Global Cyber Risk in Local Markets: 85% of Small Business Endpoints Face Active Exploits

A new data sample from XIT monitoring systems has revealed a troubling reality for the small business sector. In an analysis of endpoint devices across small businesses in Israel, researchers found that 85% of the systems surveyed (11 out of 13) are currently operating with at least one active security alert. While the sample is localized to the Israeli market, the findings serve as a stark warning for the global SMB ecosystem, where limited IT budgets often lead to catastrophic security lapses.

The most alarming discovery is the presence of 17 vulnerabilities that are not merely theoretical risks but are already being actively exploited by threat actors. These flaws are listed in the Known Exploited Vulnerabilities (KEV) catalog maintained by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The presence of KEV-listed flaws means that hackers have already developed and deployed methods to breach these systems, making them an immediate and tangible threat to business continuity.

The KEV Threat: Beyond Theoretical Risk

The distinction between a general vulnerability and a KEV-listed one is the difference between a locked door and a door that is actively being kicked in. In this sample, out of 229 open vulnerability findings across 12 computers and 28 unique CVEs, 17 specific instances were identified as actively exploited. For a small business, this exposure often leads to data theft, operational disruption, or ransomware demands.

Specific examples found in the fleet include CVE-2025-0411 in 7-Zip (x64), which carries a CVSS score of 7.0 and a high exploitation probability of 67.1%. Another significant find was CVE-2025-15556 in Notepad++ (32-bit x86), with a CVSS score of 7.5. Perhaps most concerning is the persistence of legacy flaws; the oldest active exploit found was CVE-2020-0878 in Microsoft Edge, which has been on the CISA KEV list since November 2021. The fact that a four-year-old vulnerability remains unpatched highlights a critical failure in basic digital hygiene.

Operational Decay and Maintenance Failures

The report suggests that security is not the only victim of neglect; general system health is also in decline. Only 8% of the computers in the sample were found to be fully healthy without alerts. The data shows that 38% of machines have pending updates, another 38% suffer from driver errors, and 23% have experienced Blue Screen of Death (BSOD) events or unexpected shutdowns in the last 30 days. In a single 24-hour window, the fleet recorded 63 system errors in event logs, signaling deep operational instability.

Furthermore, three out of the 13 computers are still running unsupported operating systems, such as Windows 10 or older versions. These systems no longer receive security patches, making them permanent targets for modern exploits. This lack of maintenance extends to hardware performance as well, with an average memory consumption of 57% and a staggering average uptime of 172 hours between reboots, which often prevents necessary patches from being applied.

A Global Lesson for Small Enterprises

While this data originates from Israeli small businesses, the implications are universal. Small businesses worldwide often lack the dedicated IT staff found in larger corporations, yet they face the same automated scanning tools used by global hacking syndicates. A vulnerability in a common tool like 7-Zip or a browser like Edge is a universal entry point, regardless of where the business is located.

Experts recommend that SMBs prioritize their patching schedules based on the CISA KEV catalog rather than just CVSS scores. Addressing the 17 actively exploited vulnerabilities identified in this study would provide the highest return on security investment. Beyond security, regular maintenance, such as updating drivers, clearing disk space (8% of the sample had nearly full disks), and phasing out end-of-life operating systems, is essential to prevent the productivity losses associated with system crashes and hardware failure.