87% of small and medium-sized businesses (SMBs) in the Asia-Pacific region experienced a cybersecurity incident over the past year, according to a Kaspersky survey of IT security specialists across 18 countries.
The survey found that only 13% of businesses with fewer than 500 employees in APAC reported avoiding a cyber incident during the period. Vietnam recorded the highest proportion of businesses reporting incidents at 97%, followed by Malaysia at 95%, Indonesia at 92% and India at 87%. Thailand and China reported lower levels at 82% and 67%, respectively.
Among SMBs in APAC, software vulnerability exploitation accounted for 20% of reported incidents, followed by phishing at 19% and mass malware attacks at 18%. Zero-day exploits were reported by 6% of organisations.
Respondents identified lack of security awareness among non-IT employees as the leading factor increasing the risk of successful cyberattacks, cited by 26% of SMB respondents. Lack of expertise among IT security staff followed at 24%, while outdated software or hardware was cited by 23%. Lack of regular risk assessments and lack of necessary security solutions were each cited by 22%.
The survey also found that 78% of SMBs in APAC had increased their cybersecurity budgets in 2026. Among companies surveyed, 48% had allocated additional funds to expand IT and IT security teams, while 32% had increased spending to adopt advanced security technologies.
Ilya Markelov, Head of Unified Platform Product Line at Kaspersky, said the findings reflected the difficulty businesses face in defending against increasingly sophisticated attacks.
“The current reality when companies of all sizes can be targeted with all possible methods urges business to reconsider their security posture. Sophisticated attacks easily bypass fragmented defences, requiring advanced tools and a skilled team to counter them,” Markelov said.
He added that budget constraints and the shortage of information security professionals remained challenges for growing businesses.
Adrian Hia, Managing Director for Asia Pacific at Kaspersky, said SMBs were increasingly facing the same types of attacks as larger organisations.
“SMBs across APAC are no longer the collateral damage or secondary target. Our survey shows that they are prime victims for modern threat actors who use the exact same enterprise-level tactics,” Hia said.
He added that the increase in cybersecurity budgets among SMBs indicated greater attention from business leaders to cybersecurity, while highlighting the need to secure essential systems and improve security awareness among non-IT employees.