Experts quizzed by CSO said that the rapid adoption of emerging technologies — which comes with the downside of fresh vulnerabilities that cybercriminals can exploit — together with a widening skills gap is contributing to a deteriorating security outlook for small and midsize businesses (SMBs).

“Cyber skills gaps are prevalent in SMBs largely due to a lack of resources and specialized knowledge,” says Tom Exelby, head of cybersecurity at managed security services firm Red Helix. “Many SMBs don’t have dedicated cybersecurity teams, and those in charge of security can lack the confidence to perform even basic cyber tasks.”

SMEs often mistakenly believe that cyber attackers only target larger organizations, but that’s often not the case — particularly because small business partners of larger companies are often deliberately targeted as part of supply chain attacks.

“Threats are becoming more advanced but their resources aren’t keeping pace,” says Kristian Torode, director and co-founder of Crystaline, a specialist in SME cybersecurity. “Many SMEs are still relying on outdated systems or don’t have dedicated security teams in place, making them an easy target.”

Torode adds: “They’re also seen by cybercriminals as an exploitable link in the supply chain, since they often work with larger enterprises.”

“SMEs have traditionally been low-hanging fruit — with limited resources for cybersecurity training, advanced tools, or dedicated security teams,” Adam Casey, director of cybersecurity and CISO at cloud security firm Qodea, tells CSO. “More often than not, cybersecurity is left to overstretched IT departments already juggling multiple responsibilities.”

“Unlike large enterprises, SMEs often lack the budget and specialized personnel to secure a sprawling IT stack, especially as hybrid work and cloud adoption expand their attack surface,” says Robert Phan, CISO at cloud-based directory services firm JumpCloud.

Martin Greenfield, chief executive at Quod Orbis, also sees the shift to cloud and hybrid work environments challenging SMEs at a time when “threat actors have become faster, smarter, and better resourced,” he says.

Small business IT teams have always struggled to prioritize and triage security problems — a problem that has only grown more acute in recent years as the volume of vulnerabilities has increased.

According to the Verizon Data Breach Investigation Report for 2025, vulnerabilities grew as an attack vector by 180% over the year prior. Looking at the number of software vulnerabilities reported, that number has gone up as well — from 25,059 in 2022 and 28,961 in 2023 to 40,077 in 2024.

“When you are a small team, that number of issues is just impossible to track,” Matt Middleton-Leal, managing director for EMEA at Qualys, tells CSO. “The right approach here is to grade potential issues for severity and then spend time on what matters. This can help every small team have a big business impact.”

While a wealth of information is available, such as the UK NCSC’s small business security guide, small businesses often find it difficult to find actionable guidance.