Small and medium-sized businesses (SMBs) are not necessarily unaware of cyber threats. The more important gap may be between recognizing a threat and being ready to prevent, contain, and recover from it. Verizon’s U.S. survey found that majorities of respondents considered each listed attack type a risk; that self-reported concern does not show whether security controls are in place, tested, or assigned to an owner.
Are small businesses really targets for cyberattacks?
Yes. Verizon’s 2025 Data Breach Investigations Report (DBIR) says SMBs were targeted nearly four times more than large organizations in that edition. The report covers incidents from November 1, 2023, through October 31, 2024, and draws on global breach data—not the same population as Verizon’s U.S. small-business attitude survey. This is a report finding, not a claim that every small business faces the same odds: sector, exposed systems, data, and existing controls all matter. Verizon 2025 DBIR
As an Amazon Associate I earn from qualifying purchases.
For an SMB, being small can mean fewer dedicated security staff and less spare capacity to manage an incident. But size alone does not determine whether attackers find an account, device, supplier, or payment process worth exploiting.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What are the biggest cyber risks for small businesses?
The practical risks include account compromise, deception that redirects payments or steals credentials, malicious software and extortion, and weaknesses in devices or sensitive-data handling. Verizon’s breach reports describe observed incidents; its survey records what business decision-makers say they worry about. Neither should be mistaken for a complete measure of every SMB’s exposure.
#1 Best Overall
- A FIDO security key with PUF technology provides a unique, hardware-rooted trust anchor that resists tampering and cyber attacks, offering stronger security than conventional designs.
- FIDO2 Certified Protection – Enjoy phishing-resistant security with FIDO2 certification, ensuring top-tier account safety across Windows, macOS, Linux, iOS iOS, Android and more.
- Easy to use & Portable – Designed with a compact USB-C interface, Clife key fits easily on your keychain for secure access anywhere. Simply plug in and authenticate with ease.
- Universal Compatibility – Works seamlessly with hundreds of FIDO2/U2F compliant services, including popular cloud, email, and social platforms.
- Backup recommended – To ensure continuous access, register a backup Clife security key as a spare in case your primary key is lost.
Account and email compromise
In Verizon’s 2024 SMB breach infographic, about one quarter of financially motivated incidents over the preceding two years involved pretexting, with most of those resulting in business email compromise. A criminal who takes over or convincingly impersonates a business email account may try to redirect an invoice payment or obtain credentials. In the same infographic, Verizon reported that the median time for users to fall for phishing emails was under 60 seconds. That is a vendor-reported median, not a prediction for every employee or company. Verizon 2024 SMB DBIR infographic
Ransomware and extortion
Verizon reported that 32% of SMB breaches in 2023 involved extortion, including ransomware. The infographic also reported a $46,000 median loss for financially motivated ransomware or extortion incidents, citing FBI Internet Crime Complaint Center data. These figures describe the report’s breach and loss measures, not the expected loss for a particular business. They do show why recovery planning matters alongside prevention.
Stolen credentials and social attacks
A separate Verizon infographic reports that, in its stated 2024 period, 33% of SMB breaches involved stolen credentials and 18% involved social attacks; it also gives a median attacker dwell time of 24 days. These are Verizon-reported figures, not universal rates for all SMBs. Verizon SMB DBIR infographic
Recommended Free Tools
Rank #2
- Hardware-Rooted Security with PUF Technology – PUFido Drive Clife Key uses Physical Unclonable Function technology to generate a unique, hardware-based identity that cannot be duplicated, delivering stronger resistance against tampering and cyber attacks than conventional security keys.
- FIDO2 Certified Phishing-Resistant Protection – Fully compliant with FIDO2/U2F standards, enabling secure passwordless login and two-factor authentication to help protect accounts from phishing and credential theft.
- Security Key + Flash Drive in One Device – Combines a FIDO security key with a built-in USB flash drive, allowing you to carry files and a hardware authentication key together in a single compact device.
- Easy to Use & Portable – Compact USB-C design fits easily on a keychain or in a pocket. Simply plug in the Drive Clife Key to authenticate or access stored files with no extra software required.
- Universal Compatibility – Works with hundreds of FIDO2/U2F compatible services and supports Windows, macOS, Linux, iOS, Android, and other major platforms.
Where can leaders misread the risk?
“We’re too small to be targeted.”
The 2025 DBIR finding counters the assumption that attackers focus only on large enterprises, but it does not establish equal risk for all SMBs. A business should assess its own exposed services, valuable data, payment workflows, and supplier access rather than infer safety from its headcount.
“We know phishing is a risk, so we’re covered.”
Awareness is not the same as a tested process. Staff need a safe way to report suspicious messages, and payment or credential requests should be verified through a second channel. A policy that nobody practices may not help when an urgent, convincing request arrives.
“We have antivirus, so we’re covered.”
