Cyber attacks are now a business risk for every organisation, from global banks to one-person online shops. This November 2026 refresh uses the latest official and industry research to explain the trends that matter most, and gives a practical checklist for small and mid-sized businesses in the US, UK, Canada, the EU, the UAE and India. We’ve replaced older unsourced statistics with figures from named reports.
The numbers that matter
| Finding | Source |
|---|---|
| The global average cost of a data breach reached a record $4.99 million, up 12% on the year. | IBM Cost of a Data Breach Report 2026 |
| The US average was $11.5 million, the highest of any country or region. | IBM 2026 |
| About one in four malicious breaches were AI-enabled, costing about $6 million on average. | IBM newsroom, July 2026 |
| Organisations using AI and automation in security saved an average of $1.93 million per breach. | IBM 2026 |
Figures are averages for organisations studied in the report, not predictions for any single business, but they show why prevention pays.
Seven trends to watch
1. AI on both sides
Attackers use generative AI to write convincing phishing emails in any language, clone voices for “CEO fraud” calls and speed up finding vulnerabilities. Defenders use AI to triage alerts, detect anomalies and automate response. The practical result: phishing that looks perfect, so staff training must focus on process (verify payment changes by phone) rather than spotting typos.
2. Ransomware and extortion
Ransomware remains one of the most damaging threats. Many gangs now steal data before encrypting it and threaten to leak it. Tested offline backups are the single most important defence.
3. Identity is the new perimeter
Stolen passwords and session tokens are a top way in. Multi-factor authentication (MFA) is essential, and phishing-resistant methods such as passkeys and security keys are becoming mainstream across Google, Apple and Microsoft accounts.
4. Zero trust
“Never trust, always verify”: every user and device is checked before accessing each resource, rather than trusting everything inside the office network.
5. Supply-chain and third-party risk
Attacks on software vendors, managed service providers and SaaS platforms can affect thousands of customers at once. Know which suppliers can access your data.
6. Securing AI and non-human identities
As companies deploy AI agents and automations, the API keys and service accounts they use become targets. IBM’s 2026 report found fewer than half of organisations were securing these non-human identities.
7. Stricter regulation
Incident-reporting deadlines and security duties are tightening worldwide (see the table below).
Regulations by region
| Region | Key rules |
|---|---|
| US | Public companies must disclose material cyber incidents on Form 8-K, generally within four business days of determining materiality (SEC). State breach-notification laws apply to personal data. |
| UK | UK GDPR requires reporting personal-data breaches to the ICO within 72 hours where required. The Cyber Security and Resilience Bill is set to extend NIS-style duties. |
| EU | NIS2 expands cybersecurity obligations to many more sectors; DORA has applied to financial entities since 17 January 2025; GDPR 72-hour breach reporting. |
| Canada | PIPEDA requires reporting breaches that create a real risk of significant harm to the Privacy Commissioner and affected people. |
| UAE | Federal data protection law, sector rules, and guidance from the UAE Cyber Security Council. |
| India | CERT-In directions require reporting of specified incidents within six hours; the DPDP Act, 2023 adds data-breach duties as its rules take effect. |
Small-business security checklist
- Turn on MFA everywhere, starting with email, banking, accounting and admin accounts. Prefer passkeys or authenticator apps over SMS.
- Back up critical data with at least one offline or immutable copy, and test restores.
- Patch operating systems, browsers, routers and plugins promptly; turn on automatic updates.
- Use a password manager for unique passwords.
- Verify payment changes by calling a known number, never by replying to the email.
- Limit admin rights and remove access for leavers on their last day.
- Protect endpoints with reputable endpoint protection and device encryption.
- Train staff briefly and often, including on deepfake voice and video scams.
- Have an incident plan: who to call, how to isolate systems, and reporting deadlines.
- Consider cyber insurance, but read the exclusions and security requirements.
What to do in the first 24 hours of an incident
- Contain: disconnect affected devices from the network, but don’t wipe them; you may need evidence.
- Secure accounts: reset passwords and revoke sessions for compromised accounts, starting with email and admin accounts.
- Call for help: contact your IT provider, insurer’s incident line or a specialist responder.
- Check reporting duties: regulators may need to hear within hours or days (for example six hours to CERT-In in India, 72 hours under GDPR).
- Communicate carefully: tell staff what to do, and prepare honest updates for customers once facts are clear.
- Report crime: to the police or national cyber agency, such as Action Fraud/Report Fraud in the UK or the FBI’s IC3 in the US.
Deepfakes: a real example
In early 2024, engineering firm Arup confirmed that an employee in its Hong Kong office was tricked into transferring about US$25 million after a video call in which the “colleagues” were deepfakes. The lesson for any business is that seeing and hearing a person on a call is no longer proof of identity. Agree code words or call-back procedures for high-value payments, and require two people to approve them.
Free official resources
- US: CISA guidance for small businesses
- UK: NCSC Small Business Guide and the Cyber Essentials scheme
- Canada: Canadian Centre for Cyber Security
- EU: ENISA
- India: CERT-In
Pros and cons of outsourcing security
- Pros: access to 24/7 monitoring and expertise you can’t hire in-house.
- Cons: cost, and your provider becomes a supply-chain risk itself; check their own security and contracts.
FAQ
What’s the single most effective step for a small business?
Turning on MFA for email and financial accounts, closely followed by reliable offline backups.
Are small businesses really targeted?
Yes. Automated attacks hit everyone, and smaller firms often have weaker defences.
Should we pay a ransom?
Law-enforcement agencies advise against it. Payment doesn’t guarantee recovery and may breach sanctions rules. Get legal advice and report the incident.
