Security spending is up. Losses are up faster.
The gap is where small firms live.
LeakTrace Inc., Toronto. October 2026.
The numbers
Every year the world spends more on security. Industry analysts put end-user spending on information security at $193 billion in 2024 and $213 billion in 2025, and expect about $240 billion in 2026. 1 That is an analyst's arithmetic, quoted only to size the market.
Every year the reported losses grow faster. The FBI's Internet Crime Complaint Center counted $20.9 billion in reported losses in 2025, up 26% on 2024. In 2021 the figure was $6.9 billion. It has tripled in four years. 2 Over 2022 to 2025, losses doubled while security spending rose by about 29%. 13 Even inside a single year, 2024 to 2025, spending rose 10% and losses rose 26%. 12
In Canada the Anti-Fraud Centre recorded over $704 million lost to fraud in 2025, the highest year on record, and over $2.4 billion since 2022. 4 The first three months of 2026 added over $188 million. 5
Those are the reported numbers. The real ones are larger. The CAFC says only 5% to 10% of frauds are reported. 4 The FBI said in its 2016 report that an estimated 15% of fraud victims report to law enforcement. 6
Where the money goes
Business email compromise cost US victims $3.05 billion in 2025, across 24,768 complaints. 2 That is a forged invoice. A changed bank account. A message from "the partner" that was not from the partner. It is the second-largest category of loss, behind investment fraud, and it is the one that lands on ordinary firms: law offices, accountants, brokerages, builders, clinics.
Here it is in one sentence. The spending goes to the inside of large companies. The losses happen at the public face of small ones.
A 2 to 200 person firm has no security team. It has a domain, a website, a mailbox and a bank account. The attacker never meets its firewall. They read its public records, register a look-alike of its name, send an invoice and wait.
AI made the reading cheap
Reading a firm from outside used to take a person and an afternoon. It now takes a model and a minute.
The UK AI Security Institute reported in July 2026 that freely downloadable open-weight models trail the closed frontier on cyber tasks by four to seven months, down from six to ten months through most of 2025. One open model completed its tasks at $0.28 each against $12.50 for the closed model it matched. In AISI's words, such models "can be hosted privately, with no data returning to the model providers," and "safeguards can be removed." 7
Governments say the same. The Canadian Centre for Cyber Security, June 2026: AI shortens the time defenders have "in some cases from days or weeks to hours," and "is lowering barriers to entry for malicious cyber activity." 8 The UK NCSC, May 2025: "the time between disclosure and exploitation has shrunk to days and AI will almost certainly reduce this further," and there will "almost certainly be a digital divide" between organisations that keep pace and those that do not. 9 The FBI, December 2024: generative AI lets criminals commit fraud on a larger scale and "reduces the time and effort criminals must expend to deceive their targets." 10 In 2025 the FBI counted over $30 million in business email compromise losses where AI was involved. 2
The most capable actors start the same way. The joint CISA, NSA and FBI advisory on PRC state-sponsored activity, February 2024, describes "extensive pre-compromise reconnaissance," including internet search tools used to find exposed infrastructure. 11 The first move, for a state or for a fraudster, is to read the target from outside.
The wrong answer: security that needs the keys
The industry's answer for a small firm has been a smaller version of the enterprise product: a program on every laptop, a login to the mailbox, a vendor with admin rights. That is security that needs the keys to your firm.
Keys get stolen. In July 2021 a flaw in Kaseya's remote-management software carried ransomware to managed service providers and their customers in one move. 12 In December 2020 CISA ordered federal agencies to disconnect SolarWinds Orion after a poisoned update. 13 In 2023 the CL0P gang stole data from internet-facing MOVEit Transfer servers through a web shell, in a campaign the FBI and CISA set out in a joint advisory. 14 Each time, one vendor's access became everyone's exposure.
Two more behaviours fail small firms. Scores without proof: a number, with no record of what was read, when, and what it meant. And one-time assessments: a photo of one date, when the firm, the world and the attacker's tools all keep changing.
The right answer: zero-access security
Read the firm the way attackers and AI assistants read it. From outside. No login, no install, no access to anyone's mailbox. The team keeps its habits. We hold no keys, so there is nothing of yours to steal from us.
Find each way in, give the exact fix step by step, and re-check from outside until it is closed. Where something is not visible from outside, the firm's own people confirm it, and the outside reading and the inside confirmation sit in one dated record.
Prove it. Every finding is quoted from the firm's own public record, dated and kept, so a partner, an insurer or a client can see what was true on the day.
That is what a 2 to 200 person firm can use. It costs nothing in keys, and it meets the attacker where they are: outside, reading.
We hold no keys to your firm.
- NoNo login to your systems.
- NoNothing installed on your machines.
- NoNo access to your mailboxes.
Sources
- 1Gartner, press release, 29 July 2025 (analyst figure).
- 2FBI Internet Crime Complaint Center, 2025 Internet Crime Report.
- 3Gartner, press release, 28 September 2023 (analyst figure; 2022 total).
- 4Canadian Anti-Fraud Centre, news release, 6 March 2026.
- 5Canadian Anti-Fraud Centre, news release, 4 June 2026.
- 6FBI IC3, 2016 Internet Crime Report (published 2017).
- 7UK AI Security Institute, "How far behind the frontier are leading open-weight models on cyber?", 17 July 2026.
- 8Canadian Centre for Cyber Security, statement on frontier AI models, 24 June 2026.
- 9UK National Cyber Security Centre, "Impact of AI on cyber threat from now to 2027", 7 May 2025.
- 10FBI IC3, PSA I-120324-PSA, 3 December 2024.
- 11CISA, NSA, FBI, advisory AA24-038A, 7 February 2024.
- 12CISA and FBI, alert on the Kaseya VSA supply-chain ransomware attack, 4 July 2021.
- 13CISA Emergency Directive 21-01, 13 December 2020.
- 14FBI and CISA, advisory AA23-158A, 7 June 2023.
See what your firm shows the internet, without handing over a key.
Your domain and a work email at it. No password, no login and no software. Read-only, and sent only to your work email.