Before the year is even over, Belgian businesses have already reported more cyber incidents than in the whole of 2025. That's not an alarmist claim — it comes from the Centre for Cybersecurity Belgium (CCB), the government body that tracks these reports. For an SME owner, this isn't a distant problem: smaller businesses are precisely the ones carrying the most risk right now.
What's going on
According to CCB figures, Belgian businesses reported more cyber incidents in the first nine months of 2026 than during the whole of 2025 (Brussels Times, 2026; IT Daily, 2026). The second quarter of 2026 alone showed a 23.3% increase compared to the previous period (IT Daily, 2026). That's not statistical noise — it's a structural acceleration.
A large share of those reports involves ransomware: software that locks up the files on a computer or server, after which the attacker demands payment to release them. The CCB counts an average of 22 ransomware attacks per day in Belgium, and reports that 42% of Belgian SMEs have already been hit at least once (IT Daily, 2026). That figure alone disproves the most common assumption among smaller businesses: “that mostly happens to big companies.”
Tellingly, the government itself recognises how exposed SMEs are: since 1 February 2026, the kmo-portefeuille — the Flemish advice subsidy — covered cybersecurity advice only (VLAIO; Partena Professional, 2026). That subsidy's annual budget has since run out completely: as of 15 October 2026 businesses can no longer apply for a new kmo-portefeuille, and the scheme itself is being discontinued from 2027 (VLAIO, October 2026). Businesses still looking for financial support for cybersecurity advice can look into VLAIO's cybersecurity verbetertrajecten, a separate instrument from the kmo-portefeuille.
Why this affects SMEs
Larger companies typically have an IT department, a fixed patching schedule, and a security budget. At an SME, that responsibility often sits with one person who handles it “on top of” bookkeeping, customers, and the day-to-day running of the business. Research suggests that nearly half of Belgian SMEs have no cyber insurance and that security investment is lagging (IT Daily, 2026) — not out of carelessness, but because there's often neither the time nor the knowledge to know where to start.
On top of that, an SME is rarely standing alone. A business works with suppliers, customers, and partners who are themselves connected to others again. An attacker who gets into one link in that chain — usually the least protected one — can move on from there. Big numbers about a “record number of attacks” feel abstract, right up until an invoice can't be paid because the servers are locked, or a customer asks for proof of proper security before doing business any further.
What to actually do about it
- Map out what's visible from the outside. A business often doesn't know exactly which systems, email services, or old software can be reached from the internet — and that's exactly where an attacker looks first. A clear picture of that “outside view” is the first step, not the last.
- Install updates within the week, not within the year. Most ransomware attacks exploit known vulnerabilities that already have a fix available. An update that's ready but not installed is a door left open on purpose.
- Keep an offline backup an attacker can't reach. A backup that stays connected to the network is often encrypted along with everything else. A copy that's genuinely disconnected is the difference between a bad day and weeks of being shut down.
- Talk to the business's insurer about cyber cover. Nearly half of Belgian SMEs have no cyber insurance (IT Daily, 2026). A policy doesn't replace security, but it does absorb part of the financial hit if something goes wrong anyway — from legal costs to lost revenue during downtime.
- Write down who decides what during an incident. A few agreements on paper — who to call, who decides on a potential payment, who informs customers — saves hours of panic the moment it actually happens.
How NetGuard helps
A clear picture of what an attacker sees from the outside is called External Attack Surface Management (EASM): an ongoing scan of everything a business exposes online, from forgotten subdomains to outdated software. That makes it concrete where the biggest risks sit, before an attacker finds them first. For SMEs that want to know whether their security policy actually holds up, CISO-as-a-Service offers the direction and policy of a security lead, without having to hire one full-time. A no-obligation introduction can be arranged by email.
Related articles
Why your biggest client is suddenly asking how secure you are
Since 18 April 2026, large Belgian companies must prove their cybersecurity is in order — and they are now passing that requirement down to their suppliers. Why SMEs not covered by NIS2 themselves are feeling it too, and what to do about it today.
The password on thousands of firewalls was simply “admin”
A flaw at firewall maker Fortinet gave hackers access to more than 270 Belgian businesses — often through a firewall whose default password was never changed. What happened, why SMEs are vulnerable, and which steps help starting today.
That voice on the phone might not be human
Scammers now use AI to mimic the voice of a business owner to push through an urgent payment. Here's how this new form of CEO fraud works, and five concrete steps to reduce the risk.