--- title: "Unpatched software opens 26% of SMB breaches; stolen passwords 13%" summary: "Verizon’s 2026 breach data for small and mid-sized firms, and the 2023 post’s five cheap fixes re-ranked and costed for 25 people, as of September 2026." url: https://www.thetechbag.com/blog/5-cost-effective-ways-smbs-improve-cybersecurity format: Analysis desk: "Security operations" published: 2025-05-20 facts_checked: 2026-09-30 author: TechBag (The TechBag Journal) tags: ["SMB security","patch management","MFA","password manager","BitLocker","security awareness","cyber insurance","Verizon DBIR","CERT-In","DPDP"] cover: https://www.thetechbag.com/blog/covers/5-cost-effective-ways-smbs-improve-cybersecurity.png --- # Unpatched software opens 26% of SMB breaches; stolen passwords 13% *Verizon’s 2026 breach data for small and mid-sized firms, and the 2023 post’s five cheap fixes re-ranked and costed for 25 people, as of September 2026.* Analysis · Security operations · By TechBag · Published 2025-05-20 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/5-cost-effective-ways-smbs-improve-cybersecurity The short version - Patch first. In Verizon’s 2026 data, exploited software flaws opened 26% of breaches at small and mid-sized businesses; stolen credentials opened 13% and phishing 9%.[1] - Three of the five measures from 2023 cost nothing extra for a 25-person firm on Windows Pro and Microsoft 365: patching (free to 200 endpoints), MFA (security defaults) and disk encryption (BitLocker). A password manager is about US$1,200 a year.[3][4][5][6] - Training still matters, but it now has to cover the phone: simulated attacks by voice and text drew 40% more clicks than email.[1] The 2023 version of this post listed five cheap ways for a small business to improve its security, in this order: passwords, encryption, software updates, training and cyber insurance. The list was right; the order no longer is. The question for a 10- to 200-person Indian company with no security team is which of the five to do first, what each costs, and which ones are already paid for. ## The way in has moved from passwords to unpatched software Verizon’s 2026 Data Breach Investigations Report covers more than 22,000 confirmed breaches in 145 countries, from October 2024 to November 2025. For small and mid-sized businesses it counts 7,256 incidents, 7,152 with confirmed data disclosure.[1] Where the initial access vector is known, exploitation of vulnerabilities leads at 26%, credential abuse is 13% and phishing 9%. Across all breaches, vulnerability exploitation reached 31%, a 55% jump on the previous year, while credential abuse fell to 13%.[1][2] **Figure: At small and mid-sized firms, flaws in software opened twice as many breaches as stolen credentials** *Share of breaches by known initial access vector, %, DBIR 2026 dataset (October 2024 to November 2025)* | | Small and mid-sized businesses | All breaches | | --- | --- | --- | | Exploited vulnerability | 26 | 31 | | Credential abuse | 13 | 13 | | Phishing | 9 | 16 | Source: Verizon, 2026 DBIR Executive Summary · as of 19 May 2026 ReportedReported, not measured by us The 2023 post said 80% of breaches were due to weak or stolen passwords. A password manager’s pricing page we read in September still says passwords are behind 68% of breaches, citing Verizon.[3] Neither is what the 2026 report measures as the way in, which is 13% for credential abuse.[1] Stolen credentials still matter after entry: credentials were among the data compromised in 31% of small-business breaches.[1] What “exploitation of vulnerabilities” means for a small company is usually unglamorous: a VPN or firewall appliance a version behind, a web server nobody remembers setting up, a plug-in on the company website. The report’s other small-business number points the same way: a third party was involved in 55% of these breaches, against 48% across all organisations.[1] For a firm whose IT is run by an outside provider, the provider’s patching is your patching. Ask for its patch report every month, in writing. ## Patching comes first, and everyone has got slower at it The same report measures how long organisations take to finish fixing a critical vulnerability. The median time to full resolution rose to 43 days, from 32 the year before, and only 26% of critical vulnerabilities on CISA’s Known Exploited Vulnerabilities list were fully remediated in 2025, against 38% the previous year.[1] Attackers are using generative AI to find and weaponise flaws faster: in the median case Verizon found a threat actor had used it for 15 distinct attack techniques.[2] Defenders, meanwhile, are fixing flaws more slowly, and the gap between the two is where small companies get caught. 43 days Median time to fully resolve a critical vulnerability, DBIR 2026 dataset Eleven days longer than the 32 a year earlier, per Verizon’s 2026 DBIR Executive Summary.