Cyberattacks on Small Businesses: Situation, Entry Points, First Protections

Why cyberattacks affect small businesses too

Many owners consider their business of no interest to hackers. There are no state secrets and no millions in the account. This assumption misjudges how most attacks work. They do not target a specific company but any open door. Automated tools scan the internet for outdated software, stolen passwords, and careless clicks. Whoever is vulnerable will be found.

This article therefore asks: How great is the danger for small businesses really, where do attackers typically get in, and which measures pay off first? To answer it, we first look at the situation in figures, then at the typical entry points, present a thinking model, weigh two readings on the role of employees, and finally derive an order for protective measures.

What is the situation? The figures for Germany

Every year, the digital association Bitkom surveys companies about data theft, espionage, and sabotage. For the 2026 study, presented on August 26, 2026, together with Germany's domestic intelligence service, 1,003 companies with at least ten employees and at least one million euros in revenue were surveyed by phone.

Bitkom estimates total damage from data theft, espionage, and sabotage in 2026 at 211 to 271 billion euros, around 76 percent of it from cyberattacks. This is an extrapolation from respondents' statements, not a verified damage calculation. Those affected named organized crime as the most common group of perpetrators. In the previous year's study, 34 percent of companies said they had been hit by ransomware, and IT security accounted on average for 18 percent of the IT budget. Bitkom and the Federal Office for Information Security (BSI) recommend 20 percent.

How well small businesses are positioned digitally overall is discussed in Digitalization of small and mid-sized businesses in figures.

How do attackers get into a small business?

Most attacks exploit not sophisticated gaps but everyday weaknesses. An entry point is the route by which an attacker first gains access. Four routes are particularly typical for small businesses.

A special case is fraud using a fake identity. An email, or now also a call with an imitated voice, demands an urgent transfer or a changed bank account. No technology helps here, but a firm rule does: changes to bank details and unusual payments are always confirmed via a second, known channel.

The thinking model: the Swiss cheese model

In 1990, the British psychologist James Reason described a model used to explain accidents in complex systems, from aviation to medicine. Every safeguard is like a slice of Swiss cheese: it has holes. Damage only occurs when the holes in several slices happen to line up and a hazard passes through all of them.

Applied to IT security, this means that no single measure is perfect. Training does not prevent every click, antivirus software does not detect every piece of malware, the backup may be three days old. Together, however, they make it unlikely that an attack gets all the way from the first email to a standstill of the business. The analogy is in the name: one slice of cheese is full of holes; a stack of several slices hardly is.

Security does not come from one perfect measure but from several imperfect ones whose gaps do not line up.

For a small business, this is good news. It does not need a security operations center, but a few simple layers that are reliably maintained.

Two readings: are people the weak point?

It is often said that people are the weakest link in IT security. The recommendation that follows is to train above all. Research partly supports this view but also shows its limits.

Baillon, de Bruin, Emirmahmutoglu, and colleagues (2019) conducted a field experiment with 10,929 employees of a Dutch ministry. They sent a fake email asking recipients to enter their password. One group had previously received information about phishing, a second had earlier experienced a fake email with feedback, a third had both, and a fourth had neither.

Both measures had a clear effect, but the combination added hardly anything. The authors consider it difficult to bring the share well below 10 percent with simple measures. In another field experiment, Kim, Lee, and Kim (2020) found that trained employees fell for phishing less often and that employees in higher positions were more likely to fall for it. Yin, Mullarkey, de Vreede, and colleagues (2026) point out that immediate feedback after a wrong click works well in the lab, but more weakly in field studies and in some cases even in reverse.

I consider the second reading the sounder one. Training pays off; its effect is documented. But anyone who expects nobody to click any more is planning against the evidence. The security plan must assume that someone will click and ensure that this does not lead to a standstill.

First protective measures: an order for small businesses

From the model and the findings, I derive an order that I call the five-layer sequence. It begins with what makes an attack survivable and ends with what makes it less frequent.

1. A backup the attacker cannot reach

   Back up important data regularly so that at least one copy is not permanently connected to the network. Test once a quarter whether restoring works. A backup that has never been tested is a hope.

2. Two-factor login

   Turn on a second confirmation, for example via an app, for email, bank access, accounting, remote access, and cloud services. A stolen password alone is then no longer enough.

3. Updates and a device list

   Keep a list of all devices and programs, including routers and point-of-sale systems, and activate automatic updates. Remove whatever nobody uses any more.

4. Rules for payments and bank details

   Changes to bank details and unusual transfers are always confirmed via a second, known channel, even if the request seems to come from the boss.

5. Training and a reporting route

   Explain typical deceptions to the team and set up a simple way to report suspicious messages. Praise for a report achieves more than blame for a click.

A checklist for these steps helps you not to forget them, as Checklists in the business describes. The fewer tools in use, the smaller the attack surface, one more reason to reduce tool sprawl.

Scope and limits

Today, a cyberattack is less a question of if than of when. The decisive factor is therefore not only defense but the ability to keep working after an attack. That is part of entrepreneurial resilience, as Entrepreneurial resilience describes. If customer data leak during an attack, reporting obligations under data protection law apply as well, which Data protection in sales explains for the sales context.

The limits of the figures are clear. The Bitkom study surveys companies with ten or more employees and extrapolates damage from their statements. The field experiment took place in a ministry, not in a trade business. The direction is nevertheless clear and fits the thinking model: attacks are frequent, people make mistakes, and several simple layers limit the damage.

Conclusion: the danger is real, the first steps are simple

To the guiding question: the danger for small businesses is great. In the Bitkom survey, two thirds of companies confirmed a successful attack, and the typical entry points are everyday ones: fake emails, weak passwords, outdated software, open remote access. Training helps but is not enough on its own. According to the Swiss cheese model, the layers that pay off first are those that make an attack survivable: a tested backup, two-factor login, updates, and firm rules for payments.

• Check whether there is a backup that is not permanently connected to the network, and test a restore.
• Turn on two-factor login for email, bank, and accounting.
• Create a list of all devices and programs and activate automatic updates.
• Introduce the rule that changes to bank details are always confirmed by phone via a known number.
• Print and file an emergency page with phone numbers.