It’s the question I hear more than any other from small and medium business owners: “Why would anyone bother with us? We’re not a bank. We haven’t got millions sitting in the account. Surely we’re not worth the effort.”
Kaspersky’s new 2026 SMB Threat Report puts some hard numbers on why that thinking is the wrong way round, and why smaller businesses are still one of the most attractive targets in the whole cybercrime economy.
The numbers
In just the first four months of 2026, Kaspersky detected more than 33,300 attacks on SMBs disguised as popular AI tools. That’s almost five times the same period in 2025. Add nearly 415,000 attacks using fake messaging and video-conferencing apps, and another 24,000 dressed up as office software, and you see the pattern. Attackers aren’t hunting big fish. They’re casting wide nets, and small businesses are swimming straight into them.
Even more telling, more than half of the “initial access” listings on dark web forums, where criminals sell ready-made ways into compromised networks, are for small and medium businesses. Not banks or big corporates. Businesses like yours.
So why you?
There are three reasons, and none of them need you to be famous, rich or high-profile.
You’re easier to get into. Big companies spend millions on layered security, dedicated security teams and round-the-clock monitoring. Most smaller businesses don’t, and can’t. Criminals know that. A less-defended target with a working bank account and a live email system is a much better use of their time than trying to crack a corporate firewall.
You’re a way into someone bigger. This is the one most people miss. Kaspersky found “trusted relationship” attacks, where criminals compromise a smaller supplier or contractor to get to a bigger client, rose from 12.7% to 15.5% of initial attack routes in a year. If you invoice a larger company, hold its data or have access to its systems, you’re not just a target, you’re a stepping stone.
You’re worth money on your own. A fake AI “invoicing tool” that takes a subscription and delivers nothing, a scam bank set-up page, or plain old ransomware. Criminals don’t need you to be wealthy. They just need your payment details, your logins or your data to be worth more to you than what they’re asking for.
The new twist: fake AI tools
The most striking finding this year is how quickly criminals have jumped on the AI hype. Malware and scam apps disguised as popular AI tools grew nearly 500% year on year, overtaking fake office software as a lure. Kaspersky specifically called out fake versions of Claude and OpenClaw being used to trick business owners into installing malware or paying for tools that don’t exist.
The lesson isn’t “don’t use AI”. It’s the opposite. AI use is taking off and criminals are riding the wave, betting curiosity and time pressure will beat caution. Only download AI tools from official sources, and treat any “must-have AI tool” that lands in your inbox with the same suspicion you’d give a too-good-to-be-true loan offer.
In short
You don’t have to be a target of interest to be a target of opportunity.
- Attackers follow trends, not reputations. Whatever is popular (AI tools today, something else tomorrow) gets turned into bait.
- “We’re too small to matter” is exactly the mistake they’re counting on.
- If you work with or supply bigger organisations, your security is now part of their risk too.
Where to start
Kaspersky’s recommendations match what we tell clients every day: control who has access to what, back up your data properly, train your team to spot the fakes, and put layered protection in place that suits your size and budget. Have a look at our cyber security services to see how we do that.
Not sure whether your setup would actually catch these kinds of attacks? Book a free health check, or call us on 0800 688 768.