Cyber threats push SMBs to spend more on security

https://www.helpnetsecurity.com/2026/05/21/idc-smbs-cybersecurity-spending-report/

Publish Date: 2026-05-21 00:00:00

Cybersecurity has become a key priority for small and medium-sized businesses due to growing threats and wider AI adoption. An IDC survey of 2,200 SMBs in eight markets examined how organizations manage cyber risks, prepare for AI-related threats, and handle third-party vendor security.

Top business priorities for the year (Source: IDC)

60% of SMBs expect to increase cybersecurity spending over the next 12 months. The findings show that businesses continue to rely on reactive approaches and remain underprepared for emerging risks.

Security responsibilities remain informal

Data protection and cybersecurity rank high on SMB priorities over the next 12 months, behind business growth and ahead of cost reduction. SMBs plan to increase cybersecurity spending over the next year, showing greater awareness of security risks. Cost pressures and accelerating AI adoption can slow progress and create a gap between intention and action, leaving businesses struggling to translate investment into stronger security practices.

Security responsibilities remain part of broader IT functions, with less defined ownership and fewer documented processes. Cybersecurity activity often becomes reactive, with action following incidents instead of routine oversight. Stronger accountability and consistent practices are necessary because increased spending alone may not improve security readiness.

Keeping up with changing threats

Tool management, staff training, and incident response planning remain difficult. Security maturity depends on operational discipline that helps maintain existing safeguards during business growth.

SMBs can strengthen cybersecurity posture through stronger data governance, security controls, and transparency supported by formal review cycles, defined accountability, and documented processes.

Small and medium-sized businesses encounter a broad and less predictable mix of threats, including phishing, social engineering, insider risk, third-party exposure,…

Source