If you feel good about where your cybersecurity stands, you have plenty of company. A new national survey of 1,000 small and mid-sized business leaders found that 86.3 percent report medium to very high confidence in their ability to manage cyber risk, echoing what we hear from the construction firms, auto dealerships, insurance agencies, and manufacturers we support across Lancaster County and Central Pennsylvania. Confidence is a good sign, but it is not the same thing as readiness, and the data shows a real difference between how secure businesses feel and how secure they are.
When Risk Climbs but Confidence Doesn’t Move
Cyber risk is not slowing down. 72.3 percent of business leaders report their risk increased or held steady over the past year, and only 17.9 percent have seen it go down. At the same time, 58.8 percent of leaders say they are highly confident they could recover quickly from a full day or more of downtime, which is not a hypothetical for a construction firm coordinating job sites or a dealership running on tight margins. It is lost revenue every hour the doors are effectively closed, and confidence that isn’t backed by a tested plan tends to break down exactly when a business can least afford it.
Can You Prove You Had a Clean Year?
According to the National Cybersecurity Alliance’s small business survey, 50.5 percent of SMBs reported a confirmed or suspected security incident in the past year, and another 5.6 percent weren’t sure, meaning 56.1 percent of businesses cannot say with confidence that they had a clean year. That uncertainty is often a sign monitoring isn’t catching what it should, and many businesses wouldn’t know an intrusion happened until well after the damage was done. The risk varies by industry, from a high of 76.4 percent in technology and telecommunications to 58.1 percent in manufacturing, an industry with a strong presence in Central PA.
The Difference Between Owning a Tool and Trusting It
Adopting a security tool and using it correctly are two different things, and that difference is where most incidents happen. 86.8 percent of businesses have MFA, but only 51.1 percent require it on every key account. Backups follow a similar pattern: 88.4 percent have them in place, but only 61.4 percent have verified they restore.
Leadership review habits follow the same pattern. Only 23.7 percent evaluate cybersecurity as a business risk monthly, the practice most likely to keep pace with a fast-moving threat landscape, and nearly 38 percent review it only sometimes, rarely, or never, a hard habit to defend for regulated industries like insurance and healthcare.
Watch Steve Walter discuss the pitfalls of legacy security versus modern threats. Pitfalls of Legacy Security vs Modern Threats
Your Team Is Already Using AI. Is There a Policy Behind It?
AI use among small businesses has reached 87.3 percent, driven mainly by the desire to save time and automate routine work. Policy has not kept pace: only 45.6 percent of businesses have formal guidelines for how employees should use AI tools, meaning most employees are making decisions about client data with no roadmap to follow. CISA and the National Cybersecurity Alliance both flag this as one of the fastest-growing risk areas for small businesses, precisely because the tools are so easy to start using without a policy behind them.
Four Steps Worth Taking Before Q4 Ends
- Put an AI acceptable use policy in writing. Spell out what should never go into a public AI tool, including client data, financial records, and proprietary information, and name which tools your team is approved to use.
- Choose business-grade AI platforms over free consumer versions. Paid, business-tier tools generally come with stronger data protections and administrative controls.
- Keep a human in the loop. Require review of AI-generated work before it goes external, whether that’s a client email, a quote, or code.
- Train your team in short, regular sessions. Fifteen to thirty minutes covering safe data handling and how to spot AI-related phishing goes a long way, and it’s the resource business leaders say they want most.
Find Out Where Your Business Really Stands
Every stat in this report describes a business that thought it had things covered. If you can’t say with certainty whether your MFA covers every account, whether your backups restore under real conditions, or what your team is entering into AI tools, that’s worth a conversation this week, not next quarter.
Plenty of providers sell a security tool and consider the job done. TCW-GAV‘s differentiator is the follow-through: more than 30 years building technology partnerships across Lancaster County and Central Pennsylvania went into building TCW TotalCare around exactly the blind spots this survey found, 24/7 monitoring, cybersecurity protection, and a local team that answers the phone, not just a tool installed once and left alone. Book a Discovery Discussion and get a clear picture of where your business stands before an attacker finds out first.
FAQ
Why do so many business owners feel confident about cybersecurity even though risk is rising?
Confidence often comes from having tools in place without confirming they are configured, enforced, or tested correctly. Feeling prepared and being prepared are not the same thing.
Is having multi-factor authentication enough to protect my business?
Not on its own. 86.8 percent of businesses have MFA, but only 51.1 percent require it on every key account, and attackers specifically look for the accounts it doesn’t cover.
Do smaller businesses really need a written AI policy?
Yes. 87.3 percent of small businesses already use AI tools, but only 45.6 percent have guidelines for how employees should use them. A short written policy closes one of the fastest-growing risk areas for small businesses.
What’s the first step toward closing the difference between confidence and readiness?
Start with what you already have. Confirm MFA is required on every key account, test your backups instead of assuming they work, and put cybersecurity on the agenda for a monthly leadership review instead of a quarterly or occasional one.
Source: 2026 Small Business Cybersecurity Awareness & Practices Survey, National Cybersecurity Alliance in partnership with CISA.