Key Insights
- SMBs represent most ransomware targets, making security breaches a major threat to cash flow and operations.
- CFIs oversee core payment channels, uniquely positioning them to help SMBs recognize and mitigate cyber risks.
- Institutions can support clients through embedded security controls, practical education, and vetted third-party referral networks.
Willie Sutton, one of the most prolific bank robbers in American history, was reportedly once asked why he robbed banks. His answer has endured: “Because that’s where the money is.” The idea — whether Willie actually said it or a journalist invented it — eventually became known as Sutton’s Law: start with the most obvious first.
Today, money rarely sits in bank vaults. It moves through payment rails, payroll systems, ACH transactions, and commercial banking accounts. Cybercriminals are applying much the same logic as Sutton did: look for the easiest path to the money. Increasingly, that path runs through small and medium-sized businesses (SMBs). We discuss the risk and what community financial institutions (CFIs) can do to support their SMB customers.
Small Businesses Are Big Targets
Verizon's 2026 Data Breach Investigations Report found that most confirmed breaches hit organizations with 1,000 or fewer employees, and roughly 96% of ransomware victims are SMBs. Attackers are looking for easy entry — and SMBs often provide it as they are having to manage an increasingly complex threat environment without dedicated security teams or enterprise-level resources.
The financial cost of that vulnerability can be significant. Verizon's companion 2026 Breach Impact Study found that for the hardest-hit 2.5% of SMBs, losses from a breach exceeded 7% of their annual revenue. Because SMBs operate on tighter margins than larger firms, even a modest breach can trigger a real cash flow crisis and jeopardize their ability to operate.
The gap is not just about resources; it is also about follow through. The National Cybersecurity Alliance's 2026 Small Business Cybersecurity Awareness & Practices Survey found that although most SMBs have security tools in place, they are not using them fully. For example, 86.8% use multifactor authentication (MFA), but only 51.1% require it across all key accounts. And while 88.4% have backups, just 61.4% have tested whether those backups restore.
Encouragingly, the same research also shows that there is demand for support. More than half of SMB leaders say they are likely to pursue free or low-cost training within the next six months. In addition, the most requested resources — employee training, leadership guidance on risk management, and incident response templates — suggest that businesses know they need support and guidance to strengthen their defenses.
Why CFIs Are Already Well-Positioned To Support SMBs
CFIs sit at the intersection of the financial activities that attackers most like to target — from payments and payroll to treasury management and cash flow. That gives institutions the visibility and opportunity to engage with their SMB customers about cybersecurity issues.
Importantly, this doesn’t require CFIs to become cybersecurity experts. In fact, many CFIs face similar resource constraints as their SMB customers and already lean on specialized third parties to supplement internal expertise.
Instead, the opportunity for CFIs is to play a valuable role by helping SMB customers understand the connection between cyber risk and financial risk, connect them to important resources, and help create a trusted cybersecurity ecosystem.
The Case for Caution
Offering cybersecurity support can create risks for financial institutions if the boundaries are unclear. For example, referring customers to a provider can create reputational exposure if that provider fails, while bundled security features can create a false sense of protection if customers assume they are fully covered. Staff also need clear limits on what guidance and advice they can provide and when they should direct customers to qualified experts.
It is important for CFIs to clearly define the services they provide, such as education, tools, resources, and trusted referrals, as well as the services they do not provide, including security audits, technical advice, and guarantees against breaches.
Where Should CFIs Start?
CFIs do not need to become cybersecurity experts or take on responsibilities best handled by specialized providers. However, they are well positioned to help SMB customers recognize common risks, strengthen everyday security practices, and connect with appropriate tools and trusted resources. The following four approaches offer practical starting points.
1. Build security into existing conversations. CFIs can audit the conversations they already have with customers, such as those around account opening, treasury onboarding, and annual relationship reviews, and identify two or three areas where a cybersecurity question fits naturally. These could include whether the SMB has MFA enabled, whether it has payment controls in place, and whether it has actually tested its backups.
2. Offer basic education, guidance, and signposting. A one-page guide on phishing, ransomware, password hygiene, and payment fraud may be more useful to an SMB owner than a 50-page cybersecurity manual. NIST’s Small Business Quick-Start Guide provides a useful foundation for translating cybersecurity risk management into actions a smaller organization can implement.
3. Make security part of the SMB banking proposition. Fraud prevention and cybersecurity are becoming core expectations, not optional extras. CFIs can embed protection into business checking and treasury services through tools such as real-time fraud monitoring, MFA, positive pay, user permissions, AI-driven detection, and identity theft protection. Pairing those capabilities with practical cybersecurity education helps SMBs get more value from the tools. It also helps position security as a meaningful part of the banking relationship.
4. Create a trusted referral network. Many SMBs simply don’t know where to turn when they need cybersecurity help. CFIs can fill that gap by building relationships with a small number of carefully vetted local cybersecurity firms and managed service providers, and also by connecting customers with relevant industry groups for threat intelligence and shared resources. These referral networks should be governed and reviewed regularly, with the same level of due diligence applied to any third-party vendor.
The opportunity here for CFIs is not to become cybersecurity companies. It is to become the trusted bridge between their SMB customers and the cyber expertise they need. Done well, cybersecurity becomes a pivotal way in which CFIs can protect the relationships, businesses, and financial ecosystems they already serve.
