Sophos: Over 75% of Cyber Incidents Target Small Businesses

• The 2024 Sophos Threat Report highlights the disproportionate impact of cybercrime on small businesses, particularly vulnerable due to limited cybersecurity investment and a lack of experienced security personnel.
• The data analyzed in the report comes from Sophos’ X-Ops Incident Response service and its protection software for small and medium-sized businesses.
• The findings indicate that ransomware is the most significant threat to these organizations.

The 2024 Sophos Threat Report highlights the disproportionate impact of cybercrime on small businesses, particularly vulnerable due to limited cybersecurity investment and a lack of experienced security personnel. This vulnerability makes small businesses prime targets for cyberattacks, with potentially devastating consequences, including the possibility of being forced to close due to the financial strain of recovery. Despite smaller organizations’ significant contributions to global employment and economic activity, their cybersecurity risks remain largely underreported compared to larger entities.

The data analyzed in the report comes from Sophos’ X-Ops Incident Response service and its protection software for small and medium-sized businesses. In 2023, small businesses accounted for over 75% of the incident response cases handled by Sophos. The findings indicate that ransomware is the most significant threat to these organizations. However, other cyber threats, including data theft through malware, such as password stealers and keyboard loggers, are responsible for nearly half of all malware detections in small and medium businesses.

The report also outlines various methods cybercriminals use to infiltrate small business networks. These methods include web-based malware distribution, such as malvertising and SEO poisoning, and exploiting unprotected devices within organizational networks. Additionally, there has been an increase in the abuse of legitimate and malicious drivers to bypass malware defenses and a shift in email attack strategies toward more engaging and convincing social engineering tactics. Furthermore, attacks on mobile device users through scams related to third-party services and social media platforms have seen a significant rise, posing an increasing threat to individuals and small businesses.

Read the full report