Cybercriminals aren’t slowing down. In May 2026 alone, Comcast Business says its SecurityEdge Preferred service blocked threats targeting small businesses at a rate of more than 230 per second. And as artificial intelligence makes cyberattacks faster, cheaper, and more sophisticated, small businesses face a growing challenge: protecting themselves against threats they may not even know exist.
According to Comcast Business’s 2026 Cybersecurity Threat Report, which analyzed 79.3 billion cybersecurity events across its business cybersecurity customers, phishing and attacks involving compromised websites remain major threats. But attackers are also finding new ways into business networks through stolen login credentials, vulnerable devices, and even employees’ browsers.
With Cybersecurity Awareness Month coming to a close, I talked to Christian Nascimento, senior vice president, Connectivity & Digital Customer Solutions at Comcast Business, about how cyberthreats are changing, the security risks small business owners often overlook, and the practical steps they can take to protect their businesses.
How AI Is Changing Cybersecurity Threats
Rieva Lesonsky: How has the cybersecurity threat facing small businesses changed over the past year, particularly as attackers increasingly use AI?
Christian Nascimento: The biggest change is the speed at which attackers can move. AI has made it far faster and cheaper to launch a campaign that would’ve taken a whole team before. And they can now find new ways to exploit businesses before software fixes are even available or online. This has shrunk the window between when a weakness is exposed and when it can be used against a business.
Attackers are also changing the way they get in. It’s becoming more common to bypass digital breaking and entering. Instead of trying to break in, they’re logging in, using stolen credentials or routing activity through everyday devices not immediately thought of as a cyber risk.
Lesonsky: Comcast Business says it defended against 230 cyberattacks per second targeting small businesses in May. What kinds of attacks are small businesses facing most often, and are there any that are increasing particularly quickly?
Nascimento: That figure comes from SecurityEdge Preferred, which blocked threats targeting small businesses at a rate of more than 230 per second in May 2026. Our 2026 Cybersecurity Threat Report takes a broader view. It analyzed 79.3 billion cybersecurity events across Comcast Business cybersecurity customers between March 1, 2025, and February 28, 2026.
Two techniques top the list:
- Phishing:Fake emails, texts, or messages pretending to be from someone trustworthy. The report counted 25.4 billion phishing events.
- Drive-by compromise:Visiting a compromised or malicious website that can install malware without an additional click. The report counted 21.9 billion drive-by compromise attempts.
These were the two highest-volume techniques in the report.
One area small business owners should keep a closer eye on is attempts to gain covert access to employee browsers through malicious extensions, browser sync, and session theft. We detected 5.8 million of these attempts.
The Hidden Devices Putting Small Businesses at Risk
Lesonsky: You mention “hidden devices” that can put a small business at risk. What devices do business owners commonly overlook, and why can they create vulnerabilities?
Nascimento: When securing a small business, most owners think of laptops and phones first. But the attack surface has grown. All of these can be taken over without the owner noticing:
- Security cameras outside a storefront
- Routers in the back office
- Streaming devices providing entertainment for customers
- Point-of-sale (POS) systems
That’s because they’ve traditionally flown under the radar when it comes to cybersecurity. They aren’t managed or monitored closely, which makes them an easy access point to get in.
These kinds of devices are being used to disguise criminal traffic, help attackers move into business networks that trust them, and even launch large-scale attacks. We call this the “unmapped edge,” since traditional security tools and processes don’t account for devices that aren’t mapped as part of the attack surface in the first place.
Lesonsky: What should a small business owner do to identify every device connected to the company’s network and make sure each one is properly secured?
Nascimento: The first step is to take inventory of everything that is connected to the internet. That includes the devices that get overlooked: cameras, routers, thermostats, streaming devices, and POS systems.
A router or the internet provider’s online portal is a good place to start and can often show what’s connected to it. But it’s important to go beyond that, and a physical walk around both the interior and exterior of the business can help catch anything that’s missing.
Once everything is accounted for, it should all be added to a security checklist and treated with the same level of attention as the more obvious devices like phones and laptops.
Who’s Responsible for Small Business Cybersecurity?
