Too small to be ignored? Not anymore. Why shoring up cyber defenses is crucial for small businesses

These days, there’s nothing small about small business. The global economy has always stood on the shoulders of small businesses, and the digital revolution is enabling them to grow beyond Main Street into the world marketplace.

But a larger digital footprint brings risks as well as opportunities — risks that small business owners, who long considered themselves beneath the notice of cybercriminals, are now painfully, and in many cases, personally, aware of.

A forthcoming Mastercard survey of more than 5,000 small and medium-sized business owners across four continents reveals that 46% have experienced a cyberattack on their current business, and nearly one in five that suffered an attack then filed for bankruptcy or closed their business.

The impact of these attacks — most commonly hacking, malware and phishing, according to the survey — puts a financial strain on businesses. Productivity suffers. Reputational damage lingers: Following an attack, 80% said they had to spend time rebuilding trust with clients and partners.

Upping their cyberthreat posture is now a priority for small businesses, and 86% of small and medium-sized businesses have conducted an active cybersecurity risk assessment and have a cyberattack prevention plan. But only 23% are very satisfied with their plan, and only 23% again are very confident in their ability to identify threats. In other words, they know enough to know they don’t know enough.

And cybercriminals know this. With budget and other resources typically dedicated to growing their business rather than protecting it, owners are often their own IT experts. Among their biggest challenges — their own workers, who are the front line in cyber defense and sometimes the weak link as well. In the survey, 73% of these business owners say getting employees to take cybersecurity seriously is a challenge, and only a quarter are very confident in their ability to educate employees on cybersecurity best practices.

They need support. This is an increasingly large part of our mission to help small businesses securely pay, get paid, access capital and digitize their operations. Since 2020, Mastercard has brought more than 50 million small businesses into the digital economy. But only trust will keep them there.

That’s why we’re partnering with other cybersecurity experts and investing in innovation that simplifies yet strengthens cybersecurity approaches so small business owners can focus on what they do best — serving their customers. For example, we’ve customized our flagship RiskRecon vulnerability scanner for small businesses through My Cyber Risk, enabling them to pinpoint, prioritize and act on cybersecurity threats to their websites or apps.

Launched in February, the Mastercard Business Builder program offers credit and debit cards for small businesses with cybersecurity services that help them protect themselves from fraudsters and provide  enterprise-grade security technology and expertise. It includes, among other benefits, ID Theft Protection, which provides monitoring, alerts and resolution services to help protect against identity theft.

Though most people associate identity theft with the misuse of personal information, it can and does happen to businesses. Fraudsters can use the identities of business owners or employees to falsely apply for loans, file fake tax refunds or even steal rights to a company’s intellectual property. That’s why we’ve focused the power of open finance on small businesses, with tools that can confirm ownership of accounts, verify account holder identity and even validate the device being used when a small business opens and funds a financial account.

We’re also bringing scale to cybersecurity through new partnerships. For example, with global cyber company VikingCloud, we’re combining Mastercard’s own highly developed risk scoring and evaluation capabilities with VikingCloud’s cybersecurity remediation solutions for its millions of merchant locations worldwide. With CyberMonks, we launched a marketplace for businesses of all sizes to easily find and seamlessly implement tailored cybersecurity and risk management solutions.

As technology evolves and threats change, ongoing education that meets businesses where they are is also crucial. The Mastercard Trust Center is a platform that helps small business owners access research, resources and tools for free in collaboration with our longstanding partners the Global Cyber Alliance, Cyber Readiness Institute, and National Cybersecurity Alliance.

By working together, we can create a safer ecosystem for small businesses. After all, security isn’t just about defense — it’s about enabling growth. The trust it creates is what helps small businesses operate with confidence and thrive without fear. 

Johan Gerber is Mastercard's executive vice president of Security Solutions. Jane Prokop is Mastercard's global head of Small and Medium Enterprises.