"The most common attacks on small businesses in 2026 - phishing, ransomware, business email compromise - aren't stopped by antivirus alone. They're stopped by three layers of defence, each with a predictable cost."
Author
Lior Refael
Published
Jan 20, 2026
The threats facing small businesses have changed. Attackers don't need to be sophisticated - they use automated tools that scan thousands of businesses a day looking for the same predictable gaps: weak passwords, unpatched software, no MFA, no email authentication.
The attacks actually hitting businesses in Israel and across Europe in 2026:
Phishing
Ransomware
Business email compromise
Credential stuffing
None of these require a sophisticated attacker. They're automated. A 10-person accountancy firm in Berlin has the same exposure as a 10-person law firm in Tel Aviv.
If you take one number from this article, take this one: 96% of ransomware victims in Verizon's 2026 dataset were small and medium businesses[1]. And ransomware is not receding - it has grown as a share of all breaches in each of the last three reporting years.
Percentage of analysed breaches
Ransomware moved from a third of breaches to nearly half in two reporting years. In the same 2026 dataset, 96% of ransomware victims were small and medium businesses.
| Percentage of analysed breaches | Breaches involving ransomware |
|---|---|
| 2024 edition | 32% |
| 2025 edition | 44% |
| 2026 edition | 48% |
Source: Verizon Business, 2026 Data Breach Investigations Report (2026)
The delivery method has shifted, though, and that matters for where you spend. In Sophos's 2026 survey, malicious email and phishing together accounted for around half of all ransomware incidents[2] - which is why the work below starts with identity and email rather than with anti-malware.
The layering below is not our invention. It is the same baseline that CISA publishes for small businesses in Cyber Essentials[3] and that the Israel National Cyber Directorate sets out in its defence methodology for organisations[4] - identity first, then devices, then recoverable data.
This is the most important layer, and it is where the evidence is strongest. Microsoft's measurement study of Entra accounts found MFA reduced the risk of compromise by 99.22% across the population, and by 98.56% even for accounts whose password had already leaked[5]. Over 97% of identity attacks Microsoft observes are password attacks[6] - which is precisely the category MFA removes.
Every device that accesses your data is a potential entry point.
If layers 1 and 2 fail (and occasionally they will), a tested backup is what separates a bad day from a business-ending event.
Identity
Endpoint
Backup
Total
This is not a marketing estimate - these are the actual current pricing ranges for a 10-person business in 2026. The loss figures in the table above are not scare tactics either: IBM's Cost of a Data Breach study puts the global average breach cost in the millions, with the smallest organisations in the study still averaging six figures[7], and the FBI's IC3 reporting shows business email compromise losses concentrated in exactly the five- and six-figure band[8]. A €5,000-€50,000 recovery bill for a 10-person firm is the optimistic end of that distribution.
SPF, DKIM, and DMARC are three DNS records that authenticate your email. Without them, anyone can send an email that appears to come from your domain - which is exactly how business email compromise works.
Setting these up takes about 2 hours. Your email provider's documentation covers the exact steps. This is one of the highest-ROI security improvements a small business can make, and it's free.
Every figure in this article traces back to a named source. Where we quote our own numbers, they come from work we have done with small businesses in Israel and across Europe, and we say so.
Figures last checked 28 July 2026
Book a free 30-minute security review. We'll check your MFA status, email authentication, and backup setup - and tell you exactly what's missing.
