Confidence needs evidence
The National Cybersecurity Alliance published its 2026 Small Business Cybersecurity Awareness & Practices Survey on August 7. Developed with the US Cybersecurity and Infrastructure Security Agency, the report draws on responses from 1,000 small and medium-size business leaders across ten industries. Its central message is uncomfortable but useful: many leaders feel confident about cybersecurity while lacking evidence that controls are working consistently.
The publisher says more than half of respondents could not confirm a clean security record. It also highlights a recurring operational problem: owning a security tool is not the same as configuring, monitoring, and testing it correctly. AI use has introduced another gap because employees and teams can adopt useful services faster than management can define approved tools, data rules, and incident procedures.
These are survey findings from a US sample, not a measurement of every SME in Europe or Latin America. They should be treated as a warning signal and a prompt to verify local controls, rather than as a universal breach-rate estimate.
What happened
The report organizes its findings around the difference between perceived and actual readiness, the correct use of available tools, AI governance, company size, industry, and breach history. It also provides low-cost recommendations and four practices for safer AI adoption.
That framing matters. Small-business security discussions often begin with products: endpoint protection, email filtering, firewalls, backup, or cyber insurance. Real resilience depends on the operating process around those products. Someone must review alerts, remove departed users, test recovery, approve integrations, and decide what happens when a suspicious invoice or login appears.
The same principle applies to AI. A policy that says “use AI responsibly” is too vague. Employees need to know which services are approved, which customer or financial data must never be pasted into a public tool, how generated output should be reviewed, and where to report an accidental disclosure.
Why it matters for growing businesses
Growth increases exposure before it creates security capacity. A company adds employees, suppliers, cloud applications, remote access, ERP integrations, and shared mailboxes. Privileges accumulate. Informal approvals become difficult to audit. A single administrator may control email, accounting, and backups. Attackers do not need to defeat every control; they need one unprotected account or one rushed payment process.
Management should therefore replace broad confidence questions with evidence questions. Instead of asking whether backups exist, ask when the last restoration test succeeded and who reviewed it. Instead of asking whether MFA is enabled, check coverage for administrators, remote access, finance users, and recovery accounts. Instead of asking whether staff received training, review how simulated or real reports were handled.
AI adds both productivity and attack surface. It can summarize support tickets or draft customer communications, but it can also expose confidential information, produce convincing errors, or follow malicious instructions embedded in documents. Controls should cover identity, data, connectors, output review, logging, and vendor retention—not only the model prompt.
A practical 30-day control sprint
Start with five business-critical scenarios: compromised email, fraudulent bank-detail change, ransomware or destructive deletion, lost administrator access, and accidental disclosure through AI. For each one, name an owner, identify the first three containment actions, confirm the required logs and backups, and run a short tabletop exercise. Record gaps as dated tasks in the same way the company manages financial or operational work.
Create a small evidence dashboard. Useful measures include privileged accounts reviewed, MFA coverage, unresolved critical patches, backup restoration success, suspicious-email reporting time, inactive accounts removed, approved AI tools, and exceptions past their due date. A green status should mean evidence was checked recently—not that someone feels comfortable.
Practical action checklist
- Inventory critical applications, administrators, service accounts, integrations, and recovery methods.
- Require phishing-resistant MFA where possible, especially for email, ERP, banking, and administration.
- Remove inactive users and separate daily accounts from privileged accounts.
- Test restoration of one representative ERP, document, and email data set.
- Verify supplier bank-detail changes through an independent channel and dual approval.
- Publish approved AI tools, prohibited data categories, retention expectations, and a reporting route.
- Review third-party OAuth applications and connectors that can read mail, files, CRM, or accounting data.
- Assign an owner and response deadline to every material alert and control exception.
- Run one phishing and one AI-data-disclosure tabletop exercise with management and staff.
- Recheck the dashboard monthly and report unresolved risk in business language.
How VDS Consultoria can help
VDS Consultoria helps growing companies turn security expectations into workable controls across Odoo, Microsoft 365, cloud services, and connected finance processes. We can map access, improve approval and backup workflows, establish an AI-use policy, prepare incident runbooks, and build dashboards that show whether controls are operating.
The goal is not to eliminate every risk or buy every product. It is to know which systems matter, reduce preventable exposure, detect important events quickly, and recover with evidence. Confidence is valuable only when the company can show why it is justified.
Source
National Cybersecurity Alliance, “2026 Small Business Cybersecurity Awareness & Practices Survey,” August 7, 2026: https://www.staysafeonline.org/articles/2026-small-business-cybersecurity-awareness-practices-survey