# The Evidence: Sourced Numbers on Small-Business AI Use and Cyber Risk | Steady Hand IT

Source: https://steadyhandit.com/evidence/

Sourced numbers

# The evidence behind the advice

Short answer: About one in five U.S. businesses (19.8%) reported using AI as of May 2026 (Census Bureau), ransomware appeared in 88% of breaches at small and medium businesses in Verizon's 2025 report, and the FBI logged $2.77 billion in business email compromise losses for 2024. Every figure on this page links to its source.

    I only publish numbers I can link to. Below are four charts built from published reports. Nothing here is my own survey, and nothing is rounded up to sound scarier.

## How many businesses use AI?

    The Census Bureau surveys firms every two weeks. In its May 2026 release, 19.8% of U.S. businesses reported using AI in any business function. Use is far higher in information and finance, and it grew among firms with 20 or more employees but did not change significantly among firms with fewer than 20.

    Share of U.S. businesses using AI, May 2026. Share of firms reporting AI use in any business function, by sector. Source: [U.S. Census Bureau BTOS](https://census.gov/library/stories/2026/05/ai-use-businesses.html).

    The Federal Reserve estimated about 18% adoption at the end of 2025. The Census question wording changed in November 2025, so compare across that date with care.

## How exposed are small businesses to ransomware?

    Verizon's 2025 report analyzed 12,195 confirmed breaches. Ransomware appeared in 88% of breaches at small and medium businesses, versus 39% at larger organizations.

    Breaches involving ransomware, by organization size. Share of analyzed breaches in which ransomware appeared, Nov 2023 to Oct 2024. Source: [Verizon 2025 DBIR](https://verizon.com/about/news/2025-data-breach-investigations-report).

## What does a breach cost?

    IBM's 2025 report puts the global average at $4.44 million and the U.S. average at $10.22 million. Those averages come mostly from larger organizations, so a small office should read them as context, not a forecast.

    Average cost of a data breach, 2025. Average total cost per breach in US dollars, millions. These are averages across surveyed organizations, mostly larger than a typical small business. Source: [IBM Cost of a Data Breach Report 2025](https://www.ibm.com/reports/data-breach).

## What do victims report losing?

    The FBI's Internet Crime Complaint Center received 859,531 complaints in 2024 with $16.6 billion in reported losses. Business email compromise, where a criminal impersonates a vendor or executive to redirect a payment, accounted for $2.77 billion across 21,442 complaints.

    Reported cybercrime losses to the FBI, 2024. Losses reported by victims to the FBI IC3, US dollars, billions. Reported losses undercount real losses. Source: [FBI IC3 2024 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf).

## What these numbers cannot tell you

- They are averages and shares from large samples. They do not predict what will happen to one office.

- The breach cost figures skew toward larger organizations. I have not found a primary source I trust for small-business breach costs, so I do not chart one.

- FBI figures are only what victims chose to report. Real losses are higher.

- The Census AI question changed wording in November 2025, and "uses AI" covers everything from a chatbot to a custom system.

- I read the Verizon, IBM and FBI figures through news and trade coverage of the reports and linked the publishers' own pages. Check the original report before quoting a number in anything formal.

- Downtime cost per hour is widely quoted, but the common figures come from vendor surveys with unclear samples, so I leave them out.

## Sources

- [U.S. Census Bureau, Business Trends and Outlook Survey: AI use by businesses (May 2026)](https://census.gov/library/stories/2026/05/ai-use-businesses.html)

- [Federal Reserve FEDS Notes: Monitoring AI adoption in the U.S. economy (April 2026)](https://www.federalreserve.gov/econres/notes/feds-notes/monitoring-ai-adoption-in-the-u-s-economy-20260403.html)

- [Verizon 2025 Data Breach Investigations Report](https://verizon.com/about/news/2025-data-breach-investigations-report)

- [IBM Cost of a Data Breach Report 2025](https://www.ibm.com/reports/data-breach)

- [FBI Internet Crime Complaint Center, 2024 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf)

## Want to know where you stand?
Take the free Tech Health Check, or book a free 20-minute call.
[Take the Health Check](https://steadyhandit.com/#check) [Book a free call](https://steadyhandit.com/contact/)