State-grade attackers. Corner-shop budgets.
In 2025 the Israel National Cyber Directorate (INCD) issued roughly 2,480 alerts, two and a half times the 2024 count, while its 119 emergency cyber line logged about 26,500 incident reports, up 55% year-on-year. Phishing was 52% of the vectors. Most of the calls came from Israeli small and mid-sized businesses (SMBs) with no full-time security staff, no multi-factor authentication, and no incident-response retainer.
01The pain
Three thousand six hundred and fifty incident reports landed in Israel's 119 emergency cyber line in June 2025 alone, 75% above the monthly average. Across that year the Israel National Cyber Directorate (INCD) issued roughly 2,480 alerts, 2.5 times the 2024 count, while the 119 hotline logged about 26,500 reports, up 55% year-on-year. Phishing accounted for 52% of the vectors. Most of the calls came from shopkeepers and dispatchers with no full-time security staff.1,2
The pain concentrates on Israel's small and mid-sized businesses (SMBs). A joint study by Marsh and Northwave flagged a strategic shift by ransomware crews toward Israeli SMB targets in information-technology services, retail, construction and logistics; the average European ransom now sits at roughly €172,000, around 2% of victim revenue. A March 2026 password-spraying campaign, reported by TheHackerNews and attributed to Iran-linked operators, hit more than 300 Israeli Microsoft 365 tenants in three waves. Only about 17% of small Israeli businesses carry any cyber-insurance cover.3,2
A Petah Tikva electronics shop, a Beer Sheva logistics dispatcher, a Holon solo law office — all face attacks calibrated for state-grade adversaries on corner-shop budgets. No in-house security operations centre, no multi-factor authentication on most accounts, no retainer with an incident-response firm. The 119 line answers. The bill arrives later.1
Further reading
- 1 Israel Defense — INCD 2025 Cyber Threats Report: 2,480 alerts, ~26,500 incident reports to the 119 emergency line, phishing at 52% of vectors, June 2025 spike during the Iran operations (English): israeldefense.co.il
- 2 The Jerusalem Post — INCD on Iran-linked targeting of Israeli IT-service providers and SMBs; Marsh / Northwave reporting on the European ransom average and the strategic ransomware shift (English): jpost.com
- 3 The Hacker News — March 2026 password-spraying campaign reported against 300+ Israeli Microsoft 365 tenants in three waves, attribution reported as Iran-linked (English): thehackernews.com
02Who solves this today
Three Israeli-rooted vendors that publicly self-market cybersecurity to small and mid-sized businesses or that ship a dedicated SMB product line. Each was checked live on the date of writing with a verbatim homepage marketing quote. The list is intentionally narrow.
Listed providers publicly market cybersecurity to Israeli SMB or mid-market buyers on their own front pages, verified by live fetch on the date of writing. Inclusion is not endorsement. Adjacent Israel-active vendors were considered and excluded — CyberHat (cyberhat.com) returned a connection-refused error (ECONNREFUSED) on every attempt and could not be verified, so it was dropped pending a re-check; Comsec (comsec.co.il) returned a connection-refused error (ECONNREFUSED) and was dropped pending a re-check; CYE (cyesec.com) returned HTTP 200 but the homepage emphasised enterprise-grade exposure-management for "industry leaders around the globe" without a small-business or SMB surface, so it was dropped per the named-niche-on-homepage rule; Pentera (pentera.io) returned HTTP 200 but the homepage pitched automated security validation to mid-market and enterprise security teams without an SMB surface, so it was dropped; Radware (radware.com) returned HTTP 200 but the homepage pitched cloud DDoS protection and an MSSP partner programme without a direct SMB surface, so it was dropped. The Israel National Cyber Directorate, the 119 emergency line, the Jerusalem Post, Israel Defense, The Hacker News, Marsh and Northwave are referenced in section 01 as institutional / trade-press citations rather than homepage-self-marketed solution providers.
Report a mistake — or suggest a new solution
Spot a wrong number, dead source link, missing aspect, broken translation? Or know a vendor we should list as a solution? Tell us. The Director re-checks every report and either updates the page or writes back with a reason.
Got it — thank you.
The Director will look at your report on the next research cycle. If you left an email you'll hear back when we either update the page or decide it's not actionable (with a one-paragraph reason).
Listed companies — manage your entry. If you are one of the providers above and anything here is wrong, missing, or out of date — or you'd rather not be listed — write to us. Removal within 24 hours; corrections within 7 business days. We do not contact listed companies first; we publish what your own public marketing claims and respond when you reach out. Email contact@aikraft.com.