Most SMBs Think They’re Ready. The Operational Data Says Otherwise.
We measured what’s actually happening inside managed SMB environments — not what business owners believe is happening. The gap between the two is the story.
Corporate Technologies Research · Published April 2026 · Eden Prairie, MN
Think your IT is in good shape?
Take the free 3-minute readiness quiz
The opening premise of most IT security discussions goes like this: SMBs are underprepared, and they know it. The reality is more uncomfortable. They are underprepared, and most of them believe the opposite.
Read the Full Index
Devolutions’ 2025 State of IT Security report found that 71% of SMBs express confidence in their ability to handle a cyber incident. Only 22% have a security posture that could actually survive one. CrowdStrike’s 2025 survey drove the point further: incident rates are nearly identical for SMBs with security plans and those without — 25% versus 24%, respectively. Having a plan and executing a plan are not the same thing, and for most small businesses, the gap between those two things represents their entire margin of error.
This index was built to close that gap in measurement. It combines anonymized, aggregated operational data from our managed SMB client base with external industry benchmarks sourced from more than 40 published studies. The goal is to replace what business owners assume with what the systems are actually reporting.
“Most SMBs don’t lack awareness — they lack measurement. This index exists to replace assumptions with operational evidence, and to give business owners a benchmark they can actually act on.”
— Jim Griffith, CEO, Corporate Technologies
Why Surveys Get It Wrong
The majority of SMB technology benchmarks are built on self-reported survey data. This is a structural problem. Social desirability bias — the documented tendency for respondents to overstate positive behaviors and minimize vulnerabilities — systematically inflates the picture. SolarWinds found that 87% of businesses rate their cyber defenses as average or better, yet 71% had suffered at least one breach in the prior year. Sophos found that 69% of ransomware victims believed they were well-prepared before the attack.
Operational data removes that distortion entirely. Patch compliance is measured by automated timestamp, not recalled from memory. A backup either ran successfully or it failed — the log doesn’t negotiate. Uptime is tracked continuously, not estimated in a survey response. The index reflects Q4 2025 operational data across our full active SMB client base, measured against U.S.-focused industry research published between 2024 and 2026.
“No amount of tools matters if you don’t measure real outcomes. SMBs are spending more on cybersecurity than ever, but spending and readiness are not the same thing.”
— Jim Griffith, CEO
The Five Pillars — What We Found
Availability & Downtime
The ITIC 2024 Hourly Cost of Downtime Survey found that 90% of organizations require 99.99% uptime — no more than 52 minutes of unplanned downtime annually. The average SMB delivers roughly 99.84%, or about 14 hours per year. That gap, tenfold, sits quietly inside most businesses as an unexamined financial exposure.
Across the managed client base, the average outage rate in Q4 2025 was 0.294 per client per quarter — approximately 1.18 per year, compared to an industry average of roughly five. Average outage duration was 132 minutes, within the range of hardware and software failure, and well below the 8 to 24 hours typical of ransomware-related incidents. All recorded outages occurred during business hours, consistent with systems surfacing failures under active load rather than after-hours intrusions.
| 1.18 Outages per year (managed) | ~5 Industry average outages/year | 132 min Avg outage duration | 4× Lower frequency vs. industry |
“The concentration of outages during business hours is consistent with what we see operationally. Hardware and software failures tend to surface under active load. The fact that we’re not seeing after-hours incidents is a direct reflection of 24/7 monitoring catching threats before they trigger outages.”
— Ben Silver, Chief Operating Officer
Backup & Disaster Recovery
Backup readiness is the most consequential section of this index, and the most sobering. Within the managed client base, 71% of clients have automated backups — more than double the roughly 30% industry rate of full automation. Sixty percent have offsite or cloud replication. By those measures, performance is strong relative to a market where 75% of small businesses have no documented disaster recovery plan at all.
The problem is what comes after the backup runs. Only 5% of clients have both documented recovery point and recovery time objectives, and only 5% have conducted a tested restore within the last 90 days. Industry benchmarks, already low, place RPO/RTO documentation at 25 to 35% of SMBs and restore testing at 54% for organizations that have ever tested. The managed environment is below both figures, by a significant margin.
