Why cyber criminals see small businesses as easy pickings

When cyber attacks make the news, it’s usually a well-known brand that’s in the spotlight. But cyber criminals don’t just focus on large organisations. Many actively target smaller businesses, knowing they often have fewer resources and less protection in place. 

If you’re busy running a business, it’s easy to assume cyber crime is a problem for larger companies. However, the latest figures show that businesses of all sizes are at risk. 

The Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses and 28% of charities experienced a cyber security breach or attack in the last 12 months. That’s a reminder that cyber risk affects organisations of all sizes, including SMEs. 

For many SMEs, the consequences of a cyber incident can be particularly severe, disrupting day-to-day operations, affecting customer trust, and creating significant financial pressures. 

Why Small Businesses Appeal to Cyber Criminals 

Cyber criminals are often looking for the easiest route to a successful attack. Smaller businesses can be attractive targets because they typically have fewer resources available to invest in cyber security than larger organisations. 

That doesn’t mean you’re doing anything wrong. It’s simply the reality of running a business. 

Many SMEs: 

• Don’t have a dedicated IT department
• Have limited time to focus on cyber security
• Depend on employees wearing multiple hats
• May not have provided formal cyber awareness training
• Assume they’re too small to be targeted 

From a cyber criminal’s perspective, those factors can create opportunities. 

Cyber Attacks Often Start With Something Simple 

When people think of cyber attacks, they often picture sophisticated hackers breaking into systems. 

In reality, many attacks start with something surprisingly ordinary. 

It could be: 

• An email that appears to come from a trusted supplier 

• An invoice with bank details that have been changed 

• A message claiming to be from your bank 

• A link that takes you to a fake website that looks genuine 

These scams are designed to catch people when they’re busy, distracted or trying to deal with tasks quickly. 

And because they often look convincing, they’re effective at catching people out. 

Phishing Remains the Biggest Threat 

Phishing continues to be one of the most common ways cyber criminals gain access to businesses. 

According to the Cyber Security Breaches Survey 2025/2026, phishing attacks, staff receiving fraudulent emails or being directed to fraudulent websites, remain the most prevalent type of cyber attack, affecting 38% of businesses and 25% of charities. They are also the most disruptive breach type, cited by 69% of organisations that experienced a breach or attack. 

That’s why employee awareness plays such an important role in reducing cyber risk. Sometimes all it takes is one convincing email and one click for a business to experience significant disruption. 

The Cost of a Cyber Attack Goes Beyond Lost Money 

When a cyber incident occurs, most people immediately think about financial losses. 

And while fraud and stolen funds can certainly be costly, the wider impact can often be even more damaging. 

A cyber attack could result in: 

• Systems being unavailable and disrupting day-to-day trading 

• Loss of access to important business data 

• Customer information being compromised 

• Regulatory investigations or potential fines 

• Damage to your reputation and customer trust 

• Significant stress for you and your employees 

For many SMEs, even a short period of disruption can have a major impact on operations and revenue. 

Why Cyber Insurance Matters 

Despite the growing threat, many small businesses still don’t have cyber insurance in place. 

Often, it’s because they believe they’re unlikely to be targeted or feel cyber protection is only relevant to larger organisations. 

The reality is that cyber insurance isn’t just about helping with financial losses after an attack. It’s also about having expert support available when you need it most. 

A good policy can provide access to specialist help and practical support following a cyber incident. 

Business Interruption 

If a cyber event forces your business to stop trading, cyber insurance can help cover lost income while you recover and get back up and running. 

System Recovery and Technical Support 

After an incident, identifying the problem and restoring systems can be time-consuming and expensive. Cyber insurance can help cover those costs and provide access to specialist expertise. 

Claims from Customers and Other Third Parties 

If a data breach or cyber incident leads to legal action, cyber insurance can help with defence costs and compensation payments where cover applies. 

Regulatory Support 

Certain cyber incidents can trigger investigations by regulators. Depending on the policy, cover may help with associated costs and support throughout the process. 

Fraud and Cyber Crime Protection 

Many policies can also provide protection against cyber-enabled fraud, including social engineering scams, invoice fraud and cyber extortion. 

Perhaps most importantly, you’re not left trying to manage a crisis on your own. Having access to experienced specialists can make a huge difference when every minute counts. 

Taking Practical Steps Today Can Make All the Difference 

Cyber protection isn’t about assuming the worst will happen. It’s about being prepared if it does. 

The businesses that recover most effectively from cyber incidents aren’t always the biggest or best resourced. They’re often the ones that recognised the risk early and put sensible measures in place before a problem occurred. 

That includes combining good cyber security practices, staff awareness and appropriate insurance protection. 

In the current economic climate many businesses are being forced to examine their costs, however, with cyber threats being generally regarded as the number one risk, the question should not be whether you can afford cyber insurance, but whether you can afford not to. 

Quote from Richard Wright – Client Director – Corporate 

“I have personal experience of dealing with a Cyber claim for a company that had suffered a ransomware attack. In the absence of an insurance policy, the combined cost of forensic IT experts and weeks of business interruption would have seen a company that had been trading for 80 years having to close it’s doors”.  

How Macbeth Insurance Brokers Can Help 

Let’s face it, you’ve got enough to think about without worrying about cyber threats every day. 

That’s where we can help. At Macbeth Insurance Brokers, we’ll guide you through your options, answer your questions and help you put the right protection in place for your business. 

Because cyber insurance isn’t really about computers or technology. It’s about protecting your customers, your reputation, your income and the business you’ve worked so hard to build. 

Call 0118 923 5090 to speak to our cyber experts Theo, James or Gareth