One in four malicious breaches is now AI-enabled, according to IBM's 2026 Cost of a Data Breach Report, up 56% in a single year. For a small business, that can look like a phone call in the CFO’s voice asking for an urgent wire transfer.
It’s one sign of a broader shift in the cybersecurity threat landscape. The latest reports from IBM, Verizon, Mandiant, and the FBI, covering attacks from 2025 and 2026, show attackers getting in faster, using AI to scale, and handing off access within seconds. Here’s what that means for small business cybersecurity heading into 2027.
Why small businesses are disproportionately targeted
Attackers choose targets by access and weak controls, not company size. According to the 2026 Verizon Data Breach Investigations Report, ransomware appeared in 48% of all breaches, and small organizations made up roughly 96% of ransomware victims, as summarized by the Cyber Readiness Institute. Smaller teams are less likely to have overnight monitoring, tested recovery processes, or someone dedicated to confirming patches landed.
For regulated organizations, the stakes are higher. IBM found healthcare breaches averaged $6.64 million and financial services $6.29 million, and examiners, auditors and cyber insurers increasingly expect proof that controls work, not just that tools are installed.
The 7 biggest cybersecurity threats for small businesses
Understanding the most significant threats and the safeguards that reduce them can help small businesses focus their cybersecurity efforts where they matter most.
1. Exploited vulnerabilities
Unpatched software is now the most common way attackers get in. Verizon found vulnerability exploitation led all initial access vectors at 31% of breaches. Only 26% of flaws on CISA's Known Exploited Vulnerabilities list were fully remediated, and the median fix took 43 days, up from 32. Meanwhile, Mandiant's M-Trends 2026 estimates the mean time to exploit at negative seven days, meaning attacks can begin days before a patch exists.
Safeguard: Assign clear ownership for patching internet-facing systems, prioritize known exploited flaws, and verify each fix actually landed.
2. Edge device security vulnerabilities
Firewalls, VPN gateways, and remote access appliances sit directly on the internet, so they see every attacker first. The 2025 Verizon DBIR found edge devices and VPNs rose from 3% to 22% of breaches involving vulnerability exploitation. The GreyNoise 2026 State of the Edge Report found 52% of remote code execution attempts came from IP addresses with no prior history, so blocklists alone can miss most of them.
Safeguard: Review firmware, configuration, and end-of-life status on every edge device and keep a documented replacement plan for aging hardware.
3. AI deepfake phishing attacks and voice phishing
Attackers are reaching employees by phone, not just email. Mandiant found voice phishing, or vishing, rose to the second most common entry point at 11% of investigations, while email phishing fell to 6%. IBM found vishing and smishing carried the highest average breach cost of any attack type at $5.29 million. The FBI's 2025 Internet Crime Report logged 22,364 complaints referencing AI, tied to $893 million in losses, and AI-generated voice and video make impersonation harder to spot.
Safeguard: Confirm through a separate channel any request to change payment details, reset a password, or grant access. If the request arrives by phone, hang up and call back using a number already on file, not one the caller provides. Then train staff on deepfakes and to expect AI-generated voices that sound like someone they know.
4. Ransomware and data theft
Ransomware does two kinds of damage by both stopping operations and stealing data. Backups help you recover systems, but they don't undo the exposure of stolen records. For a healthcare clinic or community bank, that exposure can trigger notification obligations and regulatory scrutiny even after systems are restored.
Safeguard: Protect backups from tampering, test full restores on a schedule, and maintain a recovery plan tied to your most critical business services.
5. Attackers who move faster than your team
Speed is now the attacker's advantage. Mandiant found the median time between initial access and hand-off to a second criminal group fell from more than eight hours in 2022 to 22 seconds in 2025, yet in a typical case the intrusion still went undetected for 14 days. IBM found breaches contained in under 200 days cost $4.32 million on average, compared with $5.65 million for those that ran longer.
Safeguard: Make sure someone is watching alerts at night and on weekends along with having someone authorized to act on them.
6. Stolen logins and third-party access
Identity is the key attackers use most quietly. Verizon found breaches involving a third party rose to 48%, up from 30% the year before, often through vendor accounts with weak access controls or missing multi-factor authentication (MFA).
Safeguard: Require MFA on email, remote access, and every admin account, limit privileged access, and review which vendors can reach your systems.
7. Shadow AI
Employees are adopting AI tools faster than policies can keep up. Verizon found 67% of users accessed AI services through non-corporate accounts on work devices, which can send customer data and sensitive files to platforms the business doesn't control.
Safeguard: Set an AI use policy that defines approved tools and what data can go into them, then monitor for use outside of it.
Cybersecurity threat landscape at-a-glance
Frequently asked questions about the cybersecurity landscape
What does this mean for how your small business responds?
The pattern across every report is similar in that most breaches start in the gaps between tools, teams, and vendors, and they get expensive when no one is clearly responsible for closing them. That's why the safeguards above matter less as a checklist and more as a question of ownership. Who confirms the patch landed? Who answers the alert at 2 a.m.? Who verifies the urgent call from the "CFO"?
It's also why proof matters. Insurers, auditors, and examiners increasingly ask for evidence that MFA is enforced, endpoints are monitored, backups restore, and patches are verified. For a lean IT team, producing that evidence on top of daily operations is where risk quietly builds.
Locknet’s managed IT services are built for that reality. As a security-led managed service provider, we share responsibility for the controls that close these gaps and the evidence that shows they're working, so your team isn't carrying that risk alone. Talk with Locknet about managed security and IT services to see where your environment stands.
