Techaisle Blog

The digital landscape for small and medium-sized businesses (SMBs) and midmarket enterprises is a minefield fraught with evolving threats and escalating costs. Techaisle’s latest 2025 SMB and Midmarket Security Adoption Surveys paint a stark picture: while some metrics suggest a plateau in security incidents, the financial impact, and perceived vulnerability are on the rise, driven by factors like AI-powered threats and persistent staffing challenges. This blog delves into the key findings, offering a comprehensive look at the state of cybersecurity for these critical segments.

The Bottom Line: Escalating Financial Losses Amidst Perceived Vulnerability

Let's start with the hard numbers. The average loss for SMBs due to security incidents in 2024 surged to US$1.6 million, up from US$1.4 million in 2023. This increase, despite a seemingly stable incident rate (44% in 2024, consistent with 2023 but down from 56% in 2021 and 2022), highlights a crucial point: the attacks are becoming more sophisticated and costly. While the frequency might be leveling, the severity and financial ramifications are intensifying. Adding to the complexity, despite the downward trend from 2021/2022, a concerning 68% of SMBs feel under-prepared compared to their peers, a slight uptick from 65% in the previous year. This discrepancy between perceived incident rates and felt vulnerability indicates a growing awareness of the sophistication of modern threats and a lingering sense of inadequacy in defense mechanisms.

The Threat Landscape: AI, Attacks, and Denial of Service

Techaisle's research identifies the top cybersecurity risks as cyberattacks, risks related to the use of AI, and denial-of-service (DoS) attacks. The rise of AI as a security risk is particularly noteworthy. In 2025, 56% of SMBs anticipate new security risks stemming from AI, up from 48% in 2024. This burgeoning concern reflects the dual-edged sword of AI: while it offers potential security benefits, it also introduces new attack vectors and amplifies existing ones. The escalating concern about AI-powered threats is logical. Bad actors increasingly leverage generative AI to craft sophisticated phishing campaigns, automate malware development, and amplify social engineering attacks. This trend is not just theoretical; it’s a tangible threat that SMBs are grappling with.

As the market becomes flooded with specialized security solutions, an important question arises: Who can effectively integrate and manage all these different solutions? Cisco is making changes to position itself as a leading contender. As a comprehensive solution provider, Cisco can fill gaps in the cybersecurity landscape and ensure a cohesive approach to security, especially cloud security. It is building and integrating its portfolio of offerings, for example, XDR, Umbrella, Duo, Talos, many others, and now Armorblox.

As threats evolve, security efforts have shifted from solely preventing incidents to investigating them quickly and anticipating future risks. With IT environments now comprising interconnected networks, communication tools, mobile devices, cloud applications, and more, security is a top priority. Techaisle data shows that security is an IT priority for 74% of small businesses, 85% of SMBs, and 100% of midmarket firms. Endpoint security is already relatively widely adopted by SMBs. In addition, security suppliers have made headway in gaining customers for mobile hardware and access control security services. While Endpoint Detection and Response (EDR) tools are helpful, their capabilities are limited to detecting and responding to threats on endpoints and servers. Prevention remains the best approach to security, but detection is essential.

Cisco’s new XDR technology presents exciting opportunities for business growth by leveraging its vast network infrastructure and customer data to tackle security challenges. To strengthen its position in the security industry, Cisco is streamlining its go-to-market strategy and investing in partnerships to unify its cybersecurity offerings. Its partner growth strategy includes upgrading firewalls and refreshing products for existing customers, offering competitive pricing and margins to win new business, and introducing new partner offers for Security Operations Centers, such as Managed Detection and Response using Cisco XDR.

Cyberattacks targeting small and medium-sized businesses (SMBs) have increased, particularly ransomware and DDoS attacks. Implementing multi-factor authentication (MFA) safeguards employee identities and credentials. However, only 16% of SMBs and 25% of midmarket firms use MFA enterprise-wide. Similarly, only 13% of SMBs and 16% of midmarket firms have adopted single sign-on. However, the intent to adopt is significantly higher. Cisco offers MFA and single-sign-on (SSO) through its Duo offering, introducing innovations such as passwordless and risk-based authentication and Verified Duo Push. In addition, Duo has made security more accessible by integrating its Duo Trusted Endpoints capability into all service tiers, allowing users to restrict access only from corporate-managed devices or devices registered with Duo. This helps prevent unauthorized access attempts from unknown devices. In the advanced tiers, users can also assess the devices’ health before granting access and block risky or non-compliant devices, such as those running out-of-date software.

Securing endpoints and servers is essential for organizations, but cybercriminals are finding ways to bypass these measures through covert attacks. Instead of directly targeting high-value assets in data centers, they gain access through laptops and move laterally through the network. As a result, relying solely on an EDR solution or a firewall is not enough to detect and prevent cyberattacks. To fully protect IT infrastructure, it’s necessary to integrate prevention, detection, and response technologies into a single solution. This is where Extended Detection and Response (XDR) comes in, providing a comprehensive approach to security.

XDR builds upon the concept of EDR and expands its scope. It goes beyond the endpoint and server by integrating data from various security tools, including firewalls, email gateways, endpoint, network, identity, DNS, public cloud tools, and mobile threat management solutions. While it is possible to connect these components manually, a comprehensive XDR solution is designed to function as a unified system wherein components are interconnected and work together seamlessly to optimize threat detection and response workflows. Cisco's XDR solution in one such system.