Breaking News
Tracy
Tracy
Oct 16 2026
38The leading cybersecurity vendor warns about the most damaging consequences of cyber-attacks, uncovers the primary motives of threat actors, and reveals which departments are most frequently targeted. Findings from the new global survey of small- and medium‑size businesses (SMBs), including those in APAC, underscore the growing need for advanced and purpose-built protection.
As small and medium-sized businesses increasingly become a battleground for digital threat actors, understanding the true operational and financial impact of security breaches has never been more critical. A new global survey[1] by Kaspersky draws attention to the key security gaps of companies below 500 employees and highlights critical risk areas.
According to a poll of IT and IT security professionals in the APAC SMB sector, an overwhelming 87% of respondents stated they had experienced at least one cyber incident in the last year. Among them, the top threats cited as the most damaging were software vulnerability exploits (10%), mass malware attacks (7%), and external remote access (7%).[AAM1]
The consequences[ML2] of these incidents extend well beyond financial losses. Among APAC SMBs that had experienced a cyber incident, the most harmful attacks resulted in the theft of clients’ personal data (25%), temporary disruption of client-facing services like websites and online stores (23%), and theft of employees’ personal data (23%).
The survey also highlights the irreversible nature of some of the damage: 21% of companies reported financial loss an equal percentage faced irrecoverable data loss, while 13% suffered irreversible damage to corporate assets. This underscores the long‑term risks that cyber incidents pose to SMBs.
Global Kaspersky B2B Market Pulse survey: What was the result of the most harmful incident your organization experienced over the past 12 months? (Multiple choice)
Adversaries’ Primary Objectives[ML3]
Respondents indicated that attackers are heavily focused on business and personal data theft. Stealing clients’ personal data was identified as the leading objective of attackers in APAC (34%), followed by sensitive internal information such as financial credentials, legal documents, etc (31%), employees’ personal data (27%), and preventing employees and clients from accessing online resources (23%). This pattern reflects a strategic shift toward extracting valuable data that can be monetised or leveraged for further attacks.
Most Targeted Departments[ML4]
Kaspersky’s APAC data shows that cybercriminals concentrate their efforts on IT and IT‑security teams, with 51% of the most harmful attacks directed at IT and 52% at IT‑security departments. Customer service and accounting and finance departments were the next most targeted areas, at 22% and 20% respectively.
Recent breaches have compelled companies to implement additional cybersecurity measures across processes, people, and technologies. The top priority for APAC companies has been deploying IT security monitoring solutions (24%), strengthening cloud security controls (24%), and hardening third-party compliance requirements (24%). This is followed by investing in specialised training to boost IT staff expertise (22%), deploying security solutions on all employees’ devices (22%), revising password policies (22%), and implementing multi-factor authentication (22%).
“Cyber incidents often inflict far more devastating consequences on small and medium-sized companies than high-profile breaches do on large corporations. Sometimes, it can threaten the very survival of these resource-constrained businesses”, comments Ilya Markelov, Head of Unified Platform Product Line at Kaspersky. “Faced with diverse and intense threats, operational constraints, and specific growth objectives, SMBs urgently need scalable, purpose-built protection. Kaspersky Next Optimum, our flagship offering for this segment, is engineered to bring expert and flexible security within reach for growing businesses. With the new suite of customisable, add-on Security Modules, users can further extend capabilities of its core products and strengthen defenses as new needs or challenges evolve.
“Our findings highlight the increasingly complex and diverse range of cyberthreats facing businesses across APAC, underscoring the importance of cyber resilience. While the risks and attack methods vary across market, from software vulnerability exploits and phishing to mass malware attacks, their impact can be felt across the business. A single incident can compromise sensitive information, interrupt day-to-day operations and weaken customer trust. Cybersecurity is therefore not confined to IT, and addressing these risks require a combination of the right technology, strong security awareness, and consistent cyber hygiene being embedded into every business practice,” says Adrian Hia, Managing Director for Asia Pacific at Kaspersky.
