A new report, Small Business Cybersecurity Awareness & Practices Survey, finds that while small and medium-sized businesses recognize cyber threats are growing and continue investing in cybersecurity, many have not consistently implemented the policies and practices needed to build long-term resilience. Based on a survey of 1,000 SMB decision-makers, the findings suggest businesses are investing in cybersecurity but often falling short when it comes to consistently implementing the policies and practices that build long-term resilience.
Rather than a lack of awareness, the report points to an execution gap. Many organizations have adopted foundational cybersecurity tools and embraced AI, but fewer have consistently implemented the policies, governance and day-to-day practices needed to strengthen cyber resilience.
Key Findings
Confidence outpaces preparedness
- 72.3% of business leaders said their organization’s cyber risk has increased or remained the same over the past year.
- Despite that, 86.3% expressed medium to very high confidence in their ability to manage cyber risk.
- While over half (56.1%) could not confidently say their organization maintained a clean security record in the past 12 months
Security implementation remains inconsistent
- 86.8% of organizations have implemented multi-factor authentication (MFA), but only 51.1% require it across all key business accounts, highlighting a gap between deploying security tools and consistently using them.
AI adoption is moving faster than governance
- 87.3% of SMBs are already using AI tools, primarily to save time and automate routine work.
- However, only 45.6% have implemented formal AI policies, leaving many employees without clear guidance around security, privacy and responsible AI use.
“Small businesses aren’t ignoring cybersecurity—they’re investing in it. But this report shows there’s a meaningful difference between having security tools and using them effectively,” said Lisa Plaggemier, Executive Director of the National Cybersecurity Alliance. “Whether it’s testing backups, enforcing multi-factor authentication across every account, or establishing clear policies for AI, resilience comes from consistently putting those practices into action. The organizations that make cybersecurity part of their day-to-day operations will be far better positioned to withstand today’s evolving cyber threats.”
The report also found that organizations that have experienced a cyber incident often report stronger cybersecurity practices—including documented incident response plans, broader use of MFA, tested backups and more frequent cyber risk reviews—suggesting many businesses strengthen their defenses only after experiencing an attack.
Together, the findings reinforce that cybersecurity resilience depends on more than deploying technology. As AI and other digital tools become increasingly embedded in business operations, organizations that pair security investments with strong governance, employee education and consistent implementation will be better equipped to manage today’s evolving cyber threats.
You can download the full report here: 2026 Small Business Cybersecurity Awareness & Practices Survey
