Ask a small-business client whether they have a security plan, and the odds say yes: 83% of small and medium-sized businesses (SMBs) report having a cybersecurity strategy. Ask who worked through it this year, what closed, and what the rest will cost, and the call goes quiet. In the same survey, the SMBs with a plan were just as likely to suffer a breach as those without one (CrowdStrike, 2025).
The client has a plan nobody runs. The assessment happened, the report arrived, and nobody took ownership of the findings, set a schedule, or put the fixes on a budget line. Cybersecurity Awareness Month gives you a scheduled, non-sales reason to call every client in October, put last year’s findings on one page (found, fixed, still open), and price the open column as monthly work.
This page collects the primary-source statistics behind that position: how many small businesses run a security assessment, what happens to the findings, and who owns the follow-through. It also covers what service providers report when an assessment becomes a program, with results from Cynomi’s own State of the vCISO research.
Key Statistics on SMB Security Assessments
- The share of UK small businesses running a cyber risk assessment fell from 48% to 41% in a year (UK Cyber Security Breaches Survey 2025/26).
- Among UK businesses that outsource security, 23% lack confidence they can judge whether their provider offers value for money (UK cyber skills report, 2025).
- Only 54% of edge-device vulnerabilities were fully remediated during the year, across organizations of all sizes (Verizon Data Breach Investigations Report (DBIR), 2025).
- Nearly half of service providers, 48%, call risk assessments an easy upsell driver for other services (Cynomi State of the vCISO, 2025).
- Cynomi partner Burwood reports converting 40 to 50% of assessed clients into vCISO engagements (Burwood case study).
- In the past 12 months, 45% of SMBs faced a cybersecurity incident (ESET SMB Cyber Readiness Index, 2026).
How Many SMBs Run a Cybersecurity Risk Assessment
Start October with the simplest question: does the client have a current assessment at all? The UK government asks it every year, and most businesses answer no. The rows below come from three survey editions, and larger organizations are more likely to have run one:
| UK organization type | Ran a cyber risk assessment in the past 12 months |
|---|---|
| All businesses, including micro (2025/26) | 30% |
| Charities (2025/26) | 27% |
| Small businesses (2025/26) | 41% |
| Small businesses (2024/25) | 48% |
| Medium businesses (2024) | 63% |
| Large businesses (2024) | 72% |
- Only 30% of all UK businesses ran a risk assessment covering cybersecurity in the past 12 months (UK Cyber Security Breaches Survey 2025/26).
- UK charities trail businesses, with 27% running a cyber risk assessment in the same period (UK Cyber Security Breaches Survey 2025/26).
- In 2024, 63% of UK medium businesses and 72% of large businesses had run a cyber risk assessment (UK Cyber Security Breaches Survey 2024).
- 56% of organizations surveyed say they use a formal risk management framework, such as the National Institute of Standards and Technology (NIST) Risk Management Framework (CompTIA, 2025).
If your book looks like the UK average, about 4 in 10 small-business clients have an assessment from the past year and the rest start October with nothing current to compare against. Both groups get the same call, and the second group’s new assessment becomes next year’s baseline. An assessment that never gets repeated is the earliest sign that nobody is running the plan.
SMB Security Plans and Breach Outcomes
When a client tells you they have a security plan, ask who is running it. Confidence is high across small businesses, incidents are common, and a written incident response plan is the exception.
- SMBs with a cybersecurity strategy, 83% of those surveyed, were as likely to suffer a breach as those without one (CrowdStrike, 2025).
- In the US, 87% of SMBs feel confident, at least slightly, in their cyber resilience (ESET North America Cyber Readiness Index, 2026).
- Canadian SMBs report similar confidence, with 83% at least slightly confident in their cyber resilience (ESET North America Cyber Readiness Index, 2026).
- In the past 12 months, 54% of US SMBs had a cybersecurity incident (ESET North America Cyber Readiness Index, 2026).
- More than one incident in the past 12 months was reported by 14% of the 4,400 SMB decision-makers surveyed (ESET SMB Cyber Readiness Index, 2026).
- Only 25% of UK businesses have a formal incident response plan (UK Cyber Security Breaches Survey 2025/26).
- UK micro businesses sit furthest behind, with 21% holding a formal incident response plan, against 76% of large businesses (UK Cyber Security Breaches Survey 2025/26).
- Among UK medium-sized businesses, 57% have a formal incident response plan (UK Cyber Security Breaches Survey 2025/26).
NIST’s guide for conducting risk assessments treats assessment as ongoing work, repeated at a frequency matched to its purpose and scope. CrowdStrike’s result fits a client who ran one assessment and filed it. The plan exists, and on its own it did not change the odds of a breach. Bring the list of findings that closed since the plan was written. That list is the only proof anyone is running it.
Who Owns SMB Security After the Assessment
A findings list closes only when someone owns it. The UK data shows how few businesses put anyone in that seat, and how many now hand it to an outside provider.
