Singapore SMEs Think They're Too Small to Be Hacked. That's Exactly the Problem.

Being small does not make a company invisible. It makes it easier to break into. The Cyber Security Agency of Singapore (CSA) recorded 165 ransomware cases in 2025 and said SMEs were disproportionately affected, yet its latest Cybersecurity Health Report, released in October 2026, found 46% of businesses still see themselves as unlikely targets, while almost nine in ten had at least one cybersecurity incident in 2025. Most attacks today are automated: scanners and AI tools look for weak passwords, unpatched devices and exposed services across the whole internet, and they do not check headcount first. Verizon's 2025 breach report found ransomware in 88% of breaches at small and medium businesses, against 39% at large organisations. An entry-level business firewall such as the Fortinet FortiGate 30G, with a year of security services, costs S$1,236 at SourceIT (listed 30 Oct 2026).

What do the Singapore figures say?

From CSA's published reports and press releases.

Why are small companies attractive targets?

• Automation makes them cheap to attack. FortiGuard Labs counted about 36,000 automated scans per second in 2024. A scanner that finds an exposed, unpatched device moves straight to it, whatever the company's size.
• They are often softer. The CSA survey found lack of knowledge (56%) and lack of manpower (37%) among the main barriers to better security.
• They pay, or they are a route to someone who will. In April 2025 a ransomware attack on Toppan Next Tech, a printing vendor, exposed customer information of DBS and Bank of China's Singapore branch. Suppliers to larger firms are a way in.
• Their data still matters to regulators. In 2025 the PDPC fined Ezynetic, a small software provider, S$17,500 after a ransomware attack exposed the data of 190,589 people; weak admin passwords were among the causes.

Attackers do not choose victims by size. They choose them by how easy they are.

What does a sensible baseline look like?

CSA's Cyber Essentials standard, aimed at SMEs, is a good checklist. Its March 2025 edition requires, among other things:

1. A perimeter firewall configured to accept only authorised traffic.
2. Malware protection on laptops, desktops and servers.
3. Software updates, with known exploited vulnerabilities fixed as soon as possible.
4. Backups kept separately and isolated, tested at least twice a year.
5. Multi-factor authentication for administrator access to important systems.

For a small office, that usually means a business firewall with security subscriptions, endpoint protection such as Microsoft Defender for Endpoint, a NAS or cloud backup kept off the main network, and MFA on email and admin accounts. Our post One Wrong Click Could Shut Down Your Entire Business shows how those layers work together, and Your Firewall Might Be Giving You a False Sense of Security explains why the firewall cannot work alone.

What help is available?

• CISO-as-a-Service: CSA-onboarded consultants run a health check and prepare a plan towards Cyber Essentials, with up to 70% co-funding for eligible SMEs, according to CSA.
• Productivity Solutions Grant: pre-approved cybersecurity solutions are listed under SMEs Go Digital. Enterprise Singapore says PSG covers up to 50% of eligible costs, up to S$30,000. Check which packages are currently pre-approved before buying.
• Cyber Incident Helpline: the Cyber Resilience Centre runs a helpline on 6890 9555 for triage and advice, launched with CSA support in 2026.
• Free toolkits: CSA publishes Cyber Essentials toolkits and a cybersecurity health check tool.

Which firewall suits a small office?

For an office of up to about a dozen people on a typical business fibre line, the FortiGate 30G or 50G with Unified Threat Protection covers intrusion prevention, antivirus, sandboxing and web and DNS filtering. Choose the 50G if you want more inspection headroom: Fortinet's October 2026 matrix lists 1.1 Gbps threat protection for the 50G against 500 Mbps for the 30G. Growing offices with more access points and switches should look at the 70G. See FortiGate 40F vs 50G vs 70G and Why Your S$200 Router Isn't a Replacement for a Business Firewall.

Buying in Singapore

SourceIT supplies the FortiGate 30G (S$1,236 with 1-year UTP, S$1,956 with 3-year), FortiGate 50G (S$1,819.20 / S$2,847.60) and FortiGate 70G (S$2,630.40 / S$4,189.20) with local warranty, plus Microsoft Defender for Endpoint P1 and Synology backup systems. Prices listed 30 Oct 2026. Browse the FortiGate firewall collection. For a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page. Government buyers can purchase through GeBIZ.

Frequently asked questions

Are Singapore SMEs really targeted by hackers? Yes. CSA reported 165 ransomware cases in 2025 and said SMEs were disproportionately affected. Most attacks are automated and do not select victims by size.

What is CSA's Cyber Essentials mark? A certification for organisations, especially SMEs, that shows basic cyber hygiene, including a perimeter firewall, malware protection, patching, isolated backups and MFA for administrators.

Is there funding for SME cybersecurity in Singapore? CSA's CISO-as-a-Service offers up to 70% co-funding for eligible SMEs, and pre-approved cybersecurity solutions may qualify for the Productivity Solutions Grant.

Who can a small business call after a cyber incident? The Cyber Resilience Centre's Cyber Incident Helpline on 6890 9555 provides triage and advice. Data breaches may also need to be reported to the PDPC.

What is the cheapest FortiGate for a small office? At SourceIT on 30 Oct 2026, the FortiGate 30G with 1-year Unified Threat Protection is S$1,236.