That last part is the uncomfortable truth. It’s not that SMEs are being targeted despite being smaller — it’s that they’re being targeted because they’re smaller. Attackers know that a 20-person logistics firm or a boutique accounting practice usually doesn’t have a dedicated security team, tested backups, or a plan for what to do in the first hour after something goes wrong. Bigger companies are harder work. SMEs are the easier payday.

The numbers are moving in the wrong direction

A few data points worth knowing, straight from CSA and closely tracked industry sources:

• Infected infrastructure in Singapore jumped 142% year-on-year, reaching 284,300 detected cases in 2025 — driven largely by unpatched, consumer-grade IoT devices and the growing availability of Malware-as-a-Service kits that lower the skill bar for attackers.
• Phishing remains the number-one entry point, with reported cases up 49% to around 6,100 in a single year — and a growing share of those emails are now AI-generated, which means the old advice of “watch out for bad grammar” no longer holds.
• The financial exposure is real and specific. The average cost of a single data breach for an SME sits around SGD 120,000, while most SMEs allocate less than SGD 10,000 a year to cybersecurity</cite> — a gap that leaves a lot of businesses badly under-covered relative to their actual risk.
• Most breaches don’t come from sophisticated hacking. <cite index=”6-1″>A scan of 102 Singapore business websites found four in five carried at least one vulnerability, and one in three were rated high or critical risk</cite> — usually from outdated software, unpatched plugins, and default settings nobody got around to changing.

What this actually means for your business

None of this is a reason to panic. It’s a reason to check three things, honestly:

• Is MFA switched on everywhere it should be — email, cloud storage, accounting software, remote access — or does it just feel like it is?
• If ransomware hit your systems tomorrow, do you have a backup that isn’t reachable from the same network — an immutable or offline copy attackers can’t encrypt along with everything else?
• Does your team know what an AI-generated phishing email looks like now, given that the “obviously fake” tells of a few years ago mostly don’t apply anymore?

If you answered “not sure” to any of those, you’re not alone — and it’s a good sign it’s time for a proper look, not a guess.

XPS Technologies runs practical cybersecurity assessments for Singapore SMEs — no scare tactics, just a clear picture of your exposure and what to fix first. Arrange a consultation.