Cybersecurity Is No Longer About Protection. It's About Survival.

Why small business cybersecurity now has to assume attackers will get in, and what to do about it.

It's 8:05 on a Monday morning. Payroll has to go out today. Your team logs in, and every screen shows the same message: your files are locked, pay up to get them back.

You can't send invoices or see your customer files. Orders stop and your email goes quiet. Your people are at their desks, getting paid to wait. And your customers are wondering why nobody is answering.

This is not far-fetched, and it's not just a big-company problem.

"Nobody wants our data." They don't need to.

Most owners we talk to say the same thing: we're a small business, not a bank. Who would want our files?

That misses the point. A kidnapper doesn't take your child because he wants to start a family. He takes your child because he knows you want your family back. Criminals don't want your spreadsheets, customer lists or payroll records. They want what you will pay to get them back, fast.

That's why small businesses are such attractive targets. You can't run without your systems, and every hour you're down costs money.

Size doesn't protect you. It makes you a target. In Verizon's 2026 Data Breach Investigations Report, 96% of ransomware victims (where the company's size was known) were businesses with fewer than 1,000 employees. Cyber insurer At-Bay, which covers about 40,000 U.S. businesses, found that companies with under $25 million in revenue saw ransomware claims rise 21% in 2025, and the average claim jump 40% to $422,000.

What changed: AI is finding the holes faster

Every published security hole in software gets an ID called a CVE. Think of it as a recall notice for a defective part. It tells the world, criminals included, that a product such as Windows, a firewall or a remote access tool has a flaw that can be used to break in. "High" and "Critical" ratings mean an attacker could take over a computer, steal data or shut systems down.

These holes aren't new. Many have been sitting in the software you use every day for years. What's new is how fast they're being found. As AI bug-hunting tools have spread, including Anthropic's Claude Mythos Preview, announced in April 2026, the number of serious flaws made public has climbed almost every month. In October 2026, 8,416 were published, nearly five times the 1,706 in October 2025. That's about 155 a day, up from 54 a day in 2025 (CRACI CVE data).

Every one of those notices is also a roadmap for criminals. The same kinds of AI tools that help researchers find flaws can also help attackers turn them into working attacks faster. Half of exploited flaws are now attacked within 80 days of being announced, down from 120 days a year earlier (VulnCheck, first half of 2026).

Why isn't traditional cybersecurity enough anymore?

Traditional security worked like a guard with a list. Block the known bad guys, fix flaws when the vendor sends a patch, and keep a strong wall around the office. That worked when threats were predictable and patches arrived on a schedule.

That world is gone. AI helps attackers find and use weaknesses faster than most businesses can fix them:

• About 23% of exploited flaws in the first half of 2026 were attacked on or before the day they were made public (VulnCheck).
• Exploiting a software flaw is now the #1 way attackers break in, at 31% of breaches in Verizon's overall 2026 dataset. Yet the typical organization took 43 days to fully fix a critical flaw (Verizon 2026 DBIR).
• 73% of ransomware attacks At-Bay saw in 2025 started through a VPN, the remote access tool many businesses use to let staff work from home or on the road (At-Bay).

To be clear: patching, firewalls, antivirus and endpoint detection and response (EDR) are still necessary, more than ever. But on their own, they are no longer enough. At-Bay found that 60% of the victims of Akira, the most active ransomware group in its 2025 claims, had a leading EDR tool in place and were still compromised. The only businesses that avoided having their systems fully locked had EDR backed by 24/7 human monitoring.

What can you actually control?

You already think about business risk this way: risk equals probability times impact. How likely is the problem, and how bad is it if it happens?

The probability side is rising, and much of it is out of your hands. You can't control how many flaws get published or how fast criminals use them. What you can control is the impact: how far an attacker gets before someone stops them.

What if you assume they'll get in?

Old-school security focused on keeping the bad guys out. Today, the smart assumption is that someday, someone will get in. The questions that matter are how fast you find them and how quickly you can shut them down.

The difference is enormous:

	Caught in minutes or hours	Found days or weeks later
What's affected	One laptop or one email account	Servers, shared files, backups, every computer
What recovery looks like	Wipe one device, reset one password	Rebuild the whole company's systems
Customers and cash flow	Business keeps running	Orders stop, invoices don't go out, payroll is late
Who gets involved	Your IT team	Forensics firm, lawyers, insurer, maybe your customers

It is much faster and cheaper to recover one workstation or one email account than your entire company. At-Bay found that 1 in 10 ransomware victims were down for more than 30 days, and that ransomware claims involving business interruption cost three times more on average.

Speed matters just as much with financial fraud, which often starts when a criminal takes over one mailbox and sends fake payment instructions. Among At-Bay's clients, the average amount stolen in financial fraud was $285,000. Companies that reported it to their insurer within three days got their money back 70% of the time. Those that waited more than 30 days recovered it just 27% of the time.

Where does a small business feel it first?

