Posted by Mumbai: There’s a growing need for advanced and purpose-built protection for SMBs in APAC and globally, according to a new global survey. As SMBs increasingly become a battleground for digital threat actors, understanding the true operational and financial impact of security breaches has never been more critical.
Kaspersky’s new global survey draws attention to the key security gaps of companies below 500 employees and highlights critical risk areas.
An overwhelming 87% of SMBs in APAC suffered at least one cyber incident in 2025, as per an IT and IT security professionals poll from SMB sector in APAC. Among them, the top threats cited as the most damaging were software vulnerability exploits (10%), mass malware attacks (7%), and external remote access (7%).
The consequences of these incidents extend well beyond financial losses. Among SMBs in APAC that experienced a cyber incident, the most harmful attacks resulted in the theft of clients’ personal data (25%), temporary disruption of client-facing services like websites and online stores (23%), and theft of employees’ personal data (23%).
The survey also highlights the irreversible nature of some of the damage: 21% of companies reported financial loss an equal percentage faced irrecoverable data loss, while 13% suffered irreversible damage to corporate assets. This underscores the long‑term risks that cyber incidents pose to SMBs.
Adversaries’ Primary Objectives
Attackers are heavily focused on business and personal data theft, respondents said. Stealing clients’ personal data identified as the leading objective of attackers in APAC (34%). Sensitive internal information such as financial credentials, legal documents, etc (31%) was the second motive of attackers.
While, employees’ personal data (27%), and preventing employees and clients from accessing online resources (23%) came as third and fourth on the cyber attackers‘ list of purpose. This reflects a strategic shift toward extracting valuable data that can be monetised or leveraged for further attacks.
Most Targeted Departments
Kaspersky’s APAC data shows that cybercriminals concentrate their efforts on IT and IT‑security teams, with 51% of the most harmful attacks directed at IT and 52% at IT‑security departments. Customer service and accounting and finance departments were the next most targeted areas, at 22% and 20% respectively.
Actions taken
Recent breaches have compelled companies to implement additional cybersecurity measures across processes, people, and technologies. The top priority for APAC companies has been deploying IT security monitoring solutions (24%), strengthening cloud security controls (24%), and hardening third-party compliance requirements (24%).
Investing in specialised training to boost IT staff expertise (22%), deploying security solutions on all employees’ devices (22%), revising password policies (22%), and implementing multi-factor authentication (22%) are among other priorities.
“Cyber incidents often inflict far more devastating consequences on small and medium-sized companies than high-profile breaches do on large corporations. Sometimes, it can threaten the very survival of these resource-constrained businesses,” comments Ilya Markelov, Head of Unified Platform Product Line, Kaspersky.
“Faced with diverse and intense threats, operational constraints, and specific growth objectives, SMBs urgently need scalable, purpose-built protection,” added Markelov.
“Faced with diverse and intense threats, operational constraints, and specific growth objectives, SMBs urgently need scalable, purpose-built protection. Kaspersky Next Optimum, our flagship offering for this segment, is engineered to bring expert and flexible security within reach for growing businesses
“Our findings highlight the increasingly complex and diverse range of cyberthreats facing businesses across APAC, underscoring the importance of cyber resilience. While the risks and attack methods vary across market, from software vulnerability exploits and phishing to mass malware attacks, their impact can be felt across the business,” commented Adrian Hia, MD for Asia Pacific, Kaspersky.
“A single incident can compromise sensitive information, interrupt day-to-day operations and weaken customer trust. Cybersecurity is therefore not confined to IT, and addressing these risks require a combination of the right technology, strong security awareness, and consistent cyber hygiene being embedded into every business practice,” added Hia.