89% of monitored SMBs have at least one user with confirmed credential compromise at any given time.

Publisher	Guardz
Report	2026 State of MSP Threat Report
Published	28 April 2026
Topics	SMB, Identity, Authentication, Credential Compromise

Published by Guardz in 2026 State of MSP Threat Report, 28 April 2026. The figure is taken from the report as published; the full methodology is in the source.

View the original report

Compare this across sources

3 sources answer what share of organisations have deployed multi-factor authentication. They report between 40% and 66%, with a median of 60%.

See all 3 sources

Related statistics

78% of enterprise servers are reachable over SMB or WinRM, administrative protocols commonly exploited for ransomware spread and lateral movement.

Zero Networks, 15/06/2026

Confirmed business email compromise (BEC) losses range from $140,000 to $1.5 million, compared to an average of roughly $40,000 in early 2025.

Guardz, 27/05/2026

Remote monitoring and management (RMM) tool abuse accounted for 26% of all detections in monitored SMB environments.

Guardz, 27/05/2026

31% of users in monitored SMB environments are exposed to compromised passwords each month.

Guardz, 27/05/2026

Machine identities outnumber human users by 25:1 in Microsoft 365 environments.

Guardz, 27/05/2026

AI-driven detection achieves 92.4% accuracy compared to 67% accuracy for human analysts alone.

Guardz, 27/05/2026

Get the newsletter

Weekly cybersecurity statistics by email.