[1] For a small company the fix is not a programme, it is a tool and a weekly habit. Action1, a cloud patching service, is free for the first 200 endpoints with full features, which covers most firms reading this.[4] Windows Update can be run without it; what a patching tool adds is a report of which machines did not patch, and updates for the applications Windows Update does not cover. Our view Our view: if a small company does one thing from this list this quarter, it should be a seven-day patch target for anything internet-facing, with someone named who checks the report every Monday. That single habit addresses the largest share in the chart above. ## Passwords and encryption: mostly already paid for Multi-factor authentication costs nothing on Microsoft 365. Microsoft’s security defaults require every user to register for MFA, require it of administrators, and block legacy sign-in protocols; the required licence is “None”.[5] Full-disk encryption is in the box too: BitLocker is supported on Windows Pro, Enterprise and Education.[6] The only line that needs a purchase order is the password manager, and at Bitwarden’s Teams price of US$4 a user a month it is a small one.[3] **Figure: Three of the four technical measures cost nothing extra for a 25-person firm; the password manager is US$1,200 a year** *Annual list cost for 25 users, US$, before tax, published prices as of September 2026* Password manager (Bitwarden Teams) US$4 a user a month US$1,200 Patching (Action1, up to 200 endpoints) US$0 MFA (Microsoft security defaults) US$0 Disk encryption (BitLocker on Windows Pro) US$0 | | Value (US$) | | --- | --- | | Password manager (Bitwarden Teams) | 1,200 | | Patching (Action1, up to 200 endpoints) | 0 | | MFA (Microsoft security defaults) | 0 | | Disk encryption (BitLocker on Windows Pro) | 0 | Source: Bitwarden business pricing; TechBag Action1 page; Microsoft Learn (security defaults, BitLocker) · as of September 2026 · Assumes Windows Pro laptops and a Microsoft 365 or Entra tenant; training and insurance are not priced Encryption matters for a reason that has nothing to do with hackers: laptops get lost. A lost laptop with an encrypted disk is a hardware cost; without encryption it can be a reportable breach of every customer record on it. One practical detail decides whether BitLocker helps or hurts: the recovery key. Microsoft documents that on devices joined to Microsoft Entra ID the key is backed up to the directory automatically.[6] On a laptop set up with a local account, it is not, and a forgotten PIN becomes a lost disk. TechBag countTechBag count 25 users × US$4 × 12 months = US$1,200 a year for Bitwarden Teams; US$1,800 on its Enterprise plan at US$6. The other three are zero only if the laptops run Windows Pro: a machine bought with Windows Home gets device encryption on qualifying hardware, not managed BitLocker. The Verizon report adds one warning for the free measures. Only 23% of third-party organisations fully fixed missing or weak MFA on their cloud accounts, and resolving half of all weak-password and permission findings took almost eight months.[1] Switching a control on is cheap; checking that it stayed on is the work. ## Training and insurance: what the money is for People remain part of most breaches: the human element appears in 45% of small-business breaches and 62% of all breaches. The report finds that simulated attacks by voice call or text message drew a 40% higher median click rate than email, so a training course that only covers suspicious emails is a 2023 course.[1] Training a 25-person company does not need a platform. It needs two rules everyone can repeat. First, no payment, bank-detail change or password reset is ever approved on the strength of a call, a text or a WhatsApp message alone; it is confirmed by calling back on a number already on file. Second, anyone who clicks something odd reports it at once and is thanked for it. A simulated phishing tool adds measurement, and is worth buying once the two rules are habit. **Figure: Ransomware is now in nearly half of all breaches, and most victims do not pay** *Share of breaches involving ransomware, and of ransomware victims who did not pay, %, DBIR 2026 dataset* 48% Breaches involving ransomware Up from 44% 69% Ransomware victims who did not pay Median ransom paid US$139,875, down from US$150,000 Source: Verizon, 2026 DBIR Executive Summary · as of 19 May 2026 Read the second grid with its note. Fewer victims pay, and those who do pay less. Our reading, which the report does not state, is that backups and recovery plans are working for more organisations. For a small company the lesson is that the ransom is rarely the largest cost; the days without systems are. A tested backup, restored at least once, is the control that turns a ransomware incident from a crisis into a bad week. In the worst 2.5% of small-business cases, losses ran to over 7% of revenue, and that is the case for cyber insurance: Verizon’s Breach Impact Study drew on about 70,000 insurance claims.