UK small businesses are facing greater AI security threats than ever — and are sadly woefully unprepapred Mike Moore | usagoldmines.com

• ESET finds nearly half (49%) of UK SMBs have experienced an incident in the past year
• Phishing, unpatched vulnerabilities, weak passwords, and a lack of monitoring often to blame
• AI-powered tools will prove a much bigger challenge for SMBs

British small businesses are being hit by more cyberattacks than ever before, and the increasing use of AI technology by hackers could put more of them at risk, experts have warned.

ESET’s 2026 SMB Cyber Risk Report found that nearly half (49%) of UK SMBs have experienced an incident in the past year, with 13% of those experiencing more than one incident.

Many of the 500 UK SMBs surveyed expressed fears that the situation is only going to get worse, as criminals employ new AI-assisted tools to launch more powerful attacks.

SMBs at risk

The top security concern for SMBs was AI-powered malware, with the most common causes of attack found to be phishing, unpatched vulnerabilities, weak passwords, and a lack of monitoring.

Security should be an important consideration for businesses of all sizes, but with so many plates to spin, can go neglected in some SMBs.

This isn’t the only challenge they face, as the report also flagged issues such as a struggle to keep up with the latest cybersecurity threats, staying the pace with new technologies like AI, vulnerability and patch management, and a lack of skills in the workforce.

The findings are especially concerning as SMBs make up more than half of UK turnover in the UK private sector – around £2.8 trillion, and so are often popular targets for hackers.

It isn’t all bad news though, as in order to help resolve security challenges, over half (55%) of UK SMBs said they expect to increase cybersecurity budgets over the next 12 months, with top investment priorities including employee training and awareness and cloud security.

“It’s true that AI will help cybercriminals to speed up their attacks against UK businesses. But the core tactics used like phishing or exploiting software vulnerabilities will largely stay the same,” explains Jake Moore, Global Cybersecurity Advisor at ESET.

“Until organisations can improve their security by locking down the basics, smaller businesses will be easy pickings for cybercriminals looking to steal sensitive data and turn a profit.”