To minimise the risk of losses caused by cyber incidents, Kaspersky recommends that small and medium-sized businesses implement specialised solutions that fit budget, size, and industry requirements to protect against advanced attacks:
· Small and medium-sized businesses that need more advanced security capabilities to counter diverse threats should consider Kaspersky Next Optimum. The offering provides core protection to help prevent evolving attacks, detect threats early, investigate incidents and respond before they escalate into more serious business consequences. With new Security Modules, businesses can extend this protection to address such specific risks, as email-borne threats, workload and cloud security risks, and vulnerabilities. Security Modules include Security Awareness, Email Security, Workload Security, Threat Lookup & Analysis and Vulnerability Management, allowing businesses to strengthen specific areas without redesigning their existing security stack.
Kaspersky Small Office Security Premium is an easy-to-use solution that ensures endpoint protection against advanced threats, including malware, ransomware and provides access to security awareness training for employees, making it ideal for micro-businesses.
Establish internal processes: Implement strict access controls for corporate resources and cloud services, ensuring IT promptly revokes permissions during employee offboarding.
Secure your data: Integrate daily backup routines into operations to secure critical information against emergencies and ransomware.
Manage human risk: Support technical controls with continuous training on safe browsing and password hygiene, while requiring IT approval for all new software. Help your employees build sustainable cyber habits with the Kaspersky Automated Security Awareness Platform providing interactive online courses and simulated phishing campaigns.
About Kaspersky
Kaspersky ensures Cybersecurity True to Business, focusing on providing clear outcomes, protecting revenue, easing workloads and preventing downtime. Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative solutions and services for organizations of every size, from small businesses to large enterprises, combining proven AI-driven protection technologies with simple management and expert support.
Recognized in independent tests and trusted by millions of individuals worldwide and nearly 200,000 organizations, Kaspersky helps detect threats earlier, respond faster and operate with greater confidence and freedom, protecting what matters most to our clients. Learn more at www.kaspersky.com.
[1] A study by Kaspersky’s internal research center involved 1,800 global interviews across 18 countries: Brazil, Mexico, Colombia, France, Germany, Italy, Spain, India, Indonesia, Malaysia, China, Thailand, Vietnam, Egypt, South Africa, Saudi Arabia, Turkey, Russia. Among the total sample, the SMB sector was represented by 616 respondents.
[AAM1]The most harmful incident for the past 12 months (single choice):
LATAM (144 respondents):
1. Phishing: attackers trick people into revealing sensitive information to them via email, text, or fake websites – 12%
2. Use of weak or stolen credentials – 9%
3. Ransomware attacks – 8%
EU (209 resp):
1. Mass malware attacks – 10%
2. Attacks using administrator (legitimate sw) tools – 10%
3. Phishing – 8%
4. Use of AI vulnerabilities – 8%
APAC (131 resp):
1. Software vulnerability exploit – 10%
2. Mass malware attacks – 7%
3. External remote access – 7%
META (33 resp):
1. Software vulnerability exploit – 12%
2. Phishing – 8%
3. Web application exploits: attackers use vulnerabilities of web applications (e.g., SQLi, XSS, RFI, etc.) to gain access – 7%
RU (33 resp):
1. Mass malware attacks – 18%
2. Use of AI vulnerabilities – 9%
3. Distributed denial of service (DDoS) attacks – 9%
[ML2] [ML2]What was the result of the most harmful incident your organization experienced over the past 12 months?
LATAM:
1. Financial loss – 31%
2. Disruption of business processes (e.g., finance, HR, legal, etc.) – 27%
3. Temporary client services disruption (e.g., web-sites, online stores, personal accounts, etc.) – 25%
EU:
1. Impact on staffing (forced hiring or layoffs as a result of the incident) – 24%
2. Loss of control over IT infrastructure / IoT devices (CCTVs, sensors / detectors, controllers, etc.) – 20%
3. Temporary client services disruption (e.g., web-sites, online stores, personal accounts, etc.) / Financial loss / Clients’ personal data theft – 19%
APAC:
1. Clients’ personal data theft – 25%
2. Temporary client services disruption (e.g., web-sites, online stores, personal accounts, etc.) / Employees’ personal data theft – 23%
3. Sensitive data theft (financial credentials, legal documents, etc.) – 22%
META:
1. Disruption of business processes (e.g., finance, HR, legal, etc.) – 28%
2. Loss of control over IT infrastructure / IoT devices (CCTVs, sensors / detectors, controllers, etc.) – 27%
3. Financial loss – 23%
RU:
1. Disruption of industrial or operational processes (e.g., equipment malfunction, production shutdown, etc.) – 24%
2. Clients’ personal data theft / Unauthorized monitoring or data collection within the company (e.g., internal telemetry spying, industrial espionage, etc.) – 21%
3. Public leak of data / Data encryption / Intellectual property or Research & Development data theft / Impact on staffing (forced hiring or layoffs as a result of the incident) – 18%
[ML3]What did cyber adversaries mostly aim for during the most harmful incident your organization experienced over the past 12 months?