- Only 31% of UK businesses have a board member with explicit responsibility for cybersecurity (UK Cyber Security Breaches Survey 2025/26).
- In UK micro businesses, the person looking after cybersecurity is rarely in an IT role (3%); most often it is the owner, chief executive or another senior manager (UK Cyber Security Breaches Survey 2025/26).
- External providers are picking up the work, with 44% of UK micro businesses now using one, up from 39% (UK Cyber Security Breaches Survey 2025/26).
- A basic cyber skills gap affects 49% of UK businesses (UK cyber skills report, 2025).
- At the advanced level, 30% of UK businesses have a cyber skills gap (UK cyber skills report, 2025).
- Some element of cybersecurity is outsourced by 31% of UK businesses (UK cyber skills report, 2025).
- Of the UK businesses that outsource cybersecurity, 23% cannot confidently judge whether their provider offers value for money (UK cyber skills report, 2025).
At a small client where security sits with the owner rather than a board or an IT role, yours may be the only name against the findings list. A one-page view of what closed since last year is the value-for-money evidence nearly a quarter of UK outsourcing clients are missing, and it comes from work you have already done. Skip it, and the client is paying you to hold a plan nobody runs.
What Open Security Findings Cost SMBs
Exploited vulnerabilities are one of the leading ways attackers get in, across organizations of every size, and that is where unclosed findings turn into incidents.
- Only 54% of edge-device vulnerabilities were fully remediated during the year, across organizations of all sizes (Verizon DBIR, 2025).
- Exploitation of vulnerabilities was the initial access vector in 20% of breaches, across organizations of all sizes (Verizon DBIR, 2025).
- At SMBs, ransomware was present in 88% of breaches, against 39% at large organizations (Verizon DBIR SMB snapshot, 2025).
- Exploits were the most common initial infection vector for the sixth straight year, at 32% of intrusions investigated (Mandiant M-Trends, 2026).
- At SMBs, 55% of breaches involved a third party (Verizon DBIR, 2026).
- The human element was present in 62% of all breaches, up from 60% a year earlier (Verizon DBIR, 2026).
- Between 2020 and 2025, submissions to the Common Vulnerabilities and Exposures (CVE) program rose 263% (NIST, 2026).
- Small organizations (fewer than 250 employees) hit by a cyber attack face incident costs of around $52,000 a year on average (Hiscox Cyber Readiness Report, 2026).
A small organization that gets hit carries about $4,300 a month in incident costs, on Hiscox’s $52,000 annual average. Open findings that nobody works still carry a cost: the client either pays you to close them or carries the risk of that bill alone. Cynomi’s MSP cybersecurity statistics cover breach costs and the wider threat picture.
MSP Risk Assessment Revenue in the State of the vCISO
Security leadership has become a standard line on the service menu, and the demand behind it is still climbing. The survey covered 200 senior leaders at US and Canadian service providers, half MSPs and half MSSPs, through Global Surveyz in May 2025.
- Two-thirds of MSPs and MSSPs (67%) now offer vCISO services, up from 21% in 2024 (Cynomi State of the vCISO, 2025).
- Combined high and moderate demand for vCISO services reached 96% in 2025, up from 94% in 2024 (Cynomi State of the vCISO, 2025).
Offering the service is now the norm. The providers who stand out keep the plan running after the first assessment.
Benefits of adding risk assessments for MSPs
For many providers, the assessment is the way in to the rest of what they sell. Asked what adding risk assessments does for the business, they named these benefits:
| Benefit of adding risk assessments | Share of service providers (Cynomi, 2025) |
|---|---|
| Easy upsell of other products and services | 48% |
| Differentiation from competition | 44% |
| Improving customer security | 44% |
| Growing recurring revenue | 37% |
| Expansion to new customers | 35% |
| Increased margins | 29% |
Easy upsell tops the list, and a reassessment opens that door a second time with a client who has already seen your results. For the 37% who count growing recurring revenue as a benefit, the reassessment is the natural point to put the open findings on a monthly contract. That contract lasts as long as the plan keeps running.
Expected benefits of adding vCISO services
Providers that don’t yet offer vCISO services expect a similar mix of benefits from adding them:
| Expected benefit of adding vCISO services | Share of providers not yet offering them (Cynomi, 2025) |
|---|---|
| Easy upsell of other products and services | 44% |
| Differentiation from competition | 41% |
| Increased margins | 39% |
| Enhanced client engagement | 38% |
| Growing recurring revenue | 37% |
| Improved customer security | 36% |
- Half of providers not yet offering vCISO services (50%) planned to add them by the end of 2025, and 27% were targeting 2026 (Cynomi State of the vCISO, 2025).
- Among MSPs and MSSPs without vCISO services in 2024, 98% planned to add them (Cynomi State of the vCISO, 2024).
- Improved customer security was the top business benefit of offering vCISO services in 2024, cited by 46% of providers that offer vCISO services (Cynomi State of the vCISO, 2024).
