According to Kaseya's 2026 Cybersecurity Report, which gathered insights from over 1,100 MSPs and IT pros worldwide, human error continues to be the top cybersecurity challenge that hasn't been cracked yet.
Human error tops the threat list
Human error, including social engineering and distraction, ranks as the threat vector 68 percent of respondents are most concerned about over the next 12 months, ahead of email at 55 percent. Among organisations that experienced an incident in the past three years, four of the top five contributing factors were people related, led by poor user practices or gullibility at 41 percent and a lack of end-user cybersecurity training at 40 percent.
“People aren’t perfect, and everyone knows it. Yet much of cybersecurity still depends on people making the right decision every time,” said David Baggett, SVP and GM, Security Suite, Kaseya. “The path to true cyber resilience isn’t about eliminating mistakes. It’s about building an organisation that can withstand them. Expect mistakes, account for constraints and engineer around them.”
The report also found confidence around compliance may be overstated. Nearly 65 percent of respondents said they could pass a compliance audit today without preparation, yet when asked what could create problems during an audit, 49 percent pointed to incomplete documentation or policies, followed by security controls that are not fully implemented at 34 percent and a lack of employee security awareness or training at 33 percent.
That gap, between feeling audit-ready and actually being able to demonstrate it, is often where smaller businesses get caught out. A business might have the right intentions without the paperwork trail, staff sign-off records, or documented policies an auditor or insurer will ask for.
Budgets aren’t keeping pace
Only 20 percent of IT departments say their cybersecurity budget is growing in line with real risk. Among those surveyed, 77 percent described themselves as under-resourced in some way, whether budgets held flat while threats grow (23 percent), budgets growing too slowly to keep pace (30 percent), or simply under-resourced and aware of it (24 percent). MSPs report a similar pattern among their clients, with 65 percent saying clients are underinvested in cybersecurity relative to their risk.
For small businesses specifically, this often isn’t a budget they control directly, it’s spread across IT support contracts, software subscriptions and whatever time an owner or office manager can spare. The report’s figures suggest that even well-resourced organisations are feeling the squeeze, so a small business assuming it’s simply “too small to matter” is working from the same shaky footing as everyone else, minus the safety net of a dedicated security team.
What high performers do differently
Alongside the report, Kaseya introduced an MSP resilience assessment, comparing high and low performing MSPs based on whether they met both revenue and growth goals over the last two quarters.
High performers were more likely to test incident response plans regularly, with almost 30 percent testing clients’ incident response plans quarterly compared with 18 percent of low performers. Only 11 percent of high performing MSPs reported not having an incident response plan at all, compared with 25 percent of low performers.
Compliance also emerged as a differentiator. A quarter of high performing MSPs generate between 11 and 25 percent of their revenue from compliance services, compared with 15 percent of low performers, suggesting compliance work can double as a revenue opportunity rather than just an obligation.
High performers also invested more heavily in advanced security layers. While foundational tools like endpoint detection and response, multi-factor authentication, backup and disaster recovery, and email security were near universal, high performers pulled ahead on SIEM adoption (48 percent versus 31 percent for low performers), network detection and response (52 percent versus 27 percent), and cloud security (32 percent versus 13 percent).
The pattern across all of this is consistency. High performers don’t necessarily have more tools, they test what they have more often, document more thoroughly, and treat security as an ongoing practice rather than a one-off project.
Building resilience on a small budget
The report closes with a five part playbook for building resilience into daily operations: designing for the mistakes teams already expect, making the case for investment before an incident forces the issue, removing friction so secure behaviour becomes the easy choice, using AI to extend stretched teams, and treating compliance as continuous work rather than a once a year scramble.
For small businesses without a dedicated security team, that playbook translates into a few practical starting points:
Assume mistakes will happen. Build simple safeguards, like requiring a second approval for payment changes, rather than relying on staff to catch every phishing attempt. This is what the report means by designing around human error rather than trying to eliminate it.
Make security the easy option. If the secure way to do something is also the slowest or most annoying, staff will find a workaround. Multi-factor authentication and password managers only work if they’re simple to use, and the report’s finding that friction undermines security is consistent with this.
Run short, regular training instead of annual sessions. The finding that 40 percent of incidents involved a lack of end-user training points to training that isn’t happening consistently, not training that’s entirely absent. A 20 minute session each quarter will do more than a single annual briefing nobody remembers by month three.
Treat compliance as ongoing, not seasonal. A quick quarterly check of policies and access permissions is more realistic for a small team than a once a year audit scramble, and it closes the gap the report identifies between feeling prepared and actually being able to prove it.
Get a second opinion on where you actually stand. Several Australian providers offer small businesses a starting point before committing to a bigger spend. Melbourne based Cynch Security runs a free cyber fitness self-assessment so owners can benchmark their security posture against other Australian small businesses, in plain language rather than technical jargon. Sydney based Apollo Secure offers a governance, risk and compliance platform built for startups, not-for-profits and small organisations managing frameworks like Essential Eight and ISO 27001 without an enterprise budget. Brisbane based Securitribe provides virtual CISO services on retainer, giving growing Australian businesses access to senior security leadership and a structured security operating model without a full-time executive hire.
None of these replace the basics, backups, multi-factor authentication, staff awareness, but they illustrate that the gap identified in Kaseya’s report is shaping how local providers are building their offerings, with small businesses as the starting point rather than an afterthought.