The finding that 96% of ransomware victims are small and medium-sized businesses inverts the perception built by the sector's press coverage.
The distortion has a simple explanation: an attack on a well-known company is news, an attack on a thirty-person company isn't. The result is a public picture where the problem looks like a big-company issue, and a reality where it's almost entirely everyone else's.
The economics of automated attacks explain the distribution. Mass scanning looks for exposed systems without choosing targets by size or sector, and companies without dedicated technology staff tend to accumulate exactly what that scanning looks for: outdated systems, reused passwords and no access logging.
There's also a recovery aggravator. A large company attacked loses money; a small company attacked frequently closes, because it has neither the cash to survive weeks of halted operations nor the staff to rebuild.
The defence list that changes the outcome is short and cheap: two-step authentication everywhere, automatic updates, backups genuinely tested, and an inventory of what each connected supplier can reach.