“The RPO gap is where the real risk hides. Because only 5% of clients have a defined recovery point objective and many rely on daily or infrequent backups, organizations face a significant risk of losing a full day or more of business data when an incident occurs. Most don’t discover that gap until they’re in the middle of a crisis.”
— Katie Kelly, Director of Integration Services
This matters in the context of how ransomware now operates. Veeam’s 2024 Data Protection Trends Report found that 93 to 96% of ransomware attacks target backup repositories directly. Backup frequency and backup survivability are different things, and most SMBs are operating as if they’re the same.
| The four false assumptions Kelly identifies during onboarding: Clients assume their backups cover all data — they often don’t. They assume all backups are equal, when immutable and mutable backups have fundamentally different survival rates against ransomware. They assume offsite replication is unnecessary. And they treat backup as synonymous with business continuity, which it is not without tested recovery procedures and documented objectives. |
Cyber Resilience
The Verizon 2025 Data Breach Investigations Report found that ransomware features in 88% of all SMB-related data breaches, compared to 39% for large enterprises. Forty-seven percent of small businesses under $10 million in revenue were hit by ransomware in the past year. This is not a risk category that SMBs can afford to treat as a large-enterprise problem.
Multi-factor authentication adoption across the managed client base stands at 63%, roughly 1.7 times the industry average of 34 to 40%. Patch compliance is 94% for endpoints, 99% for servers, 99% for firewalls, and 100% for M365 and core SaaS applications. In Q4 2025, 12,977 ransomware attempts were blocked across the client base. An additional 379 security incidents required human escalation.
“Nearly 13,000 blocked attempts in a single quarter should settle any debate about whether SMBs are being targeted. These are not hypothetical risks. They are hitting the perimeter constantly.”
The gaps that remain are not incidental. At 63%, MFA adoption still leaves 37% of users without what Microsoft has identified as the single control that would have prevented 99.9% of compromised accounts. EDR and MDR coverage at 53% means nearly half of endpoints lack advanced threat detection. In an environment where patching is near-universal, those remaining gaps represent the highest-probability attack surface.
| Metric | Managed | Industry |
| MFA adoption | 63% | 34–40% |
| EDR/MDR coverage | 53% | 25–40% |
| Endpoint patch compliance | 94% | ~40–60% within 30 days |
| Server patch compliance | 99% | 77% take >1 week |
| Ransomware attempts blocked (Q4) | 12,977 | No comparable metric |
Operational Maturity
There are an estimated 10,000 to 40,000 managed service providers in the United States. According to ConnectWise, 27% of them have between one and five employees. The barriers to claiming MSP status are low; the requirements for delivering enterprise-grade support at scale are not. This context matters when interpreting any benchmark that originates from a managed environment.
“Anyone with a few solar panels and a battery system could theoretically resell power. As a business owner, would you rely on that company to keep the lights on every day? The same is true for IT.”
— Jim Griffith, CEO
Patch enforcement across the managed client base is 100% for endpoints, servers, firewalls, and M365 applications. In an industry where Automox reports that 60% of breached organizations cite an unpatched known vulnerability as the root cause, and 77% of organizations take more than a week to deploy patches, universal enforcement is not a minor operational detail — it eliminates the most common ransomware entry vector.
Financial Impact
For a 50-employee firm at $10 million in annual revenue, the base scenario hourly downtime cost is approximately $12,500 — combining revenue-per-hour losses with fully loaded compensation of $60 per hour. At the industry-average 14 hours of unplanned downtime annually, that produces roughly $175,000 in direct losses per year, before recovery labor, compliance penalties, or reputational damage. The sensitivity range runs from $105,000 to $280,000 at the low and high ends of the hourly cost assumption.
At 1.18 outages per year with an average duration of 132 minutes, a managed client at the same firm size faces approximately 2.6 hours of downtime annually — roughly $32,500 in modeled cost at the base scenario. The managed model reduces downtime cost by approximately 80% relative to industry averages. The annual differential of roughly $142,000 exceeds the typical cost of managed IT coverage for a firm of this size.
“The financial case for standardization isn’t just about reducing the total cost — it’s also about reducing variance. When you narrow incident-driven spending and move to a predictable model, you improve forecast accuracy. That shift from reactivity to predictability is worth just as much to a CFO as the raw cost savings.”
