Key Takeaways

  • Verizon’s 2025 DBIR indicates ransomware is involved in 88% of breaches affecting small and midsize businesses.
  • Stolen credentials, unpatched vulnerabilities, and limited security staffing continue to leave smaller organizations exposed.
  • Managed detection, phishing-resistant MFA, tested offline backups, and a rehearsed response plan can reduce operational damage.

The latest ransomware data puts a stark number on the threat facing smaller businesses. According to reporting on Verizon’s 2025 Data Breach Investigations Report, ransomware was involved in 88% of breaches involving small and midsize businesses, compared to just 39% for larger enterprises. The comparison suggests ransomware has become a central business-continuity risk for smaller operations.

This dynamic reflects a basic economic calculation: smaller targets can be easier to compromise, yet still depend heavily on digital systems and data to remain operational. A regional manufacturer, accounting practice, medical office, or logistics provider may have fewer defensive layers than a multinational company, but a system outage can still create intense pressure to pay.

Attackers do not necessarily need exotic techniques to compromise these networks. Sophos’ 2025 survey found that 29% of SMB ransomware incidents began with an unpatched vulnerability, while 30% involved stolen credentials. Another 42% of respondents cited insufficient staffing or expertise as a contributing factor.

Those weaknesses frequently overlap. An internet-facing system may remain unpatched because nobody owns the update process. A stolen password becomes more valuable when an account lacks phishing-resistant multifactor authentication. Suspicious endpoint activity can go unnoticed overnight because monitoring ends when employees leave the office, leaving systems vulnerable when encryption starts during unmonitored hours.

For many smaller organizations, the answer is to supplement internal IT with a managed service provider or managed detection and response service. Vendors such as Huntress, Sophos, and CrowdStrike can provide monitoring, investigation, and endpoint isolation capabilities that a small internal team may struggle to operate around the clock. The service model matters, though. Alert forwarding alone is different from having an authorized provider that can contain a compromised device before ransomware spreads.

Preparedness remains uneven. The Guardz 2025 SMB Cybersecurity Report found that only 34% of surveyed U.S. SMBs had a formal incident-response or business-continuity plan. Among organizations that did have one, 80% avoided major damage during an attack.

A plan does not need to become a hundred-page binder. It should identify who can disconnect systems, contact legal counsel, notify an insurer, engage forensic support, communicate with customers, and decide whether restoration is safe. Those responsibilities should be tested through tabletop exercises. Otherwise, the first real discussion happens during the crisis, which is a rough time to debate authority and phone numbers.

Backups deserve similar scrutiny. A backup that remains reachable from the production network may be encrypted or deleted along with everything else. Smaller businesses can improve resilience by maintaining immutable or offline copies, separating backup credentials from normal administrator accounts, and routinely testing restoration. The restore test is the unglamorous part. It is also where faulty assumptions tend to surface.

The broader European picture is consistent. ENISA found ransomware was the leading cyber concern for 55% of surveyed organizations, while SMEs reported the lowest confidence in their ability to anticipate, withstand, and recover from incidents. Hiscox, meanwhile, reported that 27% of SMBs experienced ransomware during the preceding 12 months and that 94% planned to increase cybersecurity and data-protection spending (source).

More spending can help, but prioritization is the harder question. For most SMBs, the practical sequence starts with an accurate asset inventory, rapid remediation of exposed vulnerabilities, phishing-resistant MFA, restricted administrator privileges, endpoint detection and isolation, protected backups, and a response plan with named owners. None eliminates ransomware risk entirely. Together, they can make intrusion harder, detection faster, and recovery far less chaotic.