October is Cybersecurity Awareness Month, and this year’s theme from the nonprofit National Cybersecurity Alliance, “Don’t Make It Easy for Them,” is a useful test for any business owner. Most of the cyber risks that cause the biggest losses don’t arrive as dramatic hacks. They start with an outdated system, a vendor with weak login protections, a phone call from someone impersonating your CFO, or an employee pasting company data into an unapproved AI tool. Here are the hidden cybersecurity risks facing small businesses right now, what the latest data says about each, and how a SandStone advisor can help you close the gaps before they lead to a data breach.
Key takeaways
-
Florida ranked third nationally in 2025 for cybercrime complaints (71,843) and reported losses ($1.6 billion) to the FBI’s Internet Crime Complaint Center (IC3), while Georgia ranked tenth for complaints (25,936) and ninth for losses ($534.6 million).
-
Exploiting software flaws is now the most common way attackers break into organizations, accounting for 31% of breaches in Verizon’s 2026 Data Breach Investigations Report (DBIR), up from 20% a year earlier.
-
Breaches involving a third party, such as a vendor or software provider, rose 60% year over year to 48% of all breaches in the DBIR, and reached 55% of breaches at small and medium-sized businesses.
-
Phishing-style attacks over voice and text messaging succeed more often than email attacks: in Verizon’s phishing simulations, the median click rate on mobile-centric attacks ran 40% higher than on email.
-
Employee use of AI tools on company devices jumped from 15% to 45% of employees in one year, and shadow AI, meaning unapproved AI use, is now the third most common non-malicious insider action Verizon detected.
-
Business email compromise generated 24,768 complaints and more than $3 billion in reported losses in 2025, according to the FBI’s Internet Crime Complaint Center (IC3).
-
Ransomware appeared in 48% of all breaches in the DBIR, a record high, and Verizon found small organizations are disproportionately affected.
-
Cyber liability insurance can cover first-party costs, third-party claims, business interruption, and regulatory defense, but ransom coverage often carries its own sub-limit and conditions, so policy details matter.
Cybercrime in Florida, Georgia, and South Carolina: What the FBI’s Data Shows
Southeast businesses aren’t on the sidelines. The FBI’s Internet Crime Complaint Center (IC3), the federal government’s central intake point for cybercrime reports, received 1,008,597 complaints nationwide in 2025, with reported losses of $20.877 billion, a 26% increase over 2024. Florida ranked third among all states with 71,843 complaints and $1,596,138,595 in reported losses. Georgia ranked tenth in complaints with 25,936 and ninth in losses at $534,581,965.
These figures cover all types of internet crime reported by individuals and businesses, and they reflect only complaints filed, so actual losses are likely higher. They show why cyber risk is a local business issue, and why a SandStone advisor reviews cyber exposure with commercial clients as part of coverage conversations.
Outdated and Unpatched Software Is the Hidden Door Attackers Use Most
Software makers such as Microsoft and Apple release updates, also called patches, that fix security flaws. The fix protects your business only after someone installs it, and attackers know that gap exists. According to Verizon’s 2026 Data Breach Investigations Report (DBIR), an annual study built on incident data from nearly a hundred contributors, which analyzed more than 22,000 confirmed data breaches this year, exploiting software flaws is now the most common way attackers break in. It accounted for 31% of breaches, up from 20% a year earlier, and it overtook stolen credentials, which accounted for 13%.
Unpatched systems are one of the four threats the National Cybersecurity Alliance highlights in this year’s Awareness Month toolkit. A SandStone advisor can help you build update practices that insurers and underwriters want to see, which supports both your security and your cyber liability coverage.
Third-Party Vendor Risk Is a Hidden Cyber Threat to Your Business
Many businesses secure their own systems and overlook the software providers, payroll platforms, and service companies connected to them. Verizon reports breaches involving third parties grew 60% from last year’s dataset, reaching 48% of all breaches. Among small and medium-sized businesses, third-party involvement reached 55%. The gaps are often basic: only 23% of third-party organizations fully fixed missing or improperly configured multi-factor authentication (MFA) on their cloud accounts, and resolving weak passwords and permission misconfigurations took almost eight months at the 50% mark.
You can’t control a vendor’s security, but you can ask about it, require it in contracts, and confirm your own cyber coverage responds when a vendor’s failure becomes your loss. That conversation belongs in your next policy review with your SandStone advisor.
