5 weaknesses hackers exploit in your SME

Think you're too small to interest a hacker?

That's exactly what they're hoping. In the Verizon DBIR 2026, around 96% of ransomware victims whose size was known were SMEs (fewer than 1,000 employees under Verizon's definition). These attacks are often opportunistic: industry and turnover matter little; an open door does.

In Belgium, the CCB received 635 incident notifications in 2025, around 70% more than in 2024. Part of the rise comes from new reporting obligations, but pressure remains high across all sectors.

Here are the 5 doors you may be leaving open.

5 entry points you're leaving open

1. Reused passwords. Is your work password the same as your Netflix one? A single leak is enough. Tools automatically test stolen credentials on other services. In ransomware attacks on SMEs, Verizon found that victims often had already compromised credentials (38%). Use a password manager and a unique password for every account.

2. No MFA. Without multi-factor authentication, a stolen password gives full access to your systems. According to a Microsoft study, MFA cuts the risk of account compromise by more than 99%. Microsoft 365 and Google Workspace include it at no extra cost. A few minutes per account.

3. Unpatched software and equipment. Every ignored update is an open door. Attackers track published vulnerabilities and target those who lag behind. In ransomware attacks on SMEs, Verizon points to unpatched edge devices (VPNs, firewalls, routers) in 29% of cases. Turn on automatic updates and inventory what is reachable from the internet.

4. Backups that have never been tested. Having a backup is good. Having tested it is better. When did you last run a restore test? If the answer is "never", you don't have a backup, you have a hope. Apply the 3-2-1 rule: three copies, two different media, one copy off-site and offline.

5. No staff awareness. According to Verizon, the human element is involved in 45% of SME breaches (62% across all organisations). A firewall won't stop a click on a malicious link. KnowBe4's data shows that regular training and simulations cut click rates by more than 40% within 90 days.

Our free cyber diagnostic checks your exposure in a few minutes. We then deliver lunch & learns, half-days or conferences to train your teams on the ground.

Take action

Every door you close cuts your risk significantly.

• Test your exposure with our free cyber diagnostic
• Audit your infrastructure: request a personalised audit & roadmap
• Train your teams with our Cyber Awareness training