One security product cannot cover every route into a business or every step of recovery. Verizon’s recommendations span multifactor authentication, software updates, training, encryption, testing defenses, and incident response. The useful question is not simply what tools the business bought, but whether critical accounts, devices, data, and suppliers are covered and who checks that coverage. Verizon 2025 DBIR
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
“Growth only helps us.”
In Verizon’s 2025 U.S. State of Small Business Survey, 52% of SMB respondents acknowledged that business growth likely increases cyberattack threat. Growth can bring more accounts, applications, devices, data, and suppliers to manage. The survey captures respondents’ perceptions; it does not establish that growth causes a particular increase in incidents. Verizon 2025 survey announcement
Free tools Windows power users keep installed
One-click scans. No signup required.
Does concern translate into preparedness?
Verizon’s 2025 U.S. survey found that 47% of surveyed SMBs had invested in cybersecurity technology in the prior year, while one quarter said they did not believe their business was investing enough. Respondents continued to view each listed category—viruses, malware or ransomware, password theft, sensitive-data vulnerabilities, endpoint vulnerabilities, and spam or phishing—as some level of risk. However, the share calling each a major risk had declined compared with August 2024. Verizon State of Small Business Survey
Those responses indicate concern and reported spending, not a security audit. They do not establish whether a company enabled MFA on its most important accounts, applied updates promptly, tested backups, or knows who makes decisions during an incident. That distinction is the central leadership challenge: turn concern into owned, maintained, and rehearsed controls.
Rank #4
![Thetis Pro FIDO2 Security Key Passkey with Complex Pin [PinPlex], Hardware Device Supports USB A, Type C &NFC, TOTP/HOTP Authenticator APP, PIV Certificates, FIDO 2.0 Two Factor Authentication 2FA MFA](https://m.media-amazon.com/images/I/31ugrBqG6SL._SL160_.jpg)
- Dual USB-A and USB-C Security Key – Features both USB-A and USB-C connectors for seamless compatibility across desktops, laptops, and tablets. Supports plug-and-stay use or keychain carry.
- NFC-Enabled for Mobile Access – Built-in NFC allows fast, wireless authentication with Android and iPhone devices. Ideal for mobile logins and on-the-go security.
- FIDO Certified for Strong Authentication – [CHECK COMPATIBILITY before purchase] Fully compliant with FIDO2 and FIDO U2F standards. Works with major platforms like Google, Microsoft, GitHub, and Dropbox.
- Passwordless Login with PinPlex – Supports secure passkey login via WebAuthn and CTAP2 with added protection from PinPlex, a complex PIN system that enhances physical security.
- Multi-Layer Authentication Support – Includes PIV certificates and supports both TOTP and HOTP for strong 2FA/MFA coverage across enterprise and consumer apps.
How can a small business protect itself from cyberattacks?
Start with the assets and processes that would interrupt the business if compromised or unavailable. Assign an owner for each, then confirm that protections work in practice. Verizon’s 2025 DBIR recommendations include MFA, timely software updates, employee training, encryption, regular testing of defenses, and an incident response plan.
- Inventory critical assets and owners. List business-critical accounts, devices, data, cloud services, and suppliers. Record who is responsible for each and how access is removed when a worker or supplier no longer needs it.
- Enable MFA on high-impact accounts. Prioritize email, remote access, financial systems, and administrator accounts. A FIDO2-compatible hardware security key can be an option where a service supports it; check compatibility and establish a recovery method before relying on it.
- Make updates routine. Establish who monitors and installs software and device updates, including for internet-facing systems and critical vendor services. Define how urgent updates are handled rather than leaving patching to chance.
- Make deception harder to act on. Train staff to verify unexpected payment changes or credential requests through a second channel, such as a known phone number. Practice reporting suspicious messages without blame so staff are more likely to raise concerns quickly.
- Limit and protect sensitive data. Restrict access to people and systems that need it, and use encryption appropriate to the data and service. Review whether supplier access is necessary and limited to the required scope.
- Test recovery and response. Test that backups can be restored, not just that backup jobs completed. Write a short incident plan naming who decides, who contacts the insurer or service provider, how operations continue, and how customers or regulators are notified when required. Notification duties depend on jurisdiction and data type; do not assume a single deadline applies.
- Revisit controls when the business changes. Review coverage after growth, new applications, acquisitions, or supplier changes. A control that covered last year’s systems may not cover this year’s.
If the business lacks internal security expertise, a managed provider or assessment may help, but leadership should still retain clear ownership. Ask what systems and suppliers are in scope, how urgent findings are escalated, who can access business data, how recovery is tested, and what ongoing work and costs are included.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How should leaders judge whether they are ready?
Use operational evidence rather than confidence alone. For each critical account, system, dataset, and supplier, a leader should be able to identify the owner, the control in place, when it was last checked, and what happens if it fails. The evidence need not be elaborate: a current inventory, MFA coverage review, update records, restoration test, and a short incident exercise can expose gaps more clearly than a general statement that cybersecurity matters.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
