The Cyber Threats Hitting Small Businesses in 2026
The cyber threats hitting small businesses in 2026, ranked by claims and incident data: business email compromise, session token theft, ransomware through stolen logins, spoofed internal mail, vendor compromise, unpatched edge devices, stale accounts and help desk impersonation. How each one lands, what blocks it, and a 90-day order of work.
Updated: October 2026
Attackers stopped caring about company size a while ago. A five-person firm with a Microsoft 365 tenant and a bank account is a target, and in 2026 it is often the easier one. This guide ranks the cyber threats hitting small businesses by what insurers and incident responders saw in 2025, then shows how each one lands and what blocks it.
TL;DR
- Short answer. Email fraud, meaning business email compromise and diverted payments, is the most common incident. Ransomware is the most expensive one.
- The door. Phishing, stolen sessions and reused passwords open more incidents than software bugs do.
- MFA. Still essential, and no longer enough on its own. Push prompts do not stop session token theft.
- Vendors. A supplier's breach now lands in your tenant, through their accounts and their tools.
- Start here. Phishing-resistant MFA, callback verification for payments, tested backups, patched edge devices.
How This List Was Ranked
Every ranking of "top threats" is a ranking of something. This one uses incident data, not vendor telemetry about blocked emails. Three sources carry the weight: Coalition's 2026 Cyber Claims Report, which covers insurance claims from over 100,000 policyholders through 2025; the Sophos State of Ransomware 2026 survey of 2,158 organizations that were hit; and the FBI's 2025 Internet Crime Report, released in April 2026. Verizon's 2026 Data Breach Investigations Report fills in the breach patterns.
The first thing those sources agree on: the door is a person with a login, not a bug in a server. Per Coalition's 2026 report, business email compromise and funds transfer fraud together made up 58% of cyber claims in 2025. Sophos found that email and phishing overtook exploited vulnerabilities as the way ransomware gets in. Verizon's breach data points the same way.
That changes what "security" means for a small company. Antivirus and a firewall defend the machine. The attacks that pay in 2026 go after the mailbox, the session and the person approving an invoice.
The Threat Map at a Glance
| Threat | How it lands | First sign | What blocks it |
|---|---|---|---|
| Business email compromise | Stolen mailbox session or lookalike domain, then altered invoice | A new inbox rule, a vendor "changed banks" | Callback verification, inbox-rule alerts, DMARC at p=reject |
| Session token theft | Adversary-in-the-middle phishing page relays real login, keeps the cookie | Sign-in from a new device minutes after a user signed in | Phishing-resistant MFA, token protection, conditional access |
| Ransomware | Stolen VPN or RDP credentials, infostealer logs, unpatched firewall | Mass file renames, backups deleted, new admin accounts | Immutable backups, MFA on every remote entry, EDR |
| Spoofed internal email | Microsoft 365 Direct Send, no authentication needed | Mail "from" a colleague with an external source IP | Reject Direct Send, SPF hard fail, anti-spoofing policy |
| Vendor compromise | Supplier's account or tool is breached, their access becomes the attacker's | Vendor invoice changes, odd activity from a vendor login | Vendor access inventory, MFA on partner accounts, least privilege |
| Unpatched edge devices | Known exploited bug in a firewall or VPN appliance | Appliance vendor advisory you have not read yet | Patch SLA on edge gear, no admin from the internet, replace end-of-life boxes |
| Insider mistakes and stale accounts | Departed employee still has a working login, shared passwords | Login from a former staff member's account | Fast offboarding, access reviews, no shared admin |
| Help desk impersonation | Attacker calls IT as a user, or calls a user as IT, and asks for a reset | A reset request that skips the normal channel | Identity verification before any reset, no MFA changes by phone |
1. Business Email Compromise and Payment Diversion
Business email compromise, or BEC, is fraud done through a mailbox you trust. The attacker either takes over an employee's email account or registers a domain one letter off from a supplier's. Then they wait for a real invoice to go out and send a follow-up: "Please note our new bank details."
No malware is involved, so nothing on the endpoint objects. The FBI's 2025 Internet Crime Report put BEC losses reported to it at over $3 billion for the year, second only to investment fraud. The average BEC claim is smaller than a ransomware claim, per Coalition. It is also far more frequent, and it can hit a company that has never seen a virus.
The mechanics are worth knowing because they are the detection points. After getting into a mailbox, the attacker creates inbox rules that forward or hide any message containing "invoice", "payment" or "wire". The victim sees a quiet inbox. The attacker reads everything. Weeks later, the real invoice goes out with a swapped account number, often from the real sender's address.
What blocks it is a process, not a product. Any change to payment details gets confirmed by a phone call to a number you already had on file, never one from the email. Inbox rule creation and mailbox forwarding should raise an alert the same hour. DMARC at p=reject on your own domain stops the cheapest version of the attack, the spoofed sender. The switches for that live in our guide to email security best practices.
2. Phishing That Steals the Session, Not the Password
The phishing page of 2022 asked for a password. The phishing page of 2026 sits between the user and the real Microsoft login as a reverse proxy. The user types their password into what is really the Microsoft page, approves the MFA push on their phone, and lands in their inbox as normal. The proxy keeps the session cookie that Microsoft issued after the MFA step. The attacker loads that cookie into their own browser and is signed in, no password or second factor needed.
This is adversary-in-the-middle phishing, and kits like Evilginx made it a commodity. Sophos's 2026 survey found that 97% of ransomware victims whose root cause was compromised credentials had some form of MFA enabled at the time. MFA was there. It was the wrong kind, or it was missing on the one system the attacker picked.
Three variants show up in small-business incidents:
- MFA fatigue. The attacker has the password and sends push prompts until a tired user taps approve. Number matching, where the user types a code shown on screen, ends this one.
- Device code phishing. The user is talked into entering a short code on a legitimate Microsoft page, which signs the attacker's device into the user's account. Conditional access can block the device code flow outright.
- QR code phishing. The link is an image, so the email filter has nothing to scan, and the user opens it on an unmanaged phone.
What blocks it: phishing-resistant MFA, meaning FIDO2 security keys, passkeys or Windows Hello for Business, which bind the login to the real domain so a proxy page gets nothing useful. Below that, conditional access policies that require a compliant device, and token protection where the license allows it. When a session is stolen anyway, a password reset does nothing; the session has to be revoked. The full playbook is in our guide to account takeover prevention.
3. Ransomware, Now Delivered Through Your Login
Ransomware is still the claim that costs the most, and the entry point has moved. Sophos's 2026 data puts malicious email, phishing and compromised credentials ahead of exploited software bugs. Verizon's 2026 DBIR adds the mechanism: a large share of ransomware victims had an infostealer on a device first, quietly collecting saved browser passwords and session cookies that were sold on and used later.
For a small business the typical chain looks like this. A personal laptop with the company VPN saved in Chrome picks up an infostealer from a cracked-software download. The VPN credentials, with no MFA because the appliance is old, get sold in a log bundle. Weeks later someone buys the bundle, logs into the VPN, finds a server with RDP open internally, and runs the encryptor on a Friday night. Backups go first, because the backup server used the same domain admin account as everything else. The hour-by-hour view of what follows is in our ransomware attack walkthrough.
What blocks it works at each link. MFA on every remote entry point, including the VPN and the firewall's admin page, stops the bought credential. EDR on servers catches the tools used to move sideways. Backups that an attacker with domain admin cannot delete, covered in our guide to immutable backups, turn a disaster into a bad weekend.
One more point from the claims data: Coalition reports a record share of victims refusing to pay in 2025, and credits backups and incident response plans. Refusing to pay is a decision you can only make if the backups restore.
4. Phishing From Inside Your Own Domain
A specific Microsoft 365 weakness earned its own entry because of how often it shows up in small tenants. Direct Send lets devices like printers and scanners send mail to internal recipients through the tenant's smart host without authenticating. Attackers found that anyone on the internet can use it to send mail that appears to come from a colleague, and it skips the SPF, DKIM and DMARC checks that would catch a spoof from outside.
The payload is usually a QR code or a "voicemail" link, and the sender looks like the finance manager. The r/msp thread below walks through the mechanics and the fix, and the comments cover what broke when people switched it off.
What blocks it: Microsoft added a tenant setting to reject Direct Send, set with Set-OrganizationConfig -RejectDirectSend $true. Inventory the printers and apps that relied on it first and move them to authenticated SMTP or a connector. Then set SPF to hard fail and turn on the anti-spoofing policy in Exchange Online Protection, so an internal-looking message from an external IP gets quarantined.
5. Vendor and Supply Chain Compromise
Your security is now partly your accountant's security, your payroll provider's and your IT provider's. Verizon's 2026 DBIR reports that breaches involving a third party grew sharply year over year and now account for a larger share of the total than ever. For a small business, "third party" usually means one of three things: a supplier whose mailbox was taken over and used to send you a fake invoice; a SaaS app with an OAuth grant into your tenant that got abused; or a managed service provider whose remote tools were turned against its clients.
The MSP case deserves a plain statement, because it applies to the people reading this. Remote monitoring and management tools are the most valuable target in the small-business ecosystem: one console, hundreds of companies. Guardz's 2026 MSP threat report found abuse of legitimate remote tools among the top endpoint threats it saw. If you are an MSP, your tenant and your RMM are the crown jewels. If you hire one, ask how they protect theirs.
What blocks it: an inventory of every vendor, app and person who can reach your systems, and what they can touch. MFA on partner and guest accounts, not only staff. OAuth app consent restricted to admins, with a review of existing grants. For MSP-held access, GDAP roles scoped to what the job needs instead of global admin. The method for finding what you forgot is in our guide to mapping your attack surface.
6. Unpatched Edge Devices
The firewall and VPN appliance are the one piece of infrastructure every attacker on the internet can touch. In 2024 and 2025 a run of critical bugs in SSL VPN and firewall products from several vendors went straight onto CISA's Known Exploited Vulnerabilities list, often with exploitation underway before a patch existed. Verizon's 2026 DBIR lists unpatched edge devices as one of the two ways small organizations were picked, along with compromised credentials.
The small-business version of this problem is a five-year-old appliance that nobody owns. The reseller installed it, the firmware was never updated, the admin page answers on the WAN side, and the admin password is in a spreadsheet. Attackers scan for exactly that profile and treat it as a front door.
What blocks it: an owner for every edge device, a patch window measured in days for anything on the KEV list, admin interfaces reachable only from inside or over a management VPN, and a replacement date for anything the vendor stopped supporting. Subscribe to the vendor's advisory feed, or to CISA's, so the first you hear of a bug is not the breach.
7. Insider Mistakes and Stale Accounts
Not every threat comes from outside, and not every insider is malicious. The common small-business version is a mistake with privilege attached: a shared admin password that followed a contractor out the door, a former employee whose account still works three months after they left, a finance user with global admin because it was easier in 2021.
Attackers love stale accounts because nobody is watching them. A login from a departed employee's account at 3 a.m. raises no alarm when there is no one to alarm. The warning signs and the controls that do not turn you into the workplace police are covered in our insider threats guide.
What blocks it: offboarding that disables the account the same day, a quarterly review of who has admin, no shared accounts, and a separate admin identity for the two people who need one.
8. Help Desk Impersonation
The newest entry on the list is the oldest trick: a phone call. In one direction, an attacker calls the IT help desk as an employee who "lost their phone" and asks for an MFA reset. In the other, they call an employee as IT support and talk them through installing a remote access tool or reading out a code. The groups behind the biggest retail and airline breaches of 2025 got in this way, and the technique has moved downmarket fast because it needs no exploit at all.
Fake support pop-ups belong here too. A browser page locks up, displays a phone number for "Microsoft support", and the person on the phone installs a remote tool and asks for a payment. The FBI's 2025 report counts tech support fraud as its third-largest loss category.
What blocks it: an identity check before any password or MFA reset, agreed in advance and written down, such as a callback to the number on file or a video call with a manager. No MFA changes by phone, full stop. For users, one rule: IT never calls you asking for a code, and nobody from Microsoft will ever ring.
The Controls That Cover the Most Threats
Eight threats, and a small IT team cannot buy eight products. The useful question is which controls block the most threats at once. This checklist is ordered by coverage:
- Phishing-resistant MFA on Microsoft 365 and every remote entry point. Covers BEC, token theft, ransomware entry and stale-account abuse in one move.
- Callback verification for any change to payment details. Covers BEC and vendor invoice fraud, costs nothing.
- Alerts on inbox rules, forwarding and new OAuth consents. The three earliest signs of a mailbox takeover.
- Immutable, tested backups with a restore you have timed. Turns ransomware from existential into expensive.
- Patch the edge within days and pull admin pages off the internet.
- Reject Direct Send, DMARC at p=reject, SPF hard fail. Closes the spoofing routes.
- Same-day offboarding and a quarterly admin review. Closes the stale-account door.
- A written reset procedure that no help desk call can talk around.
Nothing on that list needs a security operations center. It does need someone to own it. An MSP or an in-house admin running OpenFrame can check patch state and admin membership across a client's devices with a script run from one place, output collected, which is how the "who still has an old firewall" question gets answered without a spreadsheet.
A 90-Day Order of Work
Weeks one and two: turn on number matching or passkeys for every user, enforce MFA on the VPN and firewall admin, and write the callback rule for payments. Send it to whoever pays invoices.
Weeks three to six: inventory vendor and app access, revoke what nobody recognizes, restrict OAuth consent to admins. Reject Direct Send after moving the printers. Move DMARC to p=reject.
Weeks seven to twelve: test a full restore from backup and time it. Patch or replace the edge device. Run a tabletop on the BEC scenario with finance in the room, using the run sheet from our tabletop exercise guide. Then schedule the quarterly admin review and put it in someone's calendar.
The threats on this list share a shape: a person with a login, a message that looks normal, and a process that trusted the message. Fix the login, verify the money, and keep a backup nobody can delete. That covers the attacks that paid in 2025, and the ones coming in 2026 look the same, only faster. Next, read how to layer those controls so one failure does not become a breach.
When one of them lands anyway, the first hour is scripted in our incident response plan.
Content Marketing Lead
Ohayo! I run content, SEO, social, and community at Flamingo. Before IT, I worked as a correspondent for Ukraine's Public Broadcasting Company and have a Master's in journalism.