious link is clicked, an autonomous system should isolate the account, block the unusual activity and alert the security team with a recommendation within minutes.
Guided by a human-in-the-loop, good automation should be able to distinguish between low-risk alerts and serious threats, with the ability to advise, or even action, the next phase of containment.
Cyber resilience must become accessible
So much is said about ‘cyber resilience’ but SMEs, who make up the largest proportion of the business world in the UK, have limited time, limited budgets and limited cybersecurity expertise.
Since cybercriminals have automated and industrialized their threats, SMEs need access to autonomous defenses to match. They need simple deployment, greater visibility, clear recovery and automation that doesn’t overwhelm them.
SMEs have become a lucrative target and it’s important they get greater protection.
We've featured the best malware removal.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit