Why keep checking?
The risk is measurable. The coverage should be clear.
Last reviewed: 5 November 2026
These statistics explain the wider risk. They are not Samtaro results, a forecast for your business or proof that our checks prevent a breach.
Risk rises with business size—but small firms are affected too
The official UK survey found that 43% of businesses identified a cyber breach or attack in the previous 12 months (overall survey base: 2,112 businesses). Results are weighted; the group percentages below should not be combined into a simple average.
View exact chart data
| Group | Percentage | Source base |
|---|---|---|
| Micro | 42% | 1,154 businesses |
| Small | 46% | 507 businesses |
| Medium | 65% | 296 businesses |
| Large | 69% | 155 businesses |
These are self-reported incidents the organisation detected. Undetected incidents are not counted, and attacks do not necessarily mean data was stolen. The UK sample does not establish prevalence in Qatar, Cyprus or the EU.
Unpatched vulnerabilities are a material entry route
View exact chart data
| Group | Percentage | Source base |
|---|---|---|
| Exploitation | 31% | 20,023 sampled breaches |
In the 2026 DBIR sample, vulnerability exploitation accounted for 31% of initial access in the stated breach subset. This is why keeping track of exploited vulnerabilities and patching relevant systems matters. The statistic does not establish that a particular site is vulnerable.
What Samtaro can show you
| Evidence | What it supports | Limit |
|---|---|---|
| Timestamped public checks | What our scanner observed and what changed | A snapshot of public signals; no access to private systems |
| CISA known-exploited vulnerability updates | A source-backed list of issues known to be exploited | A listed vulnerability is relevant only if the affected product/version is in use |
| Two model reviews before report release | A second examination of the same evidence and proposed explanations | Model agreement is not certification or proof of correctness |
| Official privacy sources | Context for website privacy and consent indicators | A website scan cannot assess all business processes or give a legal opinion |
Qatar and European sources
We reference NCSA's official PDPPL guidance hub and the official GDPR text. Which obligations apply depends on the business, processing and jurisdiction. The report is technical information, not legal advice.
Freshness is part of the evidence
Each scan records when it ran. Vulnerability-feed checks record the source's publication date and the last successful fetch. A failed source fetch is marked unavailable; it is not treated as “no new vulnerabilities”. These charts are historical research and remain labelled with their study dates.
Research sources checked 5 November 2026. Changing a website build date does not update the study or establish that legal guidance was reviewed again.
Our vulnerability source watch
Checking the latest source-read evidence…
We monitor CISA’s known-exploited vulnerability catalog. A catalog match requires investigation; it is not proof that your website is affected.
Need help with an issue?
Quick contact Quick fixes Email support
Send the domain and finding reference. Please do not email passwords, customer records or exposed secrets. We reply within one business day; this is not a 24-hour incident-response hotline.