[2] We found no published premium for an Indian small-business cyber policy; insurers quote. Our view is that insurance belongs last on the list, not because it is unimportant but because an insurer prices the risk you carry, and the three free controls above are the cheapest way to lower it before you ask for a quote. If you are buying this in India **What it costs in rupees.** Bitwarden and most security tools list in US$; bought through an Indian reseller, 18% GST is added.[7] For 25 users the password manager is US$1,200 a year, US$1,416 with GST. The other three measures need no new licence if the company already runs Windows Pro and Microsoft 365. TechBag quotes Bitwarden’s alternatives and Action1’s paid tiers in INR with GST. **What the law already asks.** CERT-In’s Directions of 28 April 2022 apply to body corporates of every size: a reportable incident goes to CERT-In within six hours, and ICT logs are kept for 180 days within India.[8] The DPDP Rules, notified on 13 November 2025, bring the duty to take reasonable security safeguards for personal data into force on 13 May 2027.[9] The 2023 Act’s schedule allows a penalty of up to ₹250 crore for failing to take those safeguards.[10] Encryption, access control and logs are exactly the controls in this piece; a firm that does them now is not rebuilding in 2027. How we did this Figures as of 30 September 2026 Breach figures are from Verizon’s 2026 DBIR Executive Summary (published 19 May 2026; dataset October 2024 to November 2025) and its SMB infographic, which also cites the 2026 Breach Impact Study (16 June 2026); the full report was not read. “Small and mid-sized businesses” is Verizon’s segment, not ours, and is global, not Indian. Initial-access shares are of breaches where the vector is known. Bitwarden’s prices come from an archived copy of its business pricing page dated 22 September 2026; Action1’s free tier from TechBag’s Action1 page as it stood in September; Microsoft’s licensing statements from the two Microsoft Learn pages cited. The annual costs are TechBag arithmetic at list price. No Indian cyber-insurance premium was found, so none is given. The 2023 post’s statistics were not carried over. Spotted an error? Write to us; corrections are published at the foot of the piece. Sources 1. [Verizon, 2026 Data Breach Investigations Report, Executive Summary (SMB table p. 16; key findings pp. 9 to 11)](https://www.verizon.com/business/resources/executivebriefs/2026-dbir-executive-summary.pdf) — 19 May 2026 2. [Verizon, Cybersecurity insights for SMBs (2026 DBIR and Breach Impact Study infographic)](https://www.verizon.com/business/resources/infographics/2026-dbir-bis-smb-revenue-losses.pdf) — 16 June 2026 3. [Bitwarden, business pricing (archived copy)](https://bitwarden.com/pricing/business/) — 22 September 2026 4. [TechBag, Action1 vendor hub (free for the first 200 endpoints)](https://www.thetechbag.com/action1) — September 2026 5. [Microsoft Learn, Security defaults in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults) — 21 July 2025 6. [Microsoft Learn, BitLocker overview (edition and licensing requirements)](https://learn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/) — 24 August 2026 7. [India Briefing, GST on online information and database access services](https://www.india-briefing.com/news/tax-digital-services-oidar-in-india-gst-applicability-and-compliance-22465.html) — updated 29 September 2023 8. [CERT-In, Directions under section 70B(6) of the IT Act](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022 9. [DPDP Rules 2025, commencement timeline](https://legismith.com/dpdp-rules-2025-timeline/) — notified 13 November 2025 10. [Digital Personal Data Protection Act, 2023, Schedule (penalties)](https://www.meity.gov.in/data-protection-framework) — 11 August 2023 Related on TechBag: the [RMM and patch management guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) compares the patching tools; the [IAM, SSO and MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) covers what comes after security defaults. **Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view. Go deeper on TechBag - [RMM and patch management guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) — the patching tools compared, Action1 among them - [IAM, SSO and MFA guide](https://www.thetechbag.com/browse/identity-access/iam-sso-mfa) — what comes after Microsoft security defaults - [Action1 vendor hub](https://www.thetechbag.com/action1) — cloud patching, free for the first 200 endpoints