64pc of participating EMEA organisations anticipate an attack in the next year, with 44pc having already experienced an incident over the past 12 months.

According to new research carried out by ESET in the SMB Cyber Readiness Index 2026, “businesses are losing sleep over a high-tech threat that has barely shown up in real attacks”, in a landscape where “everyday scams” are getting through and costing money. 

ESET, which is a Slovakia-based global cybersecurity company, partnered with Esomar member Go4insight to collect data from 4,400 organisations with 25 to 1,000 endpoints across 13 countries.

This included Canada, the Czech Republic, Denmark, France, Germany, Italy, Japan, the Netherlands, Slovakia, Spain, Sweden, the UK and the US. Contributors were the main decision-makers on, or key influencers of, organisational cybersecurity decisions. 

What was discovered in the research is that 64pc of participating organisations dispersed across Europe, the Middle East and Africa anticipate an attack in the next year, with 44pc having already experienced an incident over the past 12 months.

31pc are of the opinion that the single greatest threat is AI-powered malware, despite ESET’s findings stating that across its managed detection and response service (MDR), not one incident involved generative AI “in any meaningful way”. Rather, among the threats that posed the most risk, were phishing (27pc), unpatched software (23pc), lack of security monitoring (20pc) and weak passwords (20pc).

Commenting on the report, Michal Jankech, the vice-president of enterprise, SMB and MSP at ESET, said: “While 78pc of SMBs recognise cybersecurity’s strategic importance, inconsistent understanding of key threats, technology and terminology, including MDR and security posture, suggests there is still room for improvement. Any improvement will have to start with a reality check. 

“We’ve found SMBs’ concerns are often shaped by headlines on emerging threats like AI-driven attacks, while more routine risks, phishing, unpatched vulnerabilities and lack of monitoring, are underestimated. This hints that many respondents misperceive their security posture and resilience.” 

Invest in safety

ESET’s research also highlighted the need and desire for significant training among participating EMEA organisations.

87pc explained that they believe training to be either critical or important and 51pc train several times a year, while 12pc train monthly. Only 43pc however, were found to be using quality training programmes such as phishing simulations.

Meanwhile, 83pc view their cybersecurity budget as being sufficient or more than sufficient and 39pc expect a budget increase next year. 

Of the future investment into their organisation, 40pc are planning for increased engagement in employee training and awareness, 33pc have a future strategy for cloud security and one-quarter intend to invest in backup and recovery. The main barriers are currently budget limits (26pc), complexity and integration challenges (20pc), and a shortage in talent and skills (18pc).

“As it stands, meeting cybersecurity challenges in 2026 means understanding the intersection of your business needs, human behaviour, the democratisation of powerful technologies like AI, regulatory priorities, and the rather volatile threat landscape – that’s a lot,” said Jankech. “Therefore, to face all of these, there is but one choice – to become more resilient, starting with charting one’s own state of readiness.”

Though Ireland-based organisations were not included in ESET’s survey, George Foley – a cybersecurity specialist for ESET Ireland – offered his opinion as to what Irish organisations should expect. 

“Irish businesses are bracing for a Hollywood version of cybercrime while the side door is left wide open,” he said. “The attack that empties your account is not some self-driving AI super-virus. It is the same dodgy invoice email we have warned about for years, except now it is word-perfect and there are thousands of them. 

“Spend your worry and your budget on the basics. Train your staff to pause before they pay, keep your systems patched and stop reusing passwords. That is what stops the money walking out the door.”

Don’t miss out on the knowledge you need to succeed. Sign up for the Daily Brief, Silicon Republic’s digest of need-to-know sci-tech news.

Updated, 5.31pm, 9 June 2026: This article was amended to fix some statistical errors.