Kaspersky has published the results of its report “Inside the 2026 SMB Threat Landscape: From Phishing and Scams to Fake AI Tools,” which warns that the illusion that small and medium-sized businesses can go unnoticed by cybercriminals has become obsolete. As organizations advance in their digital transformation and the cost of carrying out cyberattacks declines, cybercriminals are targeting growth-stage companies.
According to the research, only 14% of SMEs with fewer than 500 employees globally managed to avoid a cyber incident in the last twelve months. In Spain, the SME segment analysis yields an identical figure, placing 86% of organizations that suffered cyberattacks during the same period.
According to Kaspersky’s report, the analyzed organizations experienced an average of 3.2 different security incident types over the year. In the Spanish market, the study identifies phishing as the most recurring threat among SMEs, having affected 27% of the surveyed companies, a figure higher than the global average for this segment (20%). Following this vector are mass malware attacks, invoice or payment fraud, and the unauthorized use of remote administration tools, each recorded by 22% of SMEs in Spain.
The study highlights that 20% of Spanish SMEs faced corporate email compromise (BEC) attacks, supply-chain cyberattacks, external remote access incidents, and espionage activities, while 17% suffered breaches tied to exploiting vulnerabilities in AI tools.
When examining internal factors that increase the risk of successful cyberattacks, the Kaspersky study shows differences between the Spanish market and the international context. In Spain, the three issues most cited by SMEs are the insufficiency of corporate cybersecurity policies, the lack of leadership from executive management on security, and employee fatigue caused by alert overload, each noted by 30% of the surveyed companies. It also notes that 22% of Spanish SMEs attribute their vulnerabilities to the lack of staff knowledge in security.
