Cybersecurity: nearly 70% of SMEs have no crisis plan, and your marketing is exposed too

The evaluation report of the CyberXP programme, shared by the FEB on 16 September 2026, makes a simple point: most Belgian SMEs have put a few protections in place, but few know how to react on the day an incident happens. What often gets overlooked is that your website, your email and your ad accounts are part of the exposed surface.

1. What the CyberXP report reveals

The report describes a state of « partial protection »: technical tools exist, but without a resilience strategy or a crisis plan. Nearly 70% of participating companies had never considered a cyber incident response plan, and around three quarters had no one officially responsible for the topic. The main barrier is not budget: SMEs first cite a lack of time and expertise.

2. A record phishing context

In the first quarter of 2026, phishing reports sent to the Centre for Cybersecurity Belgium rose by around 50%, to more than 40,000 cases a day, or over 3.6 million in three months. Some of these messages impersonate very real companies: yours could be one of them without you knowing.

3. Your marketing, an often forgotten attack surface

• The website: an outdated CMS or plugins, poorly protected forms, no tested backup.
• The email domain: without SPF, DKIM and DMARC records, anyone can send emails that look like they come from you.
• Ad accounts and social pages: access still open to former staff or providers, without two-factor authentication.
• Customer data: prospect files, newsletter, CRM, with the GDPR obligations that come with them.

4. Preparing for the aftermath, on the marketing side too

The report recommends treating cybersecurity as a business continuity issue, and favouring simple actions over perfect protection. For marketing, that means knowing who holds which access, being able to bring the website back online quickly, and having a message ready for your customers if your name is used in a scam. The question to ask is the report's own: what would we do tomorrow morning if our website or accounts became unavailable?

The AI lens, humans first

AI makes phishing more convincing, but it also helps defend: continuous website uptime monitoring, detection of outdated plugins, alerts on unusual logins to ad accounts, spotting fake profiles or pages imitating your brand. These signals are worthless without someone to sort them and decide. AI executes. Expertise decides, and watches.