Walk into a mid-size company in Noida, Gurgaon or Bengaluru today and ask the founder what keeps them up at night. Cash flow, usually. Talent, sometimes. Cybersecurity? Almost never — until the day the accounts team accidentally wires ₹28 lakh to a vendor account that doesn't exist, and everyone in the room realises the last real security review happened when the office was set up.

The uncomfortable pattern we see across Infrabyss engagements is that SMEs don't get breached by exotic zero-days. They get breached by five very specific, very fixable weaknesses — the same five, year after year. Here they are, ranked by how often we find them still open on day one of an engagement.

The average Indian SME breach in 2026 isn't a movie-plot hack. It's a phishing email, a reused password, or a server that missed a patch. The good news: those are the cheapest problems in security to actually solve.

1. Business email compromise targeting finance teams

By volume of financial loss, BEC is the single biggest threat to Indian SMEs right now. The playbook is simple: an attacker studies the CEO or founder's public writing style on LinkedIn, spoofs their email domain (or hijacks it via a compromised inbox), then emails the finance lead asking for an "urgent" vendor payment. There are no malicious attachments, no exploits, nothing an antivirus can catch. Just a well-written email with the right timing.

What actually fixes it

  • Enable SPF, DKIM and DMARC on your domain — with DMARC set to p=reject, not none. This alone stops most direct spoofing.
  • Enforce MFA on every mailbox, ideally with an authenticator app rather than SMS. This is the single highest-return control in email security.
  • Institute a two-channel rule for any payment over ₹1 lakh: if a payment request arrives by email, it must be confirmed on a second channel (phone call to a known number, in-person, or a signed system).
  • Add a visible banner to inbound external email — a small "External sender" tag reduces click-through on impersonation by an order of magnitude.

2. Ransomware on unpatched Windows Server and exposed SMB

Every quarter Infrabyss is asked to help recover from a ransomware incident where the root cause is a Windows Server that hasn't been patched in eight to fourteen months, often with SMB (file-sharing) exposed either to the internet or across a flat internal network. Attackers scan continuously for this exact combination — they don't need to target you specifically for you to end up on the list.

What actually fixes it

  • Establish a monthly patch cadence with a documented maintenance window. Not "when we get around to it" — a real recurring calendar entry.
  • Disable SMBv1 entirely, and never expose SMB (port 445) to the public internet. Between offices, use a VPN or a Zero-Trust proxy.
  • Segment your internal network so a compromised laptop can't pivot straight into the fileserver. Basic VLAN separation is enough for most SMEs.
  • Test your backups by actually restoring from them — quarterly, in a sandbox. A backup you have never restored is not a backup.

3. Credential stuffing via reused passwords

When a consumer service your team uses gets breached — a food-delivery app, a shopping site, a hobby forum — those email/password pairs end up in bulk credential lists within days. Attackers then replay them against corporate logins, VPNs and admin panels. If anyone on your team reuses passwords (they do), one leak is one open door.

What actually fixes it

  • Deploy a company-wide password manager (1Password, Bitwarden, Dashlane — any of them). This is the only realistic way to make unique-per-site passwords the default.
  • MFA on every SaaS admin account, not just email. If it can grant access to customer data, revenue, or infrastructure, MFA is non-optional.
  • Monitor for breached credentials — services like HaveIBeenPwned's domain search will notify you when any of your team's emails appear in a new leak.
  • Move admin access to SSO where the SaaS supports it. One point of enforcement is easier to secure than fifty.

4. Insecure APIs on customer-facing web apps

Almost every SME with a mobile app or a customer portal has, at some point, exposed an API endpoint that is not properly authorised — the classic "you can change the ID in the URL and see another customer's data" bug. It's often invisible to normal users and completely obvious to a paying attacker. In 2026 we've seen this pattern cost businesses their compliance certifications, not just their reputation.

What actually fixes it

  • Enforce object-level authorisation on every endpoint — every GET, POST, PUT, DELETE. If a user requests resource #12345, verify server-side that they own it. Don't rely on the frontend to hide it.
  • Rate-limit authentication endpoints — login, password reset, OTP verification — to prevent enumeration and brute force.
  • Run a proper application security review at least once a year, ideally by an external team. Bug-bounty programs work at scale; annual pentests work for SMEs.
  • Log and alert on unusual API patterns — a single account pulling every record in the database over 20 minutes is not normal behaviour.

5. Shadow IT and unmanaged SaaS sprawl

The fifth threat is the one CFOs feel first. Marketing signs up for a scheduling tool. Sales starts using a new CRM trial. HR pilots a screening platform. Nine months later, company data is spread across 47 SaaS tools, half of them paid on personal cards, none of them centrally managed. When an employee leaves, their access to most of those tools quietly persists — sometimes for years.

What actually fixes it

  • Run a SaaS inventory once a quarter — start by pulling the expense report and asking every department head for their list. You'll be surprised.
  • Centralise SSO (Google Workspace, Microsoft Entra, Okta) for every tool that supports it. When someone leaves, one deactivation revokes everything.
  • Establish a lightweight SaaS approval process — one form, one owner, one line in a spreadsheet. Bureaucracy that fits on a page.
  • Do an offboarding audit for every departure: revoke SSO, rotate any shared credentials the person knew, and archive their inboxes.

A 30-day SME hardening playbook

If you're reading this and wondering where to start, here's a compressed version of what Infrabyss typically deploys in the first month of a cybersecurity engagement. It's not exhaustive — it's the shortest path to closing the highest-risk gaps.

Week 1 — Visibility

  • Inventory every domain, every mailbox, every server, every SaaS tool in use.
  • Run an external attack-surface scan against public IPs and domains.
  • Enrol every mailbox and admin account in MFA.

Week 2 — Email & identity

  • Configure SPF, DKIM, DMARC (start at p=quarantine, move to p=reject within 60 days).
  • Deploy a company-wide password manager.
  • Institute the two-channel payment rule and add an external-email banner.

Week 3 — Endpoints & servers

  • Establish and run the first monthly patch cycle.
  • Disable SMBv1, close SMB to the public internet.
  • Deploy managed endpoint protection (EDR) across every laptop and server.

Week 4 — Backups, review, handover

  • Test-restore from your most recent backup. Fix whatever's broken.
  • Write and share a one-page incident-response plan — who calls whom, when.
  • Schedule the next quarterly review and put it on someone's calendar.

None of the five threats above are new. What's changed in 2026 is the speed at which attackers weaponise them and the size of business they'll target — no company is too small any more. The good news is that basic hygiene, done consistently, blocks the vast majority of what's out there. It's not glamorous work. It's just work that pays for itself the first time it saves you from a headline.

If you'd like Infrabyss to audit your current posture against this list — or to run any part of the 30-day playbook for you — get in touch below.