When systems go down, the damage shows up in places every owner knows:

• Payroll. Your people expect to be paid on time, attack or no attack.
• Invoicing and cash flow. If you can't bill, you don't get paid, but the bills keep coming.
• Serving customers. No access to orders, schedules or customer records means customers wait, or go elsewhere.
• Deadlines. Proposals, contracts, tax filings and month-end close don't move because you were hacked.
• Payments. One hijacked email account can send convincing fake wire instructions to your customers or vendors.
• Customers and vendors. Nearly half of all breaches (48%) now involve a third party such as a vendor or partner (Verizon). Your problem quickly becomes theirs, and so does the loss of trust.

Why does 24/7 monitoring by a SOC matter more than ever?

If attackers will eventually get in, someone has to be watching when they do. Criminals know your office is empty at night, on weekends and over holidays. That's when they strike.

A Security Operations Center (SOC) is a team of security experts watching your systems around the clock. They use software called a SIEM (security information and event management) that pulls together activity from your computers, servers, email, Microsoft 365 and firewall. It looks for warning signs that a person would miss, such as:

• A login to your bookkeeper's email from overseas at 3 a.m.
• A new rule quietly forwarding a manager's email to an outside address
• A laptop suddenly opening and changing thousands of files

When the SOC spots something, they act right away. They cut the infected laptop off from the network or lock the compromised account before the problem spreads. A bad night stays one bad laptop instead of becoming a company-wide shutdown.

It's not free. But compare it to a month without your systems or the $422,000 average claim At-Bay reported for companies under $25 million in revenue. It costs a whole lot less than the alternative.

The basics still matter too: fix security flaws fast, turn on multi-factor authentication (MFA) for every account, keep backups criminals can't delete and test them, and have a written plan for what to do on a bad day.

Questions to ask your MSP or IT department

Ask these this week. Clear, confident answers are a good sign. Hesitation is a warning.

• Who is watching our computers and email at 2 a.m. on a Saturday? A person, or just software?
• Do we have a SOC using a SIEM that watches our computers, servers, Microsoft 365 and firewall together?
• If someone logged into one of our employees' email accounts right now, how fast would you know, and what would you do?
• Can you cut off an infected laptop within minutes, even if it's at an employee's home?
• If one laptop gets infected, what stops the attacker from reaching our accounting, customer and shared files?
• When a critical security fix comes out, how many days until it's installed on our firewall and VPN?
• Is MFA turned on for every account, including administrators and email on phones?
• When did we last restore from backup as a test? Could ransomware delete those backups?
• If we got hit on payroll day, how would we still pay our people on time?
• If we were hit tomorrow, how many days would we be down?

The bottom line

AI is helping criminals find and exploit security holes faster than ever, and they know small businesses can't afford to stop working. Keeping attackers out is still the first line of defense, but it's no longer the whole plan. The companies that come through an attack are the ones that catch it early, contain it fast and get back to work.

Cybersecurity is no longer about protection. It's about survival.

Fairoaks IT helps small businesses find their gaps, put 24/7 monitoring in place and plan for the day something gets through. If any of the questions above made you uneasy, book a breach-readiness conversation or contact us.

Fairoaks IT, in business since 1991, provides IT support for Eastern Massachusetts, Rhode Island, and Charlotte, NC.

Frequently asked questions

Why do criminals target small businesses if they don't want the data?

They want what the business will pay to get its systems back. Small businesses can't run without those systems, and every hour of downtime costs money. In Verizon's 2026 Data Breach Investigations Report, 96% of ransomware victims (where the company's size was known) had fewer than 1,000 employees.

How many serious software security holes are being published now?

Many of these holes have been in everyday software for years; what's new is how fast they're being found. In October 2026, 8,416 high and critical CVEs were published, nearly five times the 1,706 published in October 2025. About 155 serious flaws are now published every day, up from 54 a day in 2025, according to CRACI's analysis of CVE Program data (snapshot November 13, 2026). Half of exploited flaws are now attacked within 80 days of being announced, down from 120 days a year earlier (VulnCheck, first half of 2026).

Is endpoint detection and response (EDR) enough to stop ransomware?

EDR is still necessary, but it is not enough on its own. At-Bay found that 60% of the victims of Akira, the most active ransomware group in its 2025 claims, had a leading EDR tool in place and were still compromised. The only businesses in that data that avoided a full lockup had EDR backed by 24/7 human monitoring.

How long does it typically take to fix a critical security flaw?

In Verizon's 2026 Data Breach Investigations Report, the typical organization took 43 days to fully fix a critical flaw. In the same overall dataset, exploiting a software flaw was the leading way attackers broke in, at 31% of breaches.

What is a SOC, and why does 24/7 monitoring matter for a small business?

A Security Operations Center is a team that watches a company's computers, servers, email, Microsoft 365 and firewall around the clock, usually with SIEM software. The goal is to find an attacker in minutes or hours and cut off one device or account before the incident becomes a company-wide shutdown. At-Bay found that 1 in 10 ransomware victims were down for more than 30 days, and that the average ransomware claim for companies under $25 million in revenue was $422,000.

Sources

• CRACI, CVE publication trends (CVEProject cvelistV5 data, snapshot November 13, 2026)
• At-Bay, 2026 InsurSec Report press release and the full report PDF
• Verizon, 2026 Data Breach Investigations Report
• VulnCheck, State of Exploitation, first half of 2026
• Anthropic, Claude Mythos Preview (announced April 7, 2026)