More than a million small businesses fell victim to cyber-attacks last year, according to new data from Proton, with many left facing financial losses severe enough to derail growth plans or bring their operations to a standstill.

Polling 3,000 decision-makers across companies with fewer than 250 employees, the VPN provider’s 2026 SMB Cybersecurity Report found that 26% of small businesses suffered a recent material breach, resulting in data loss (46%), operational disruption (38%), high legal costs (35%), and even the theft of funds (39%).

That’s despite nearly all (92%) of SMBs investing in their security, with around half using a combination of password managers, MFA, employee training, and encryption, as well as running formal risk assessments and regular audits.

Behind that impulse is a competitive desire, with Proton finding that 66% of organisations report demonstrating secure handling of data is critically important to winning new business, and 76% citing “secure file sharing” as a trust metric for clients.

But this push to signal strong security is undermined by the weak trust SMBs have in the platforms underpinning their operations.

That is most clearly the case when it comes to cloud and AI infrastructure. For example, the vast majority of firms (85%) said they rely on cloud-based services for email, file storage, and collaboration, but only 14% are confident their providers are keeping their data safe.

According to Proton, while almost all businesses surveyed rely on major cloud providers, more than a third (35%) said they don’t understand how these platforms handle data, while 33% say they have limited visibility into how it is being stored – little wonder, then, that almost a quarter of SMBs feel as if they have lost control of their own data.

Likewise, while many SMBs have started to integrate AI tools into their workflows, eager to reap the much hyped productivity benefits, there is a distinct lack of understanding or trust in even the largest, best-known vendors.

For instance, while 69% of firms rely on off-the-shelf AI tools like ChatGPT, Claude, or Grammarly, almost half (30%) do not trust the firms behind the software to safeguard proprietary business data.

Recommended reading

• PwC: Reduced Cyber Budgets Putting Healthcare Sector at Risk
• SMBs Under Siege | Cyber-Attacks Surge in Latest Findings
• UK SMBs Know Tech is Key to Growth, but Many Can’t Afford It

Much like their cloud anxieties, data security sits at the core of SMBs’ AI worries, with 45% complaining that they are unclear on how AI firms handle their data, 33% citing a lack of guarantees over deletion, and 32% concerned their business data might be misused.

“What stands out is the gap between dependency and confidence,” said Raphael Auphan, Chief Operating Officer at Proton.  

“Businesses frequently assume that being on a large platform means their data is automatically safe, even when they can’t clearly explain where it is stored, how it is encrypted, or who can access it.”