If you have ever read an article about small business cybersecurity, you have almost certainly seen this statistic: 60 percent of small businesses that suffer a cyberattack close within six months. It is one of the most widely repeated numbers in the entire industry. It is also, according to the organization most commonly credited as its source, completely made up. The National Cyber Security Alliance officially confirmed in 2022 that they never produced this statistic and cannot verify where it originated, and they now recommend against its continued use.
This matters for more than just fact-checking. If the scariest, most motivating number in small business security is fabricated, it raises a genuinely useful question: what does the real data actually say, and what should you actually do about it? This article answers both.
What the Real Data Actually Shows
The honest picture, using figures that come from credible, named sources rather than an uncredited viral statistic, is still serious — just differently shaped than the fake number suggests.
Verizon's Data Breach Investigations Report, one of the most respected primary research publications in the security industry, found that small businesses receive targeted malicious email at a higher rate than any other organization size category — roughly one in every 323 emails sent to a small business is a targeted attack. IBM's Cost of a Data Breach Report puts the average breach cost for businesses with fewer than 500 employees at approximately 3.31 million dollars, though this figure blends a wide range of company sizes within that band, so it is not a precise prediction for a genuinely small operation — the real, honest takeaway is the direction, not the exact number: breaches are expensive, disproportionately so for a business without dedicated security staff to absorb the disruption.
Separately, IBM's own research found something worth taking seriously in the opposite direction — having a tested incident response plan in place before an attack happens saves an average of 2.66 million dollars per breach compared to not having one. That is one of the more concrete, actionable findings in this entire space: the plan itself, not just the technology, measurably changes the outcome.
Why Small Businesses Are Genuinely Targeted, Not Just Unlucky
There is a common assumption that cybercriminals only bother with large, valuable targets. The actual incentive structure works differently. Small businesses typically have weaker defences, less security staff, and less formal training than larger organisations, while still holding real value — customer payment data, vendor banking details, access to larger partners' systems. That combination of genuine value and comparatively weak defence is precisely what makes small businesses attractive rather than overlooked.
This is worth internalising because the most common security failure in small businesses is not a sophisticated attack outsmarting good defences — it is the absence of basic defences in the first place, because "we're too small to be a target" felt like a reasonable assumption. The data above suggests the opposite is closer to true.
The Fundamentals That Actually Matter
Multi-factor authentication on everything that supports it. A password alone is a single point of failure — if it leaks, whoever has it has full access. Multi-factor authentication requires a second proof of identity, typically a code from your phone, meaning a leaked password alone is no longer enough to get in. This is widely regarded as one of the single highest-value security measures available, precisely because it is cheap or free and blocks an enormous share of account-takeover attempts.
Backups that are genuinely separate from your main systems. A backup that lives on the same network as everything else can be encrypted or destroyed in the same incident as the systems it was meant to protect. A real, working backup strategy keeps at least one copy properly isolated — offline, or on a separate system an attacker who breaches your main network cannot also reach.
Basic employee awareness of phishing. Since email remains the most common way attackers get an initial foothold, teaching your team what a suspicious email looks like — an unexpected request to change payment details, urgency designed to prevent careful thought, a link that does not match the sender it claims to be from — is a low-cost measure with a genuinely high return.
A written incident response plan, even a simple one. As the IBM figure above shows, this is not just a compliance formality. Knowing in advance who to call, what to isolate, and what to communicate to customers measurably shortens and cheapens a real incident compared to figuring it out for the first time while it is actively happening.
Keeping software and systems updated. A large share of successful attacks exploit known vulnerabilities that already have a published fix — the failure is not the vulnerability existing, it is the fix not being applied yet.
Common Mistakes Worth Naming Directly
Assuming "we're too small to matter." As covered above, this is the specific misconception that makes a business an easier target, not a safer one.
Treating cybersecurity as a one-time project rather than an ongoing practice. A firewall configured once, three years ago, with no review since, is not the same thing as active security — threats, software, and your own business all change continuously.
Sharing sensitive information with AI tools without checking their data terms. Our explanation of the 2023 Samsung ChatGPT incident covers this specific, growing risk in detail — it is a genuinely modern version of the same underlying problem, sensitive data leaving your control without anyone having decided that was acceptable.
