A new Guardz report shows that cyber risk for small and midsize businesses (SMBs) continues to climb even as many remain underprepared or rely on untrained staff for critical security functions.
Study shows cyberattacks impacting SMBs at higher rates due to ransomware and phishing
The survey collected responses from 800 U.S.-based SMB owners representing companies with more than 10 employees across industries, including retail, healthcare, finance, manufacturing, education, and technology.
According to the results, 43% of U.S. SMBs have experienced a cyberattack, including 27% hit within the past year.
Despite rising concern—80% of respondents said cybersecurity needs increased over the past year—52% still depend on business owners or untrained employees to manage cybersecurity without professional support.
“In 2025, SMBs are confronting the reality that cyber threats are no longer distant possibilities, but daily risks with the potential to disrupt or even destroy a business,” said Dor Eisner, CEO and co-founder of Guardz.
”This research confirms that businesses increasingly recognize the value of experienced service partners. Those that try to manage risk on their own lack the expertise, resources, and tools needed to stay resilient. The data shows that organizations with strong preparation, grounded in clear processes and trusted partners, are far better positioned to avoid disruption and maintain continuity,” he continued.
Persistent vulnerabilities and uneven readiness
Phishing, ransomware, and employee error continue to drive most incidents, with 45% of SMBs citing employee negligence as their top concern. Exposure is especially high in education, where staff and budget constraints leave many environments vulnerable.
While most SMBs recover quickly from incidents, three percent reported long-lasting or severe damage. Adoption of basic security tools also remains inconsistent:
- 58% use network firewalls,
- 52% use email filtering, and
- 41% deploy endpoint protection.
The survey results also show that 26% do not conduct penetration tests or security assessments, and 42% still worry about outdated technology—an issue most prevalent in healthcare.
Rising awareness, but minimal investment and planning
All of this sounds like a recipe for disaster, and for those who suffer an attack, it might be. Still, most SMBs don’t feel confident in their current approach to security.
SMBs are increasing cybersecurity budgets, but spending levels remain low. Sixteen percent invest less than $50 per user annually, and 31% of business owners do not know their total cybersecurity spend.
Only 34% have a formal incident response or continuity plan developed with a cybersecurity professional, and 27% lack cyber insurance entirely.
Operational responsibility often falls to non-experts. One-third of business owners personally respond to alerts, and another 13% rely on untrained employees. The report suggests this fragmented approach leaves organizations more exposed to missteps when incidents occur.
MSPs positioned to capture growing demand
As threats intensify, SMBs are turning to MSPs for help. Fear of cyberattacks is the strongest motivator (52%), followed by customer and stakeholder expectations (40%).
Compliance requirements, the potential for lower cyber insurance premiums, and access to specialized expertise also factor into decisions to outsource.
The report highlights one finding particularly relevant for MSPs: 80% of SMBs with a formal incident response plan avoided major damage during an attack. The data reinforces the role of structured planning and professional support in improving outcomes.
The report also shows the growth opportunities still ahead for MSPs, specifically in security. What remains to be seen is how partners choose to approach the market next year, whether through more advanced service offerings, next-generation security tooling, or a combination of both that enables them to act as business advisors to their clients.