A new report from Coalition Insurance highlights a troubling gap between cybersecurity awareness and action among small and midsize businesses. According to their June 2025 survey of 1,000 companies, the majority are aware of cyber threats but lack even basic protections. This contradiction puts countless businesses at ongoing risk.
Eighty percent of respondents said they are aware that cybercrime is a threat to their operations. Nearly eight in ten reported having already experienced a cyber incident. Yet over sixty percent still believe their size makes them an unlikely target. This misconception is costly. From phishing and ransomware to credential theft and data breaches, small businesses are now prime targets for cybercriminals who exploit their limited resources and weaker defenses.
The financial damage from a single cyberattack can be devastating. Coalition's data shows that a successful breach can cost anywhere from $800 to over $600,000. For many small businesses, even a minor disruption can lead to prolonged downtime, lost customers, or permanent closure.
Despite the stakes, almost half of small businesses have no formal cybersecurity strategy. Fewer than forty percent use basic security tools like multifactor authentication or endpoint monitoring. Budgets are limited, and many owners remain unsure about where to begin.
To address this gap, U.S. federal agencies like CISA and the FCC are offering free tools and checklists designed specifically for small businesses. These include vulnerability scans, basic hygiene assessments, and step-by-step plans to improve digital defenses. Yet adoption remains low.
Cybersecurity experts agree that small steps can offer big protection. Regular software updates, strong password policies, and employee training can block the most common attacks. Cloud-based backups and secure communication protocols add additional layers of protection.
The message for small business owners is simple. You may not be able to prevent every threat, but you can dramatically lower your risk. Awareness is no longer enough. Now is the time for action.