Phone Calls and Text Messages Are the New Phishing Frontier
Email filters have improved, so attackers have moved to channels that most businesses protect less. Verizon found the human element was involved in 62% of breaches, and in its phishing simulations, the median success rate of attacks using voice and text messaging ran 40% higher than email attacks. Pretexting, where an attacker builds a believable scenario to trick an employee, often by phone, reached 6% of all breaches as an initial access method.
Phishing scams are another of the four threats featured in the National Cybersecurity Alliance’s 2026 toolkit. Simple habits help: verify unusual requests through a second, known channel, and train employees to pause before acting on urgent calls or texts, even when the caller claims to be a boss or vendor.
Business Email Compromise Quietly Drains Bank Accounts
Business email compromise (BEC) happens when a criminal impersonates an executive, vendor, or employee to redirect a payment or wire transfer. The FBI’s IC3 2025 Internet Crime Report logged 24,768 BEC complaints and $3,046,598,558 in reported losses, up from 21,442 complaints in 2024, making BEC one of the costliest crime types the FBI tracks. Those figures cover only losses reported to the FBI, so the true total is likely higher.
BEC often involves no malware at all, which means a security tool may never flag it. Strong payment verification procedures, dual approval on wire transfers, and MFA on email accounts reduce the risk, and crime or cyber coverage with social engineering protection may help when prevention fails. Coverage for this exposure varies widely by policy, so it’s worth confirming with your advisor before you need it.
Shadow AI: The Risk Your Employees Don’t Know They’re Creating
Employees are adopting AI tools faster than most businesses can write policies for them. Verizon found 45% of employees now regularly use AI on corporate devices, whether the company approved the tool or not, up from 15% the year before, and 67% of users access AI services through non-corporate accounts on those devices. Shadow AI is now the third most common non-malicious insider action in Verizon’s data loss prevention dataset, a fourfold increase in share from the previous year.
The most common data type sent to outside AI models was source code, followed by images and structured data, and in 3.2% of policy violations, research and technical documentation went to unauthorized AI systems. The threat side is growing too: IBM’s 2026 Cost of a Data Breach Report found a 56% increase in AI-driven attacks, led by deepfake impersonation and AI-enabled malware. A written AI use policy is a practical first step, and your advisor can help you confirm whether your cyber and employment practices coverage account for AI-related incidents.
Ransomware Hits Small Businesses Hardest
Ransomware showed up in 48% of all breaches in Verizon’s 2026 DBIR, up from 44% the year before and the highest share in the report’s history. Verizon notes that small organizations are disproportionately affected and often have fewer resources to respond. There is one encouraging trend: 69% of ransomware victims in the dataset did not pay, and the median ransom paid fell to $139,875 from $150,000.
For a small business, though, the ransom is only one cost. Downtime, lost revenue, forensic investigation, and customer notification can add up to far more, which is why business income and incident response coverage matter as much as ransom coverage. IBM and Ponemon Institute’s 2026 Cost of a Data Breach Report puts the global average cost of a data breach at $4.99 million, a record high and a 12% increase over last year, and IBM found extensive use of security AI and automation saved organizations $1.93 million on average compared to those using none.
What Cyber Insurance (Cyber Liability Coverage) Covers, and Where Gaps Hide
A cyber insurance policy, also called cyber liability insurance, can help cover several distinct exposures. First-party coverage pays for your own costs after an incident, such as forensic analysis, customer notification, public relations support, and system restoration. Third-party coverage responds if a customer or partner sues you over a breach.
Business income coverage helps replace revenue lost while systems are down. Regulatory coverage can help with defense costs, fines, and penalties where law allows. Ransom and extortion coverage, however, is often not included in a standard policy, may carry a separate sublimit and deductible, and may require you to meet certain conditions set by the insurer. Those conditions can include security controls such as MFA, which is exactly why the hidden risks in this article matter to your coverage and not just your IT department. A SandStone advisor can compare cyber policies across carriers and help you understand what each one covers before a claim exposes the gaps.
