Some research I recently did for an article turned up a statistic that would have made a nice centerpiece: 60% of small businesses that experience cyberattacks go out of business within six months! If I were a hack writer, I could just have run with it; it’s “confirmed” on plenty of websites. But it smelled phony.

First, what exactly is it counting? It doesn’t even say “successful” cyberattacks. Let’s assume it means that, though. Almost every business falls victim to some malware. The consequences can be small or huge. It might contact a server that no longer exists and do nothing. It might attempt to encrypt files for ransomware but fail. It might mine for cryptocurrency, send spam, or try to enlarge a botnet. Those are all bad but won’t usually destroy the business.

Second, how much of the correlation is causation? Small businesses have high mortality rates in general. It just isn’t plausible that cyberattacks are wiping out huge numbers of small companies.
(more…)