Every year, we share research from our security partners to help our clients understand what the threat landscape actually looks like. Not in abstract terms, but in ways that connect to real business risk. The latest report from our cybersecurity research partners at SonicWall offers some of the most important findings we’ve seen in years.
Rather than simply cataloging how many attacks occurred, this year’s report focuses on protection outcomes, including why businesses actually get breached, and what the gap between protected and exposed really comes down to. The answer may surprise you! Most breaches aren’t the result of sophisticated, unstoppable attacks; they’re the result of seven predictable, preventable failures that the report names the Seven Deadly Sins of Cybersecurity (LINK).
As a steward of technology for Tampa Bay businesses for over 25 years, we’ve seen this firsthand. The companies that struggle after a security incident almost always had a known gap that felt manageable until it wasn’t. This report puts data behind that pattern in a way every business owner should read.
The Numbers Are Worth Paying Attention To
Before diving into the Seven Deadly Sins, it’s worth starting the conversation in what the threat environment actually looks like right now.
High and medium severity attacks surged 20.8% last year, totaling more than 13 billion hits globally. Automated bots are generating over 36,000 vulnerability scans every single second, accounting for more than half of all internet traffic. Meanwhile, malicious bot traffic now makes up approximately 37% of all global internet activity. The internet is a noisy, contested environment, and your business is operating in it whether you think about cybersecurity or not.
What makes the SMB picture particularly important is that small and medium-sized businesses represent 99% of U.S. businesses, yet they bear a disproportionate share of the ransomware burden. In 2025, 88% of SMB breaches involved ransomware. That’s more than double the rate seen at large enterprises. Bigger companies aren’t necessarily better protected, but they do tend to have more resources dedicated to closing the gaps that attackers exploit. That’s exactly what a trusted Tampa Bay IT partner does for an SMB that doesn’t have an in-house security team.
One more number worth looking at: organizations with a documented incident response plan save an average of $1.23 million per breach. That’s not a technology investment, that’s a planning investment. And it’s something any business can have.
The Seven Deadly Sins of SMB Cybersecurity
Here’s the core of the report, and the part we think every business owner and operations leader in Tampa Bay should understand.
Sin 1: Ignoring the Fundamentals
The most exploited attack surfaces aren’t exotic. They’re missing multi-factor authentication, unpatched internet-facing systems, and unchecked admin privileges. These are the basics and they’re where the majority of successful attacks begin. Solving complex challenges with simplicity starts with consistently doing the fundamentals, which eliminates the majority of your risk.
Sin 2: False Confidence
According to the report, 44% of security alerts go uninvestigated. That’s not a technology problem – it’s an attention and capacity problem. Believing your current tools are sufficient without validating their coverage creates blind spots that attackers are happy to exploit. Regular review and proactive monitoring exist precisely to close this gap.
Sin 3: Overexposed Access
When too many users have too much access, a single compromised account becomes a major incident. The report found that once an attacker gains initial access, lateral movement through a network can begin within 48 minutes. Reviewing user permissions, auditing admin access, and applying the principle of least privilege aren’t just best practices; they’re breach containment strategies.
Sin 4: A Reactive Security Posture
Security without a plan is just hope. Organizations without an incident response plan spend more to recover and take longer to do it. Tested backups, tabletop exercises, and a clear escalation path dramatically reduce the impact of any incident. The question isn’t whether something will happen; it’s how ready you’ll be when it does.
Sin 5: Cost-Driven Security Decisions
Choosing the least expensive option over the right option is one of the most common ways businesses create gaps. Identity, cloud, and credential-based attacks now drive 85% of actionable security alerts. If your security stack doesn’t address those vectors specifically, price was the wrong selection criteria.
Sin 6: Relying on Legacy Access Models
VPN vulnerabilities grew 82.5% last year, with 60% of those rated high or critical. More than 48% of breaches in 2025 involved compromised VPN credentials. If remote access at your organization still relies primarily on a legacy VPN setup without additional controls layered on top, that’s a gap worth addressing now rather than after an incident.
Sin 7: Chasing Hype Over Execution
The average enterprise runs 45 security tools. That’s not a security strategy, that’s just complexity masquerading as protection. More tools mean more time managing dashboards and less time actually defending your environment. Consolidation and consistent execution beat complexity every time. Having a good managed security partner that cuts through the noise and focuses on what actually works is one of the most important things you can do.
What This Means for Your Business
The theme running through every one of these findings is the same – the gap between protected and exposed almost never comes down to technology alone. It comes down to execution with consistent, proactive attention to the fundamentals, combined with a partner who knows what to look for and how to respond.
Big Sur’s Security as a Service was built around exactly this philosophy. We don’t sell security products and walk away. We serve as your ongoing partner, managing the fundamentals, monitoring your environment, and helping you close the gaps before they become incidents. That’s what it means to be a steward of technology for your network and your business.
If you’d like to talk through what sins you might be committing, let’s have that conversation. No pressure, no pitch, just an honest assessment from a team that’s been doing this in Tampa Bay for over two decades.