- In 2024, increased client engagement ranked second among vCISO business benefits at 44%, ahead of increased margins at 37% (Cynomi State of the vCISO, 2024).
Margins and engagement both depend on the client still being there after the first report. Sell vCISO services that stop at the assessment report, and you have sold the client another plan nobody runs.
Where MSPs see AI value in security assessments
Providers who see AI value point to the same three jobs a reassessment runs on: assessing, planning remediation, and talking to the client.
- Risk and security assessment is where 37% of service providers see AI value (Cynomi State of the vCISO, 2025).
- For remediation planning, 34% of service providers see AI value (Cynomi State of the vCISO, 2025).
- Client communication ranks highest of the three, with 39% of service providers seeing AI value there (Cynomi State of the vCISO, 2025).
Remediation planning is the step where last year’s open findings become this year’s roadmap, and it is the step that gets skipped when nobody owns the plan. Point AI at ranking and scheduling the open items, and the reassessment becomes a program with dates on it.
Barriers to Offering vCISO Services for MSPs
If you haven’t added vCISO services yet, the obstacles other providers name are mostly about money and people:
| Barrier to offering vCISO services | Share of providers not yet offering vCISO services (Cynomi, 2025) |
|---|---|
| Concerns about profitability or return on investment | 35% |
| High initial investment | 33% |
| Lack of skilled cybersecurity personnel | 32% |
| Limited demand from clients | 29% |
| Limited headcount | 26% |
| No processes in place | 17% |
- Only 52% of smaller providers (51–199 employees) offer vCISO services, against 80% of providers with 1,000 or more employees (Cynomi State of the vCISO, 2025).
- Lack of technology topped the 2024 list of challenges to offering vCISO services at 29%, followed by lack of security and compliance knowledge at 26% (Cynomi State of the vCISO, 2024).
- Lack of skilled personnel was cited by 24% as a challenge to offering vCISO services (Cynomi State of the vCISO, 2024).
- Nearly all MSPs and MSSPs (93%) feel overwhelmed by cybersecurity frameworks such as NIST or ISO (Cynomi State of the vCISO, 2024).
- Regulatory compliance frameworks such as PCI DSS or the General Data Protection Regulation (GDPR) overwhelm 74% of MSPs and MSSPs (Cynomi State of the vCISO, 2024).
Last year’s stalled plan is also the cheapest program you can start. A reassessment reuses last year’s questions and findings with a client you already know, so it asks for fewer specialists, less headcount, and less new process. The top two barriers are money questions, and the market already sets a reference price.
vCISO Pricing and Assessment Conversion Results
When you price the open findings as monthly work, start from what the market already charges for security leadership. Then look at what partners earned by turning assessments into programs.
- vCISO retainers usually run from about $2,600 a month at the low end (Cynomi vCISO cost guide).
- For complex or regulated environments, retainers run $11,600 a month or more (Cynomi vCISO cost guide).
- Cynomi partner Burwood reports that 40 to 50% of its assessed clients convert into vCISO engagements, with the assessment treated as the first step in the relationship (Burwood case study).
- After moving client security reporting onto Cynomi, partner Net Friends went from no win rate to winning roughly 35–40% of proposals (Net Friends case study).
Other Cynomi partners report these results from standardizing assessments and security programs:
| Cynomi partner | Reported result |
|---|---|
| Model Technology Solutions | 60% increase in upsell revenue and 75% faster assessments |
| Model Technology Solutions | 20% growth in customer base after making assessments consistent and scalable |
| CA2 Security | 40% less assessment time after moving off spreadsheets |
| CA2 Security | A renewal rate of “basically 100%” |
| ECI | 30% higher margins on GRC services |
| DeepSeas | More than 100 clients in under two years, with onboarding 50% faster |
Five converted clients at the roughly $2,600 low-end retainer come to about $13,000 a month in recurring revenue. Run the open items as a security program with a review on the calendar, so the findings don’t sit until next October.
Start an SMB Security Reassessment Before October Ends
Pick five clients this week and pull last year’s findings. Rerun the same questions so the comparison holds, and give clients with no prior assessment a baseline from a cybersecurity risk assessment template. Walk each owner through one page (found, fixed, still open) before their budget closes, and price the open column as a monthly service with a first term of two quarters.
The Cybersecurity and Infrastructure Security Agency (CISA) repeats in its 2026 Cybersecurity Awareness Month toolkit that no business is too small to be a target, and your clients will hear that message all month. The joint CISA and Five Eyes advisory on MSPs tells customers to write baseline security controls into their MSP contracts. The one-page comparison shows each client which findings your contract has closed and which are still open.
Tracking which findings closed, and what each client sees every month, is the step that breaks as your client list grows. With Cynomi, the Security Growth Platform, your team keeps each client’s findings in a tracked roadmap the client can see. CISO Intelligence ranks the open items by business impact, so the findings you reopen this October stay on the agenda through next year.
Table of contents