Cybersecurity Checklist for Businesses This Cybersecurity Awareness Month
Cybersecurity Awareness Month is a good reminder to brush up on the basics. Turn on MFA for email, banking, and cloud accounts. Install critical updates promptly and track which systems have fallen behind. Ask your key vendors how they protect your data. Create a written policy for AI tool use. Require a second verification step, through a different channel, for any payment change or wire request. Then review your cyber liability policy with your SandStone advisor to confirm your limits, sub-limits, and conditions match the risks your business actually faces today.
Frequently Asked Questions
Are small businesses really targeted by cyberattacks?
Yes. Verizon’s 2026 DBIR recorded 7,256 security incidents at small and medium-sized businesses, 7,152 of them confirmed data breaches, and every one of those breaches involved an external attacker with a financial motive. Verizon also notes small organizations face many of the same threats as larger ones, often with fewer resources to respond.
How much does a data breach cost a business?
IBM and Ponemon Institute’s 2026 Cost of a Data Breach Report puts the global average cost of a data breach at $4.99 million, a 12% increase over last year and a record high. Costs for any single business vary widely based on its size, industry, and the type of incident, which is why reviewing your cyber liability limits with an advisor matters.
What is cyber insurance, and what does cyber liability insurance cover?
Cyber insurance, also called cyber liability insurance, is a specialized business policy that helps cover the costs of a cyber-attack or data breach. Depending on the policy, it may cover first-party costs such as forensic analysis and customer notification, third-party lawsuits, lost business income, and regulatory defense. Coverage varies by policy, so a SandStone advisor can walk through what each option includes.
What are the biggest hidden cybersecurity risks for small businesses in 2026?
The biggest hidden risks include unpatched software vulnerabilities, weak security at third-party vendors, phishing through phone calls and text messages, business email compromise, unapproved employee use of AI tools, and ransomware. Verizon’s 2026 DBIR found vulnerability exploitation is now the most common way attackers gain initial access, and that third parties were involved in 55% of breaches at small and medium-sized businesses.
What is the theme of Cybersecurity Awareness Month 2026?
The National Cybersecurity Alliance’s 2026 theme is “Don’t Make It Easy for Them.” The campaign encourages individuals and businesses to build simple, consistent habits that make life harder for cybercriminals, with a focus on password cracking, unprotected accounts, unpatched systems, and phishing scams.
What is shadow AI, and why is it a cybersecurity risk?
Shadow AI means employees using AI tools their employer hasn’t approved, often through personal accounts on work devices. It creates risk because sensitive data, such as source code or internal documents, can leave the company without oversight. Verizon’s 2026 DBIR found shadow AI is now the third most common non-malicious insider action in its data loss prevention dataset.
What is business email compromise, and how common is it?
Business email compromise is a scam in which a criminal impersonates an executive, vendor, or employee to trick someone into sending money or sensitive information. The FBI’s IC3 received 24,768 BEC complaints in 2025, with reported losses of more than $3 billion.
Does cyber liability insurance cover ransomware?
It can, but coverage varies. Ransom and extortion coverage is often not part of a standard policy, may carry its own sublimit and deductible, and may require you to meet conditions set by the insurer. Business income and incident response coverage can also help with the downtime and recovery costs that often exceed the ransom itself.
How can an insurance advisor help reduce my cyber risk?
An independent advisor can compare cyber liability coverage across multiple carriers, explain sublimits and policy conditions, and help you prepare for the security controls underwriters expect, such as MFA and patching practices. Insurers may also review your current defenses and identify weak points as part of the underwriting process.
Why Partner With SandStone
Cyber risk changes faster than most businesses can track, and the gaps that cause the biggest losses are often the ones nobody has looked at yet. SandStone Insurance Partners helps businesses across Florida, Georgia, and the Southeast evaluate their exposure and build cyber liability insurance coverage that matches how they actually operate, not a one-size-fits-all policy. Contact your SandStone advisor today to review your cyber coverage this Cybersecurity Awareness Month.
Related Coverage
AI is reshaping more than one business risk at once. Read about cyber insurance and the Gold Eagle clearinghouse to learn what that development means for your coverage in 2026, and see how employment practices liability insurance responds to employee-related claims.
Disclaimer: This blog provides general educational information about business insurance and is not legal, financial, or insurance advice. Coverage availability, eligibility, sublimits, exclusions, and policy features vary by state, carrier, industry, and individual underwriting. For coverage recommendations specific to your business, contact a licensed agent from SandStone.