Lesonsky: Cybersecurity is often described as a “shared responsibility.” In a small company without an IT or security department, who should be responsible for cybersecurity, and what should employees be expected to do?
Nascimento: Without a dedicated IT team or the infrastructure larger companies have, responsibility has to be spread across the whole business. It starts with the business owner or day-to-day operations lead. They should be accountable for setting the ground rules, even if a provider handles the technical work.
From there, employees carry out a few basics that should be on every cybersecurity checklist:
- Turning on multifactor authentication (a second check at login) for every account
- Using strong, unique passwords and changing them if they may have been exposed
- Reporting anything suspicious the moment they see it
Owners play their part by ensuring employees and devices have only the access their roles require, so one compromised account doesn’t lead to a larger-scale breach.
Training is where the two sides meet. Phishing is the highest-volume attack technique in our data, so it’s the owner’s job to keep teaching the team what to look for, and the team’s job to speak up when something looks off.
Lesonsky: What cybersecurity mistakes do you see small businesses making repeatedly — including things owners may believe are protecting them but actually aren’t enough?
Nascimento: The biggest is treating security as a one-time project. The threat landscape keeps changing. Defenses set up years ago, or training that happened only at orientation, won’t keep pace with attackers who are finding new and faster ways in.
Another common mistake is waiting for a breach to take security seriously. Small businesses need network protection that monitors incoming and outgoing traffic in real time and adapts to emerging attack patterns.
5 Ways to Strengthen Your Cybersecurity Defenses
Lesonsky: If a small business owner could take only five steps this month to reduce the likelihood or impact of an attack, what would you tell them to do?
Nascimento: We’ve covered a few of these, but it’s important to reiterate that a few practical steps can make a noticeable difference:
- Map every connected device:Cameras, routers, thermostats, streaming devices, and POS systems are all now part of the attack surface. Add these types of devices to the security checklist and check it twice.
- Require multifactor authentication and strong passwords:Turn on MFA for every account and use strong, unique passwords, changing any that may have been exposed. This reduces the chance that one stolen credential turns into a full network compromise.
- Train employees to spot phishing: Phishing is the highest-volume attack technique in our data, arriving by email, text, and messaging apps. Build an ongoing training program to educate employees on how to recognize and report phishing attempts, turning them into a front line of defense.
- Apply least privilege:If every employee has full access to all business systems and data, one compromised account can reach everything. Limit employees and devices to only the access required to do their jobs.
- Build protection into your network:Don’t wait until a breach occurs to tackle security needs. When choosing a network or internet solution, make sure it monitors traffic in real time and adapts to emerging threats.
Lesonsky: As small businesses prepare for 2027, what emerging cybersecurity threats should they be watching for now, and what should they be doing differently because of them?
Nascimento: The thing to watch is identity, meaning who or what is logging into systems. That used to mean employees, but it now includes AI agents and software connections, which can carry permissions no employee would ever be given. Employee AI tools are also expected to become a bigger target. At the same time, risk is moving beyond the four walls of a business, into home offices, supplier networks, and devices no one manages.
So, what should change?
- Speed:Attackers move fast, so install updates as soon as they’re available and automate responses where possible.
- Vigilance after login:Keep watching for unusual activity once someone is in, not just at the door.
- Clear rules for AI:Decide which AI tools are approved for use and what information is safe to put into them.
The goal is visibility into what’s happening across the whole business environment to be able to respond to risk wherever it starts or moves.
My Takeaway
Cybersecurity isn’t something small business owners can set up once and forget about. As attackers find new ways to exploit everything from stolen passwords to overlooked devices, protecting a business requires constant attention.
The good news is that owners don’t have to tackle every threat at once. Start by identifying everything connected to your network, strengthening account security, training employees, and establishing clear rules for using AI.
The goal isn’t to eliminate every possible risk — it’s to make your business a harder target and be better prepared when something goes wrong.
Rieva Lesonsky is the founder of Small Business Currents, a content company focusing on small businesses and entrepreneurship. You can find her on Twitter @Rieva, Bluesky @Rieva.bsky.social, and LinkedIn. Or email her at Rieva@SmallBusinessCurrents.com.
Photo courtesy Mariia Berezovsky for Unsplash+
