The 60% small-business cyberattack claim needs context

“Sixty percent of small businesses close within six months of a cyberattack” is one of security marketing's most repeated statistics. It is memorable. It is also a poor planning baseline.

The claim is usually repeated without a current study, sample, definition of “cyberattack,” or method for tracking closure. A business should not turn that number into a survival forecast. The useful lesson is simpler: a serious incident can create costs and downtime that a smaller company has little room to absorb.

Replace the statistic with a continuity test

Ask what happens if email, payroll, customer records, or the main cloud account becomes unavailable. Then measure the recovery path. The answer belongs in tested procedures, not a generic percentage.

• Recovery time. How long can each critical process remain unavailable?
• Recovery point. How much recent data can the business afford to lose?
• Independent access. Can responders reach backups and recovery accounts when the primary identity system fails?
• Decision ownership. Who can isolate systems, contact customers, and approve recovery spending?
• Evidence. When was the recovery plan last exercised?

The controls small businesses still need

No single browser product can make a company survive an incident. Continuity comes from layers that fail differently.

1. Use phishing-resistant authentication for important accounts where available.
2. Keep offline or separately controlled backups. Test restoration.
3. Patch endpoints and browsers. Remove software and accounts no longer needed.
4. Separate administrator accounts from daily work.
5. Limit vendor and contractor access to the work they need.
6. Write an incident plan with current contacts and decision owners.
7. Review cyber-insurance terms before an incident, including exclusions and reporting duties.

The CISA small-business guidance and the NIST small-business cybersecurity resources are better starting points than an unsupported shutdown percentage.

Where browser isolation fits

Browser isolation changes where a page runs. That can separate unfamiliar web content from the endpoint. It does not secure every route into the company. It does not stop a person from submitting a secret to a phishing page. It does not protect a file after someone exports it to the device.

Legba is a Chrome extension with two modes. Ghost gives you a private browser route. Shield opens a page in an isolated browser off your device.

Ghost changes the browser route. Shield changes the page execution boundary. The Shield session is destroyed when its tab closes. Identity controls, endpoint security, backups, and incident response still carry their own jobs.

The Chrome extension costs $10 a month, or $100 a year. That price is not an ROI guarantee. Compare it against the specific browser risk in your environment.

A better survival question

Do not ask whether your company will land in a universal 60% or 40%. Ask whether one compromised account, endpoint, or vendor can stop revenue. Then make that failure smaller and recovery faster.

Browser isolation can narrow one part of that problem. It works best when its boundary is explicit and the rest of the continuity plan is real.

For the browser mechanics, read how Legba browser isolation works.