Misinformation is sometimes catchy and often repeated.  Time and money-stretched small to medium-sized businesses (SMBs) often find themselves only lightly considering the truth regarding a bevy of myths about cyber security – if they’re even paying attention.  One particularly enduring myth is that “60% of SMBs go out of business within six months after a cyber attack.” I researched this one, trying to find its full origin. No such luck! Its accuracy is questionable…at best.  

This much is true: the impact of a cyber attack on an SMB can be devastating. Whether it’s the financial burden of recovery efforts (the scope of which may be surprising), loss of customer trust, and/or operational downtime, SMBs are often less equipped than larger organizations to clear the rubble left from an attack.

Scary statistics aren’t the only mythical statements: many tropes diminish the perceived need for cyber security best practice implementation.  Here are some of those tropes.

“I’m too small to be targeted.”

Balderdash, my friends! Yes, sadly, many SMB owners believe hackers only zero in on large enterprises who own and manage shiny troves of valuable data. Unfortunately, SMBs are frequently targeted as well.  Why? It’s because they lack the robust defenses of larger organizations, making them an easier entry point.

According to a study, 43% of cyber attacks target small businesses, and attackers often see them as chingy gateways to larger networks through supply chain connections. By thinking they’re too small to matter, SMBs eschew necessary work on cyber security maturity, leaving themselves exposed. And exposure makes it easier for attackers to exploit weak (or missing) defences.

“Firewall and antivirus are enough.”

Yes, firewalls and antivirus (now, please, antimalware) software are essential components of cyber security, they’re far from sufficient on their own. They’re not full coverage.

Modern threats, like phishing scams, ransomware, and social engineering attacks, bypass these traditional defenses. SMBs relying solely on these tools are like homeowners locking the front door but leaving the windows wide open. Without widespread multi-factor authentication, employee training, regular updates, asset management, endpoint protection, and many other practices, SMBs leave critical gaps in their defences that attackers are more than happy to exploit.

So…what do you do, SMB? You select a guide, and together you select a framework.  Simultaneous with that, you knock out all of the simple and easy while building a plan – and its steps and order of operations – for the future.  Quite a bit more work than firewalls and antivirus, right?  We haven’t even discussed your website and email; they’re in there, too.

“My IT team handles cyber security.”

Many SMBs assume that their IT providers or in-house teams manage all aspects of cyber security. IT practitioners are experts in IT – making things go and keeping them going.  There’s some overlap with cyber security but not enough to make them synonymous. When things that go are going, IT focuses on keeping systems operational, while cyber security is about defending those systems against attacks. Unless an SMB explicitly invests in cyber security expertise, the IT team may not have the specialized knowledge or resources to handle evolving threats and a plan to stay ahead of them. This gap often leads to vulnerabilities being overlooked, leaving the business exposed.

“If I don’t store customer data, I’m safe.”

While customer data is a prime target for hackers, it’s far from the only asset worth stealing. SMBs also hold valuable intellectual property, financial data, and access credentials. Even if a business doesn’t store sensitive information, unplanned and unwelcome access into the business’ network can still be used as a stepping stone for attackers targeting larger organizations in a supply chain. Additionally, ransomware doesn’t discriminate—it can cripple any business by locking up essential files and demanding payment for their release, regardless of the type of data stored.

“I’ll know immediately if I’m hacked (and can respond appropriately and quickly).”

Unfortunately, that’s unlikley. Many breaches go undetected for weeks or even months. Attackers often infiltrate systems and quietly gather data before triggering noticeable events like ransomware attacks. They dwell, as it were. According to research, the average time to detect a breach is around 200 days. 200. Days.

SMBs operating under the assumption that they’ll know right away are likely to miss early warning signs, delaying their response and amplifying the damage. Without proper asset, data, and network monitoring (and incident response plans) in place, the likelihood of minimizing harm right away is slim.

“I don’t have anything worth stealing.”

Every business has something of value to an attacker. It could be financial data, employee credentials, or even access to a broader network. Cyber criminals also target SMBs to use their systems and therefore processing power in botnets or as launch points for further attacks. The belief that a business has “nothing worth stealing” can lead to lax security practices, making it an easy and attractive target. In today’s digital landscape (I couldn’t resist the AI trite saying), every business—no matter the size—has something that hackers want.

The Cost of Believing the Myths

Believing these myths doesn’t just leave SMBs vulnerable; it actively increases the damage done by cyber attacks. A business that assumes it’s too small to be targeted may forgo basic security measures, making it an easy target. Similarly, relying on incomplete solutions like deploying only antivirus software or cyber insurance creates a false sense of security, leading to complacency. The harm goes beyond immediate financial losses. Operational downtime, loss of customer trust, and reputational damage can have long-lasting impacts that many SMBs struggle to recover from.

Conclusion

The myths surrounding cyber security for SMBs are dangerous because they lull businesses into a false sense of security, leaving them unprepared for the reality of modern threats. By reviewing and debunking these myths and taking proactive steps, SMBs can significantly reduce their risk of successful cyber attacks.

Cyber security isn’t a one-time fix or a problem that solves itself; it’s an ongoing process that requires attention and investment. For SMBs, the stakes are too high to rely on statements born from outdated (or inaccurate) beliefs. Recognizing the risks and addressing vulnerabilities head-on is not just a smart business move—it’s essential for survival in today’s “digital landscape.”