No backup testing. A backup that has never actually been restored is a backup you are assuming works, not one you know works. This distinction matters enormously the one time you actually need it.
Cybersecurity Basics — Quick Reference
| Measure | Cost | Effort | Impact |
|---|---|---|---|
| Multi-factor authentication | Free to low-cost | Low | High — blocks most account-takeover attempts |
| Isolated, tested backups | Low ongoing cost | Medium | High — the difference between an incident and a disaster |
| Employee phishing awareness | Low | Low-Medium | High — email is the most common initial attack path |
| Written incident response plan | Free (your own time) | Medium | High — IBM found this saves an average of $2.66M per breach |
| Regular software updates | Low | Low | Medium-High — closes known, already-published vulnerabilities |
Case Study: A Distribution Business in Nagpur
A distribution company in Nagpur, roughly 40 employees, running its inventory and accounting systems on a small local network with no dedicated IT staff.
The situation. The business had never experienced a security incident and, like many small businesses, had no formal cybersecurity budget or plan — the general assumption was that a mid-sized regional distributor simply was not the kind of target attackers bothered with.
What changed. After a supplier in the same industry was hit by a phishing-driven payment fraud incident — an employee was tricked into changing a vendor's bank account details based on a convincing but fake email — the Nagpur business took two low-cost, high-impact steps: enabling multi-factor authentication across email and accounting software, and running a short, practical staff session on recognising exactly this kind of payment-detail-change scam.
The outcome. Within weeks, an employee correctly identified and reported a nearly identical fraud attempt targeting their own accounts payable process, based directly on what the training had covered.
The lesson. Neither measure was expensive or technically complex. The value came from treating a nearby, realistic incident as a genuine warning rather than something that happens to other kinds of businesses.
Common Questions
Is the "60% of small businesses close within six months" statistic completely fake? The organisation most commonly cited as its source, the National Cyber Security Alliance, officially confirmed in 2022 that they never produced this statistic and could not verify its origin. It should not be treated as a real, sourced figure, even though it continues to circulate widely.
If that famous statistic is false, does that mean small business cybersecurity risk is overstated? No — the real, credibly sourced data still shows small businesses facing serious, disproportionate risk, including being targeted with malicious email at a higher rate than any other business size category. The fake statistic being debunked does not mean the underlying concern is exaggerated, only that this particular number should not be the one used to make the case.
What's the single highest-value security measure for a small business with almost no budget? Multi-factor authentication is generally considered the strongest return for the lowest cost, since many platforms offer it for free and it blocks a large share of account-takeover attempts even when a password has already leaked.
Do we need a dedicated IT security person to do any of this properly? Not for the fundamentals covered here. Multi-factor authentication, tested backups, basic phishing awareness, and a written response plan are all achievable without specialised security staff, though a growing business handling genuinely sensitive data may eventually benefit from dedicated expertise.
How often should a cybersecurity plan actually be reviewed? At minimum, treat it as an annual review, but any significant change — new software, new staff with system access, a notable incident at a similar business in your industry — is a reasonable trigger to revisit it sooner rather than waiting for the calendar date.
Key Takeaways
The most widely repeated statistic in small business cybersecurity — that 60 percent of attacked businesses close within six months — was officially disavowed by its most commonly cited source in 2022 and should not be treated as real data.
The genuinely credible data, from sources like Verizon's Data Breach Investigations Report and IBM's Cost of a Data Breach Report, still shows small businesses facing real, disproportionate risk — including being targeted with malicious email at the highest rate of any organisation size category.
The fundamentals that actually matter are not expensive or highly technical: multi-factor authentication, genuinely isolated and tested backups, basic phishing awareness, and a written incident response plan — the last of which IBM's own research found saves an average of 2.66 million dollars per breach compared to having no plan at all.
The most common real failure is not a sophisticated attack defeating strong defences — it is the absence of basic defences, often justified by the assumption that a small business is not a worthwhile target, which the data suggests is precisely backwards.
If you're trying to work out where your business's actual security gaps are, talk to us. We'll give you a straight, practical read — not a fear-based sales pitch built on a statistic that doesn't hold up.