Cyber risk, one in four SMEs attacked in 2025
Presented the Cyber Index PMI 2025, the report by Confindustria and Generali. Dossier on 1,500 companies: 70% of SMEs remain in the intermediate levels and risk is growing faster than defence capacity. One in three does not even know how to manage ordinary IT security activities
Key points
- SME Cyber Index 2025: index rises, attacks grow faster
- SMEs and cyber attacks: almost one in four already affected
- Cybersecurity budgets in SMEs: insufficient growth
- Multi-factor authentication, encryption, detection: where defences remain uncovered
- Public funding for cybersecurity: 39% of SMEs do not know about it
One in four SMEs stated that they had received a cyber-attack. While one in three does not have adequate digital skills to handle even routine cybersecurity activities.
These are the hardest data of the Cyber Index PMI 2025, the annual report - now in its third edition - drawn up by Confindustria and Generali on a sample of 1,500 enterprises: not the lack of budget, not the scarcity of tools, but a structural knowledge deficit that makes the entire defensive perimeter of Italian SMEs fragile - even when the overall index rises.
Cyber Index PMI 2025: index rises, attacks grow faster
And up it goes, indeed. The SME Cyber Index reaches 55 out of 100, up from 52 in 2024 and 51 in 2023. Enterprises classified as 'mature' rise to 16% and overtake for the first time those classified as 'beginners', down six points to 14% since the first survey. But 70% remain stuck in the intermediate levels - 38% 'informed', 32% 'aware' - and the improvement is not enough to speak of a solid system.
The risk, meanwhile, is growing faster than the defence capability: in the first half of 2025, there were 1,549 cyber events recorded, an increase of 53 per cent compared to the same period in 2024; in the second half, there were 1,253, an increase of 30 per cent.
SMEs and cyber attacks: almost one in four already affected
The problem is not only technical. Among novice companies, one third still believe that cyber attacks do not pose a real risk. Among informed ones, 39 per cent instead show an overconfidence in their own defences. Two opposite pathologies, same effect: underestimation of real exposure. An exposure that has meanwhile become concrete: almost one in four SMEs claims to have suffered at least one attack in the last three years, a figure three times higher than the previous survey. 2.5 per cent have experienced operational or financial consequences; 6 per cent have had to take significant response actions.
