SMB Cybersecurity Gaps: Patch Delays, Mobile Risks and Practical Defenses

Many small and midsize businesses know cyberattacks are a risk but still lack basic defenses. The gap often comes down to stretched IT teams, limited budgets and a belief that a problem can wait until something breaks. Michael Caralis, Verizon’s vice president of business sales, argues that this approach leaves businesses exposed as more work and customer activity moves online.

Caralis points to concrete areas where firms can act: shorten delays in fixing vulnerabilities, train employees to recognize social engineering, protect every device that connects to the internet and prepare to detect and respond to a breach. His account draws on Verizon’s 2024 Data Breach Investigations Report, which he says found rising exploitation, ransomware and mobile malware.

Why basic defenses are delayed

Small businesses often have few people responsible for technology. In some cases, one person holds both chief information officer and chief information security officer responsibilities, leaving little time for security planning. Caralis described meeting a customer whose technology lead understood the weaknesses in the company’s security but struggled to get its chief financial officer to approve relatively modest changes.

He suggested making the business case in terms of risk and cost, and asking the company’s insurer what protections it expects. Caralis said some business insurers, including providers of cyber coverage, may require baseline safeguards such as device management and threat protection before certifying a business. The customer he described worked in healthcare and had to meet HIPAA requirements, adding to the stakes.

The example illustrates a familiar problem: recognizing a risk does not automatically secure the budget or staff time to address it. Caralis says some business owners assume that because they have not experienced a breach, existing arrangements are adequate. His view is that waiting for visible damage is a poor test of whether protections are sufficient.

Caralis oversees advanced solutions, wireless connectivity and Verizon’s vehicle-to-building business. His earlier work at the company included commercial wireline, Fios, channel programs and Internet of Things resale. He also led solution architecture and engineering teams working on integrated designs and managed services, including broadband, security and collaboration platforms.

Patch delays create an opening

One of Caralis’s clearest recommendations is to make vulnerability management routine. He cited Verizon’s 2024 report as showing a 180% increase in initial exploitation of vulnerabilities. He also said small and midsize businesses take about 55 days, on average, to fully address vulnerabilities and risks.

That delay matters because attackers can target known weaknesses while organizations work through their backlog. A consistent patch process gives teams a way to identify affected systems, prioritize fixes and track whether remediation is complete. Caralis’s figures underline the operational challenge: buying security software alone won’t close a gap if updates remain unapplied for weeks.

Employee training is another part of the baseline. Caralis said pretexting and other social engineering attacks are increasing, making it important for staff to recognize suspicious requests and understand how these attacks work. Training should accompany technical controls; employees need clear guidance on how to handle unusual messages, requests for information and unexpected access attempts.

Caralis also pointed to lower-cost security software for mobile devices and routers. Those tools can provide basic protection in places where businesses may have deployed internet-connected equipment without adding safeguards. His broader point is to build a set of complementary controls, rather than expect any one product to cover every risk.

Protect endpoints and plan for response

For firms deciding what to fund first, Caralis starts with endpoint protection. Laptops, phones and other devices that connect to the internet need some form of security capability. Smartphones deserve attention because employees use them for many work tasks and they can hold substantial business information.

Beyond endpoint and malware protection, he recommends network security, a written cybersecurity policy and a plan for responding to incidents. Businesses need a way to detect a breach and act on it, not just tools intended to prevent one. They also need to meet the security standards that apply to their industry and the information they handle.

Caralis names virtual private networks and zero trust access solutions as options, while stressing that they belong within a broader threat protection platform. Businesses should manage software updates, train employees and establish a way to identify and respond to threats. Where internal capacity falls short, he advises bringing in outside help to cover those fundamentals.

That is a practical threshold for resource-constrained teams: know which devices and systems are exposed, keep their software current, and decide who will respond when an alert turns into an incident. A plan does not require every small business to build a large security department, but it does require clear ownership and the ability to act.

Digital growth expands the attack surface

Caralis sees SMB risk rising as businesses depend more heavily on digital services. Competing and serving customers increasingly requires an online presence, while hybrid work connects employees from home over the internet. More digital transactions and more connected operations create additional systems and access points that need protection.

He says attackers can see smaller firms as targets because they may have fewer technical resources and weaker defenses. Ransomware is one way criminals seek to make money from that gap. This exposure can grow when businesses add digital tools faster than they add security measures.

Caralis says service providers can influence that imbalance. A connectivity partner may supply internet access without offering a broader security package, leaving the customer to work out protection separately. He calls on providers to explain risks in plain language, ask what a business needs to protect and describe how the proposed safeguards address those needs.

That advice applies to vendors beyond connectivity providers. SMBs should ask partners about their cybersecurity practices when those partners can access customer data or business systems. Caralis cited Verizon’s report as finding that 15% of breaches involved third parties entering through partner infrastructure, including application programming interfaces. He says he would not work with a vendor that lacked a cybersecurity policy and plan.

What Verizon’s figures suggest

Caralis highlighted several figures from Verizon’s 2024 report. Denial-of-service attacks accounted for 55% of incidents in 2023, he said; these attacks overwhelm networks or systems with traffic and can disrupt availability. He also said ransomware appeared in one-third of breaches and was the leading threat across 92% of industries.

The report also recorded a 46% increase in mobile malware attacks, according to Caralis. These figures describe different pressures: service disruption, data or system compromise, and threats reaching devices employees increasingly rely on. They make a case for treating security as part of operating a digital business, including when choosing vendors and planning new tools.

Caralis frames cybersecurity spending as supporting growth because customers and partners need confidence that their data is protected. For an SMB, the immediate work is less abstract: close known vulnerabilities, secure endpoints and networks, train staff, and rehearse how to respond. The next useful step is to check whether those basics cover every device, employee and outside provider with access to the business.