Source: Verizon 2026 Data Breach Investigations Report (DBIR) – based on analysis of more than 22,000 confirmed data breaches across 145 countries.
Every year, Verizon publishes the Data Breach Investigations Report (DBIR) – one of the most respected pieces of research in the security world. The 2026 edition, published this month, looked at more than 22,000 confirmed data breaches across 145 countries. It is the largest dataset they have ever examined.
Here is what it means for small businesses:
Small businesses are not being overlooked by criminals
Let’s start with the finding that matters most. Of all the ransomware cases in the 2026 DBIR where the victim’s organisation size was known, 96% were small and medium businesses.
Criminals are not just targeting the big names you see in the news. They are casting wide nets, looking for the easiest doors to walk through. If your business has an unpatched system or a set of stolen login details floating around on the dark web, you are just as interesting to them as a large company.
The DBIR team put it plainly: attackers are “opportunistic in nature.” It is not about who you are or how much money you make. It is about whether you had a vulnerability they could exploit.
The biggest shift: unpatched software is now the most common way attackers get in
For years, the number one way attackers got into organisations was by using stolen or guessed passwords. That is no longer the case.
In 2026, exploiting vulnerabilities in software has become the most common way attackers gain initial access – rising to 31% of breaches, while credential abuse dropped to 13%.
What does that mean in practice? It means that if your computers, routers, or software are not being kept up to date, you are leaving the digital equivalent of a broken window in your office wall.
The report found that only 26% of critical vulnerabilities – the most dangerous, actively exploited ones, were fully patched by organisations. That is down from 38% the previous year. The average time to fix them has also gone up, to 43 days.
Forty-three days is a long time to leave a known door open.
For small businesses, the message is clear: patch your systems, and patch them quickly. It does not need to be complicated. A good managed IT or security provider can handle this automatically.
Ransomware keeps growing – but fewer victims are paying
Ransomware now accounts for nearly half of all breaches – 48%, up from 44% the year before.
If you are not familiar with ransomware, it works like this: attackers get into your systems, encrypt your files so you cannot access them, and demand payment to give them back. Sometimes they also threaten to publish your data publicly if you refuse.
The two most common ways attackers got into small businesses to plant ransomware were stolen or guessed credentials (38% of cases) and unpatched vulnerabilities in edge devices – things like firewalls and VPNs (29%).
There is some good news here. Fewer victims are paying ransoms, and the amounts being paid are falling. But that is cold comfort if your business is the one that is offline for days or weeks while you try to recover.
The better news is that the most effective defences are well within reach for small businesses:
- Keep your software and devices up to date
- Use multi-factor authentication (MFA) on your accounts – especially email and remote access
- Have a proper backup in place that is tested regularly
Third parties are an increasing risk
Nearly half of all breaches, (48%), now involve a third party. That means a supplier, software provider, or contractor whose systems were compromised, which then became a route into their customers.
This has risen 60% compared to last year’s data.
If you use cloud software, outsource any part of your IT, or rely on suppliers who have access to your systems or data, this matters to you.
You cannot control your suppliers’ security, but you can ask questions. Do they have Cyber Essentials? Do they have a process for telling you if something goes wrong? Have they ever had a breach?
The 2026 DBIR also found that when it comes to fixing security weaknesses in third-party cloud systems, only 23% of third-party organisations had fully resolved missing or misconfigured multi-factor authentication on their cloud accounts. Weak passwords and permission issues were even slower to fix – taking an average of eight months to resolve in half of all cases.
AI is now being used against you
This is a new one. The 2026 DBIR confirms that attackers are now routinely using artificial intelligence tools to help them. AI is being used to identify targets, write more convincing phishing emails, research vulnerabilities, and build attack tools.
The typical attacker was using AI assistance across 15 different stages of their attack. Some were using it across 40 to 50.
The practical impact for small businesses is this: phishing emails are getting better. The obvious spelling mistakes and clunky phrasing that used to be a giveaway are disappearing. Emails, texts, and phone calls from attackers are becoming harder to spot.
The report also found that people are 40% more likely to click on a phishing link when it arrives via a text message or phone call than via email.
The human element is still a factor in most breaches
Despite the rise of vulnerability exploitation, people are still involved in the majority of breaches. 62% of breaches involved a human element – whether that was someone clicking a link, using a weak password, or being tricked into handing over information.
This is not a reason to blame your staff. It is a reason to train them, support them, and make it easy for them to do the right thing.
The report highlights a growing tactic called pretexting – where an attacker builds a relationship with someone over time, often by phone, before asking them to do something that compromises the business. Help desks and customer support staff are a particular target.
One more thing: Shadow AI
Here is a finding that might surprise you.
45% of employees are now regular users of AI tools on work devices – whether their employer has approved those tools or not. That is up from just 15% the previous year.
The most common type of data being fed into unauthorised AI tools? Source code and structured business data.
If your team is using AI assistants to help with their work, and they almost certainly are, it is worth having a conversation about which tools are safe to use and what should never be pasted into them.
So what should you do?
The 2026 Verizon DBIR is not a doom-and-gloom document. It is a practical one. And its consistent message, despite all the change in the threat landscape, is this: the basics still matter most.
Here is where to start:
1. Keep everything patched and up to date. Software, operating systems, routers, firewalls. If it connects to the internet, it needs to be maintained.
2. Use multi-factor authentication everywhere. Especially email, cloud accounts, and any remote access to your systems.
3. Back up your data properly. Offline or immutable backups that ransomware cannot reach. Test them.
4. Train your team. Not once a year with a box-ticking exercise. Regularly, with realistic examples of what attacks actually look like.
5. Ask questions about your suppliers. Who has access to your systems or data? What happens if they are breached?
None of this requires a big IT budget. It requires making it a priority.
If you would like to talk through what any of this means for your business, get in touch. That is exactly what we are here for.
Source: Verizon 2026 Data Breach Investigations Report. All statistics cited are from that report.
