Five shifts.

01 / 05

of ransomware victims had fewer than 1,000 employees (where size was known)

Attackers are targeting smaller businesses.

• Third parties were involved in 48% of all breaches.
• The same report counted 828 confirmed breaches in construction, and one security firm ranked construction among the three most-attacked sectors for ransomware in 2025.
• Criminals are hacking trucking carriers’ and freight brokers’ accounts to steal real shipments, and cargo crime rose 27% to an all-time high in 2024.

Sources: Verizon 2026 DBIR · Rapid7 · Proofpoint · NICB

02 / 05

to report a breach of unencrypted data affecting 500+ consumers to the FTC

Regulators expect a written security program.

• Tax preparation firms fall under the FTC Safeguards Rule: a written information security program, encryption of customer data, and multi-factor authentication.
• The reporting requirement has applied since May 13, 2024.
• The IRS tells tax and accounting professionals of every size to keep a written plan.

Sources: FTC · Federal Register · IRS Pub. 5708

03 / 05

when NIST’s draft plan disallows today’s vulnerable algorithms (phase-out after 2030)

Encryption standards are changing.

• NIST finalized its first post-quantum encryption standards on August 13, 2024.
• Its draft transition plan gives businesses a schedule to plan against.

Sources: NIST · NIST IR 8547 (draft)

04 / 05

of small employers using AI have fully integrated it

AI is arriving faster than controls.

• About 46% of small employer firms now use AI.
• Accuracy is their top challenge, and 28% cite data security and privacy concerns.

Sources: Federal Reserve SBCS 2026

05 / 05

a month general contractors report spending managing payments

Manual processes carry a real cost.

• From a 2025 survey of 125 contractors.
• The top cause of payment delays was a lack of organized processes.

Sources: Rabbet 2025