What the evidence means
The survey covers breaches or attacks organisations could identify and were willing to report, so it may underestimate true prevalence. Small businesses are those with 10 to 49 employees.
Identification-based prevalence may understate the full level of attacks.