2023 Year in Review: The Changing Face of SMB Cyber Risk

2023 in Review

The threat landscape continued to evolve in 2023, with several trends impacting small and mid-sized businesses:

Ransomware Evolution Ransomware groups became more sophisticated, targeting supply chains and MSPs. Double extortion (encrypt + leak) became standard practice.

Identity Attacks Dominated Credential theft and abuse overtook traditional exploitation as the primary attack vector. MFA bypass techniques matured.

AI Entered the Chat Both attackers and defenders began leveraging AI. Phishing became more convincing; detection improved but so did evasion.

Regulatory Pressure Increased New SEC rules, state privacy laws, and cyber insurance requirements raised the bar for security compliance.

Key Takeaways for SMBs

1. Identity is the new perimeter — MFA and identity monitoring are essential
2. Continuous testing is necessary — Annual pentests aren't enough
3. Supply chain risk is your risk — Vet vendors and monitor third-party access
4. Insurance requires evidence — Documentation and testing are prerequisites

Looking Ahead to 2024

Expect continued focus on identity security, AI-powered attacks and defenses, and increased regulatory requirements. MSPs who can deliver comprehensive, continuous security will thrive.