LATAM:
1. Stealing sensitive data (financial credentials, legal documents, etc.) – 29%
2. Stealing clients’ personal data / Stealing employees’ personal data – 27%
3. Manipulating or altering data – 25%
EU:
1. Stealing clients’ personal data – 28%
2. Stealing information about organization’s business strategy – 26%
3. Stealing sensitive data (financial credentials, legal documents, etc.) – 25%
APAC:
1. Stealing clients’ personal data – 34%
2. Stealing sensitive data (financial credentials, legal documents, etc.) – 31%
3. Stealing employees’ personal data – 27%
META:
1. Stealing clients’ personal data – 34%
2. Stealing sensitive data (financial credentials, legal documents, etc.) – 29%
3. Stealing employees’ personal data – 24%
RU:
1. Stealing clients’ personal data / Stealing employees’ personal data – 36%
2. Manipulating or altering data / Stealing or extorting money – 24%
3. Stealing information about organization’s business strategy / Sabotaging organization’s operations and business processes – 21%
[ML4]Which of your organization’s departments got attacked at the time of the most harmful incident your organization experienced over the past 12 months?
LATAM:
1. IT Security – 40%
2. Accounting and Finance – 36%
3. IT – 35%
EU:
1. IT Security – 53%
2. IT – 47%
3. Accounting and Finance – 26%
APAC:
1. IT Security – 52%
2. IT – 51%
3. Customer Service – 22%
META:
1. IT – 54%
2. IT Security – 40%
3. Research and Development (R&D) – 18%
RU:
1. IT – 76%
2. Accounting and Finance / Customer Service – 27%
3. Research and Development (R&D) – 24%
[ML5]What IT security measures were taken by your organization after this incident to avoid such attacks in the future?
LATAM:
1. Implementation of Zero Trust or the Principle of Least Privilege (PoLP) for all employees, partners and contractors – 30%
2. Introduction or update of IT security trainings for improving expertise of IT staff (covering new threats, attack techniques, incident response) – 28%
3. Introduction or update of password policy (e.g., encouragement of regular password change, introduction of specific password requirements, etc.) / Introduction of regular data backups – 27%
EU:
1. Installation or update of IT security solutions on all employees’ corporate and personal devices – 30%
2. Introduction or update of password policy (e.g., encouragement of regular password change, introduction of specific password requirements, etc.) – 25%
3. Introduction of regular vulnerability scans – 24%
APAC:
1. Installation of monitoring IT security solutions (e.g., SIEM) / Strengthening cloud security controls / Implementation or update of IT security compliance requirements for partners and contractors – 24%
2. Introduction or update of IT security trainings for improving expertise of IT staff (covering new threats, attack techniques, incident response) / Installation or update of IT security solutions on all employees’ corporate and personal devices / Introduction or update of password policy (e.g., encouragement of regular password change, introduction of specific password requirements, etc.) / Introduction of multi-factor authentication – 22%
3. Introduction of regular vulnerability scans / Introduction of regular data backups / Introduction of regular penetration testing or red teaming (imitation of attacks to test systems’ security) / Introduction of the obligation to use secure channels for sharing confidential information within and outside of organization / Implementation or update of email encryption / Update of compliance with regulatory requirements – 20%
META:
1. Introduction or update of obligatory IT security trainings for all our employees – 27%
2. Installation of monitoring IT security solutions (e.g., SIEM) / Implementation or update of IT security compliance requirements for partners and contractors – 26%
3. Introduction of multi-factor authentication – 24%
RU:
1. Building of Security Operations Centre (SOC) – 30%
2. Introduction or update of password policy (e.g., encouragement of regular password change, introduction of specific password requirements, etc.) / Introduction of regular data backups – 21%
3. Installation of monitoring IT security solutions (e.g., SIEM) / Implementation or update of email encryption / Outsourcing a part of IT security functions – 18%
