Most SMEs are optimistic about their cyber resilience and satisfied with their cyber security budgets
ESET, the global European cybersecurity market leader, has released its 'SME Cyber Readiness Index 2026', based on a global survey of 4,400 SME decision-makers representing organizations with between 25 and 1,000 endpoints across 13 countries in North America, Europe and Asia.
The report assesses SMBs' level of cybersecurity awareness of the industry's most pressing challenges, including the dual use of AI in generating new threats and defending against them in enterprise environments, the overall state of cybersecurity, awareness and incident response.
Data shows that 45% of SMBs have suffered a cybersecurity incident in the last 12 months, with 14% experiencing more than one. The majority of SMEs surveyed (61%) say they are seriously concerned about cyber attacks, while 75% consider cyber wars and global conflicts to be real cyber threats that can impact their business operations.
Among cyber threats, SMBs report the greatest concern about AI-based malware, although such threats currently remain rather sporadic.
Overall, the survey highlights several positive trends. Assurance and compliance requirements are driving stronger cybersecurity measures, and many SMBs have realized that the size of the organization is no protection from cyber threats. As a result, companies appear increasingly prepared to deal with attacks.
- 68% of SMBs are optimistic about their abilities to prevent attacks and 75% are confident in their cyber resilience to respond to incidents
- 65% are satisfied with the budgets allocated to cybersecurity, while a further 15% say they are "more than satisfied"
- Only 11% operate with essential/minimal cybersecurity protection.
- 87% consider employee training very important or critical to cyber resilience, with 67% holding training more than once a year
- Only 6% rely exclusively on basic awareness training programs, while a further 2% offer no cybersecurity training at all
- More than a third of SMBs investigated cyber incidents within two weeks of their occurrence
Despite these improvements, significant concerns remain. Many SMBs underestimate the severity of supply chain attacks and the risks associated with AI-based tools, including so-called “shadow AI”.
