Cyber warfare, global conflicts, and the rapid adoption of artificial intelligence (AI) are among the concerns of small and medium-sized enterprises (SMEs). More than a potential risk, cyberattacks can have direct consequences for business activity. According to the “ESET SMB Cyber Readiness Index 2026”, 75% of the organizations surveyed agree that cyber warfare and global conflicts represent a real cybersecurity threat with potential impact on business.

Although 68% of respondents trust their organizations' ability to prevent cyberattacks, 45% have experienced at least one cybersecurity incident in the last 12 months. Phishing is the main cause of incidents, cited by 26% of respondents, followed by unpatched software vulnerabilities (23%), lack of security monitoring (22%), and weak passwords (20%).

“ Any improvement will have to start with a realistic assessment. We found that SMEs’ concerns are often shaped by news about emerging threats, such as AI-driven attacks, while more common risks, such as phishing, unpatched vulnerabilities and lack of monitoring, are underestimated. This suggests that many respondents have a misperception of their security posture and resilience ,” says Michal Jankech, Vice President for the B2B market at ESET.

Impact on the business

Data loss is the primary concern for organizations regarding the consequences of cyberattacks, cited by 50% of respondents. This is followed by operational disruption, mentioned by 40%, and financial consequences, cited by 37%.

Keeping up with evolving threats is the main cybersecurity challenge for 34% of organizations. In turn, 32% identify the need to keep up with new technologies, including artificial intelligence, as a difficulty.

AI increases risks and opportunities.

The integration of artificial intelligence in organizations is progressing: 73% of respondents say they are integrating this technology, while 70% acknowledge that its use introduces new cybersecurity risks. Furthermore, 60% of organizations claim to have an AI policy.

The organizations surveyed intend to use artificial intelligence primarily to anticipate threats and accelerate the mitigation of attacks. The technology thus assumes a dual role in corporate cybersecurity: it introduces new risks, but also offers opportunities to strengthen incident prevention and response capabilities.

The international study “ESET SMB Cyber Readiness Index 2026” was conducted with 4.400 cybersecurity decision-makers or influencers from organizations with 25 to 1.000 devices, across 13 countries: Canada, United States, United Kingdom, France, Germany, Italy, Spain, Netherlands, Sweden, Denmark, Czech Republic, Slovakia, and Japan.