The ten IT problems that hurt small and medium businesses most, the ten that matter when the website is the business, with the Irish picture and what you can do about each.
Published 21 October 2026 · RTLane IT
Attackers scale down, not away. Ransomware is the dominant SMB breach pattern, and third-party involvement in breaches doubled to 30%.
The browser is the new perimeter for shops. Card skimmers run client-side, evade server tools, and PCI DSS 4.0.1 now requires script inventories on payment pages.
Compliance has widened beyond GDPR. Accessibility (EAA) and payment-page controls are now legal or contractual duties for many SME sites.
Ireland is late on NIS2, but the obligations are arriving anyway, through customer and supply-chain contracts.
Verizon’s 2025 DBIR found ransomware in 88% of SMB breaches versus 39% at larger organisations; the median ransom paid fell to $115,000 and 64% of victims refused to pay [1]. Payments falling does not make recovery cheap for a firm without offline backups.
43% of UK businesses identified a breach or attack in 2025/26, unchanged year on year, with phishing the most common type [3][4]. Roughly 60% of breaches globally still involve a human element [2].
Credential abuse (22%) is the top breach entry point, and 54% of ransomware victims had their domains in infostealer logs [1][2]. Unmanaged and personal devices are a main source of leaked logins.
Vulnerability exploitation rose 34% to 20% of breaches; median time to fix critical edge-device flaws was 32 days [2]. SMEs rarely have someone whose job is patching.
Third-party involvement in breaches doubled from 15% to 30% [2], yet only 12% of UK micro and 22% of small businesses review their immediate suppliers’ cyber risk [3].
Techaisle’s 2026 survey (n=5,500) puts budget constraints and cost predictability back at #1, now driven by usage-based AI pricing [5]. 28% of UK SMEs say they lack budget for digital tools [6].
38% of UK SMEs cite workforce skills gaps as a digital barrier [6]. The OECD found under 5% received government-supported digital training in the countries it measured, while 24% want cheaper, flexible training [7].
“Data trust and sanitisation for AI” (#2) and “governance of shadow AI” (#4) are new top-five IT challenges in 2026 [5]. The OECD says SME cybersecurity practices lag behind their digital intensity [7].
Techaisle ranks SaaS silos #5 [5]. Each extra tool is another admin login, another supplier and another place data can leak.
For e-commerce, downtime is close to 100% revenue loss for its duration. In a 2025 SMB survey, 37% put one hour of downtime at $1k–5k and 8% above $25k [14]. 99.9% uptime still allows 8h 46m of downtime a year [15].
Recorded Future counted 11,000+ unique infected e-commerce domains in 2024, nearly 3× the prior year [16]. Most victims are small and mid-sized merchants [17].
One 2024 campaign used a single Magento flaw (CosmicSting) to inject skimmers into hundreds of stores [16]. Outdated platforms are scanned and exploited automatically at scale [17].
Analytics, chat and tag-manager scripts are a favoured injection route; in early 2025 attackers abused Google Tag Manager to load skimmers [16]. One compromised vendor script affects every site using it [17].
Recent skimmers hide when a logged-in WordPress admin views the page and restore the checkout after stealing data, so orders complete normally [18]. Server-side tools such as WAFs and file-integrity scanners look in the wrong place [19].
Since 31 March 2025, requirements 6.4.3 and 11.6.1 require merchants to inventory and authorise every payment-page script and to detect unauthorised changes [20].
EU consumer e-commerce must be accessible from 28 June 2025, with WCAG 2.1 AA as the technical baseline via EN 301 549 [10][11]. Only micro-enterprises (<10 staff and ≤€2m) are exempt, and the rule applies to non-EU sellers too.
Tracking before consent, missing privacy notices and unclear operator details are the most visible GDPR gaps on a public site.
Infostealer logs routinely contain corporate logins [1]. For a small shop, one stolen CMS, hosting or DNS login can mean a defaced site, a planted skimmer or a hijacked domain.
Ireland missed the October 2024 deadline; on 8 July 2026 the European Commission referred it to the Court of Justice. The Government expects to notify transposition by end-2026, and the NCSC recommends the CyFun framework for evidencing controls [24]. NIS2 clauses are already appearing in customer and supply-chain contracts [25].
Enterprise Ireland’s Cyber Review Grant supports a cybersecurity assessment and remediation plan [26], a practical way to lower the cost of getting started.
We monitor your backups and run a quarterly restore test, with a short report showing how long recovery takes. In Ireland, 35% of businesses that paid a ransom still had to rebuild their systems [21].
Learn more →Phishing-resistant MFA, Entra ID Conditional Access, blocking of legacy sign-in methods and device compliance, delivered as a fixed-price project and then monitored monthly.
Learn more →A gap assessment against the CyFun Basic framework, a short board briefing and an evidence folder to share when customers send NIS2 clauses. Grant support may be available where eligible [26].
Learn more →At launch, and quarterly for managed clients: TLS, security headers, email records (SPF, DKIM, DMARC), cookie consent and how visible the site is in search and AI answers.
Learn more →WCAG 2.1 AA accessibility checks (EAA), a payment-page script inventory (PCI DSS 4.0.1) and a consent tool configured before go-live.
Learn more →A monthly patch compliance report plus an external scan of internet-facing devices such as firewalls, VPNs and remote access, where exploitation is rising fastest [2].
Learn more →Short monthly modules and phishing simulations in Microsoft 365, aimed squarely at the training gap in small Irish firms [23].
Learn more →A one-page AI policy, Microsoft Purview sensitivity labels and Copilot readiness. 62% of Irish firms see third-party AI tools as a major risk [21].
Learn more →RTLane is ISO/IEC 27001 certified. We package the certificate, a client-facing security summary and NIS2 contract answers so you can pass your own customers’ supplier reviews.
Learn more →Sources accessed 21 October 2026. Figures are as published by each source on that date.
Book a free 30-minute risk review. We’ll check your Microsoft 365, backups and website against the risks above and tell you what to fix first.
