Unpatched software opens 26% of SMB breaches; stolen passwords 13%

01The way in has moved from passwords to unpatched software

Verizon’s 2026 Data Breach Investigations Report covers more than 22,000 confirmed breaches in 145 countries, from October 2024 to November 2025. For small and mid-sized businesses it counts 7,256 incidents, 7,152 with confirmed data disclosure.¹ Where the initial access vector is known, exploitation of vulnerabilities leads at 26%, credential abuse is 13% and phishing 9%. Across all breaches, vulnerability exploitation reached 31%, a 55% jump on the previous year, while credential abuse fell to 13%.¹²

What “exploitation of vulnerabilities” means for a small company is usually unglamorous: a VPN or firewall appliance a version behind, a web server nobody remembers setting up, a plug-in on the company website. The report’s other small-business number points the same way: a third party was involved in 55% of these breaches, against 48% across all organisations.¹ For a firm whose IT is run by an outside provider, the provider’s patching is your patching. Ask for its patch report every month, in writing.

02Patching comes first, and everyone has got slower at it

The same report measures how long organisations take to finish fixing a critical vulnerability. The median time to full resolution rose to 43 days, from 32 the year before, and only 26% of critical vulnerabilities on CISA’s Known Exploited Vulnerabilities list were fully remediated in 2025, against 38% the previous year.¹ Attackers are using generative AI to find and weaponise flaws faster: in the median case Verizon found a threat actor had used it for 15 distinct attack techniques.² Defenders, meanwhile, are fixing flaws more slowly, and the gap between the two is where small companies get caught.

For a small company the fix is not a programme, it is a tool and a weekly habit. Action1, a cloud patching service, is free for the first 200 endpoints with full features, which covers most firms reading this.⁴ Windows Update can be run without it; what a patching tool adds is a report of which machines did not patch, and updates for the applications Windows Update does not cover.

03Passwords and encryption: mostly already paid for

Multi-factor authentication costs nothing on Microsoft 365. Microsoft’s security defaults require every user to register for MFA, require it of administrators, and block legacy sign-in protocols; the required licence is “None”.⁵ Full-disk encryption is in the box too: BitLocker is supported on Windows Pro, Enterprise and Education.⁶ The only line that needs a purchase order is the password manager, and at Bitwarden’s Teams price of US$4 a user a month it is a small one.³

Encryption matters for a reason that has nothing to do with hackers: laptops get lost. A lost laptop with an encrypted disk is a hardware cost; without encryption it can be a reportable breach of every customer record on it. One practical detail decides whether BitLocker helps or hurts: the recovery key. Microsoft documents that on devices joined to Microsoft Entra ID the key is backed up to the directory automatically.⁶ On a laptop set up with a local account, it is not, and a forgotten PIN becomes a lost disk.

The Verizon report adds one warning for the free measures. Only 23% of third-party organisations fully fixed missing or weak MFA on their cloud accounts, and resolving half of all weak-password and permission findings took almost eight months.¹ Switching a control on is cheap; checking that it stayed on is the work.

04Training and insurance: what the money is for

People remain part of most breaches: the human element appears in 45% of small-business breaches and 62% of all breaches. The report finds that simulated attacks by voice call or text message drew a 40% higher median click rate than email, so a training course that only covers suspicious emails is a 2023 course.¹

Training a 25-person company does not need a platform. It needs two rules everyone can repeat. First, no payment, bank-detail change or password reset is ever approved on the strength of a call, a text or a WhatsApp message alone; it is confirmed by calling back on a number already on file. Second, anyone who clicks something odd reports it at once and is thanked for it. A simulated phishing tool adds measurement, and is worth buying once the two rules are habit.

Read the second grid with its note. Fewer victims pay, and those who do pay less. Our reading, which the report does not state, is that backups and recovery plans are working for more organisations. For a small company the lesson is that the ransom is rarely the largest cost; the days without systems are. A tested backup, restored at least once, is the control that turns a ransomware incident from a crisis into a bad week.

In the worst 2.5% of small-business cases, losses ran to over 7% of revenue, and that is the case for cyber insurance: Verizon’s Breach Impact Study drew on about 70,000 insurance claims.² We found no published premium for an Indian small-business cyber policy; insurers quote. Our view is that insurance belongs last on the list, not because it is unimportant but because an insurer prices the risk you carry, and the three free controls above are the cheapest way to lower it before you ask for a quote.