SMEs are now prime targets in global cybercrime escalation

The study highlights a stark reality: SMEs are now disproportionately affected by cybercrime despite contributing significantly to national employment and economic stability. The review underscores that most SMEs operate with limited cybersecurity infrastructure due to financial constraints, lack of trained personnel and insufficient awareness of emerging risks. These weaknesses make them attractive targets for threat actors seeking maximum impact with minimal resistance.

Small and medium enterprises (SMEs) across the world are facing an unprecedented wave of cyber threats as digital dependence grows and attackers sharpen their methods. A new comprehensive research review shows that these firms, which make up the backbone of most economies, are now primary targets for cybercriminals exploiting gaps in preparedness, awareness and investment. The findings indicate an escalating crisis, with many firms lacking the defensive capabilities needed to withstand increasingly sophisticated attacks.

The study, titled “Cybersecurity Threats and Defensive Strategies for Small and Medium Firms: A Systematic Mapping Study,” published in Administrative Sciences, examines a decade of global research to understand the evolving cyber threat landscape facing SMEs and the measures available to strengthen their defenses. It synthesizes evidence from 73 peer-reviewed studies selected from an initial pool of 671 publications, offering one of the most extensive analyses of SME cybersecurity vulnerabilities, attack patterns and mitigation strategies to date.

Small firms emerge as prime targets as cyber threats intensify

The study highlights a stark reality: SMEs are now disproportionately affected by cybercrime despite contributing significantly to national employment and economic stability. The review underscores that most SMEs operate with limited cybersecurity infrastructure due to financial constraints, lack of trained personnel and insufficient awareness of emerging risks. These weaknesses make them attractive targets for threat actors seeking maximum impact with minimal resistance.

The research identifies ten dominant cyber threat categories repeatedly affecting SMEs worldwide. Phishing and social engineering attacks are the most common and damaging, exploiting human error and limited training. Ransomware remains a leading threat due to its high-profit potential for attackers, often crippling businesses that lack the resources to recover quickly. Malware intrusions, insider threats, business email compromise, weak password practices, data breaches and supply-chain vulnerabilities account for a large portion of SME incidents.

The review also shows that SMEs are increasingly implicated in broader cyber campaigns. Attackers often compromise smaller vendors as entry points to larger organizations, raising the threat level for firms integrated into complex supply chains. The systemic consequences extend beyond individual businesses, with disruptions spreading across industries, sectors and, in some cases, national infrastructures.

A key insight from the study is the uneven distribution of cybersecurity maturity. Many SMEs remain unaware of the severity of these threats or assume they are too small to be targeted. This misconception contributes to significant underinvestment in cybersecurity, reinforcing a cycle in which inadequate defenses encourage more attacks.

The authors further report that economic and sector-specific factors influence the type and intensity of threats faced by SMEs. Firms in finance, healthcare, manufacturing and retail face elevated risks due to the sensitivity of stored data, operational dependencies and connectivity to high-value networks. Regional differences also exist, with SMEs in developing markets displaying higher vulnerability due to weaker digital ecosystems and fragmented regulatory oversight.

Defensive measures lag behind as cyber risks outpace preparedness

The study identifies persistent gap between the sophistication of cyber threats and the defensive strategies adopted by SMEs. The review identifies more than a dozen widely recommended defensive techniques, yet adoption remains inconsistent across regions and industries.

Training and awareness programs emerge as essential components of SME defense. The study shows that a significant portion of successful attacks could be prevented by employee education on phishing, social engineering and basic cyber hygiene. However, many SMEs lack structured training protocols or rely on outdated materials that do not keep pace with evolving attack vectors.

Technical defenses are equally underdeveloped. Best practices such as multi-factor authentication, role-based access control, network segmentation and endpoint protection are not implemented adequately in many firms. Regular data backups, patch management and vulnerability assessments, critical to minimizing impact and preventing exploitation, are often overlooked due to resource constraints or lack of internal expertise.

Email security remains a major gap. Business email compromise has risen sharply, yet only a fraction of SMEs use robust authentication technologies or filtering tools designed to detect impersonation attempts and malicious attachments.

The review also highlights the growing importance of supply-chain risk management. SMEs often assume third-party tools and service providers maintain secure environments, yet many breaches originate from compromised vendors. The absence of supplier vetting, security questionnaires or contractual cybersecurity requirements leaves firms exposed to risks beyond their control.

Regulatory compliance adds another layer of pressure. The study notes widespread confusion among SMEs regarding national and international data protection laws. Many firms lack the guidance or capacity to implement compliance frameworks, which increases legal and operational vulnerabilities.

Outsourcing offers a partial solution. Managed security service providers (MSSPs) contribute to improved resilience by offering continuous monitoring, incident response and advanced threat detection tools at lower costs than building internal teams. However, reliance on external providers also introduces challenges such as vendor lock-in, data privacy concerns and inconsistent service quality.

The study emphasizes that SME cybersecurity challenges cannot be solved solely through technology. Cultural factors, leadership priorities and organizational behavior play significant roles in whether firms invest meaningfully in security measures. SMEs that view cybersecurity as a strategic asset rather than a cost burden demonstrate significantly higher resilience and faster recovery from disruptions.

Urgent need for integrated cyber resilience models

The systematic mapping study reveals important insights about the evolution of SME cybersecurity research itself. Early work focused primarily on cost barriers and limited awareness, but recent studies highlight the need for comprehensive risk management, incident response frameworks and cybersecurity culture development.

The researchers detail how research methods have diversified, with surveys, interviews, case studies and simulations all contributing to a more nuanced understanding of SME vulnerabilities. Framework-based research is increasing, helping organizations evaluate their readiness and structure improvement plans. Scenario-based modeling and maturity assessments provide new tools for SMEs to measure their resilience and benchmark their progress.

The authors urge policymakers, academic researchers and industry leaders to collaborate on designing cybersecurity models specifically tailored to SME realities. Generic frameworks often fail to accommodate unique challenges such as lean staffing, limited budgets and informal organizational structures. Targeted solutions, such as simplified risk assessment tools, subsidized training programs, regional cybersecurity centers and clearer compliance guidance, are needed to address these hurdles.

Another key takeaway is the necessity for ongoing empirical research involving SMEs directly. Many existing studies rely on large enterprises or theoretical models, which do not always translate effectively to smaller firms. The authors call for longitudinal studies to track how SME cybersecurity evolves over time, especially as digital transformation accelerates and AI-driven threats expand.