— Sam Mahn, Chief Financial Officer, Corporate Technologies
The financial model is conservative. It accounts only for direct revenue and productivity losses during the outage itself. It doesn’t include recovery labor, data reconstruction, compliance penalties, or customer attrition. And it doesn’t model the avoided cost of a ransomware incident — where SMB-specific recovery costs range from $250,000 to $1.5 million for a minor-to-moderate event. Sophos puts the average 2025 recovery cost at $1.53 million across all sizes. The median U.S. SMB holds approximately $12,100 in cash reserves. The average cyber insurance claim for a small business reached $264,000 in 2025. One in five SMBs that suffer a cyberattack subsequently files for bankruptcy or closes.
| On cyber insurance: Premiums for SMBs average $1,500 to $1,740 per year for $1 million in coverage. Approximately 40% of claims filed are denied. 82% of those denials involve organizations that could not document verified MFA compliance. Purchasing a policy and qualifying for a payout are different things. |
What “Good” Actually Looks Like
Resilience is not binary, and the appropriate target depends on industry, regulatory environment, and risk tolerance. A 15-person marketing agency and a 120-person medical device manufacturer face different threat profiles. The following three-tier framework provides a practical benchmark for where an organization stands and what it should build toward.
| Tier 1 Baseline — Survive an Incident |
| Automated backups running on a defined schedule with offsite replication. MFA enabled on all business-critical systems. Patching deployed within 30 days. A basic incident response plan in writing with contact information and initial response steps defined. Cyber insurance in place with coverage validated against the organization’s actual security posture. This tier doesn’t make an organization resilient — it makes it recoverable. |
| Tier 2 Structured — Recover Predictably |
| RPO and RTO targets formally documented for all business-critical systems. Restore procedures tested at least quarterly. EDR or MDR deployed across all endpoints, with 24/7 monitoring and defined escalation SLAs. Help desk performance measured against concrete metrics. Privileged access managed through a centralized system rather than spreadsheets. Organizations at Tier 2 can predict their recovery timeline with reasonable accuracy. |
| Tier 3 Resilient — Withstand and Adapt |
| Immutable backups that ransomware cannot encrypt or delete. 100% MFA coverage across all users and systems. Incident response tested annually through tabletop exercises that simulate ransomware, data exfiltration, and extended outages. Cyber insurance compliance actively maintained with documented evidence. Quarterly performance reviews with the MSP using index-level metrics and trend data. At this level, the organization measures its own defenses and improves them systematically. |
Most SMBs in this index currently operate between Tier 1 and Tier 2. Strong performance on automation, patching, and threat blocking, with significant gaps in recovery documentation, immutable backup coverage, and universal MFA deployment. Closing those gaps is measurable quarter over quarter — which is the point.
A Note on MSP Selection
The outcomes documented in this index reflect the capabilities of a scaled MSP with dedicated teams for help desk, remote monitoring, project work, and technology roadmap services. Those capabilities are not universal across the MSP market. SMBs evaluating IT partners should ask three direct questions: How many employees do you have? Do you actually staff all 168 hours per week for 24/7 support? Are there dedicated teams for distinct functions? The answers will separate providers capable of delivering these outcomes from those that cannot.
“IT services for the SMB market should be identical to what enterprise businesses experience. With the right partner, that’s achievable regardless of company size. What matters is the size and capability of the MSP, not the size of the client.”
— Jim Griffith, CEO
| Read the Full Index Complete pillar-by-pillar analysis, financial modeling methodology, 90-day action framework, and a self-assessment checklist. DOWNLOAD THE Q1 2026 REPORT → |
Internal data reflects Q4 2025 (October–December 2025) and covers the full active SMB client base. All data is aggregated and anonymized. Internal operational metrics were reviewed and validated by Ben Silver, Chief Operating Officer. Financial modeling assumptions were reviewed by Sam Mahn, Chief Financial Officer.
External benchmarks sourced from Verizon DBIR, IBM Cost of a Data Breach Report, Sophos State of Ransomware, Kaseya/Unitrends, ITIC, CrowdStrike, Devolutions, Veeam, NetDiligence, and others. Full source list in the report appendix.
Financial exposure estimates are modeled scenarios for planning purposes and should not be interpreted as outcome guarantees. Published by Corporate Technologies, Eden Prairie, MN. gocorptech.com
