San Antonio SMB Cybersecurity Domain Report
Q3 2026 — Vol. 3
Every quarter, IDENETY MSP analyzes Zone Intelligence scan data from San Antonio small and mid-size businesses to surface the most common security gaps, emerging threats, and remediation trends. This report is based on real DNS, email authentication, SSL, and security header data — not vendor surveys.
Based on real Zone Intelligence scan data
Executive Summary
San Antonio SMBs continue to show significant gaps in foundational email security and HTTP hardening. The most critical finding this quarter: more than half of businesses scanned had no DMARC enforcement policy, leaving their domains open to spoofing and business email compromise (BEC). Healthcare and legal sector businesses showed the highest rate of SSL/TLS issues — a direct HIPAA and data-privacy risk. The good news: security header adoption improved 7 points quarter-over-quarter, suggesting growing awareness of web application hardening.
Business Email Compromise (BEC) remains the #1 financial threat to San Antonio SMBs. A missing DMARC record is the single most common enabler.
Key Findings
Top Security Gaps — Q3 2026
DMARC Enforcement Gap — 53% of Domains
53% of San Antonio SMB domains scanned in Q3 2026 had no DMARC enforcement policy (p=none or missing entirely). Without a p=quarantine or p=reject policy, any attacker can send email that appears to originate from your domain — the primary vector for business email compromise, invoice fraud, and credential phishing.
Remediation
Publish a DMARC record with p=quarantine as a minimum. Advance to p=reject once reporting confirms no legitimate mail is being blocked. IDENETY MSP deploys and monitors DMARC as part of all managed plans.
Affected Sectors
MITRE ATT&CK T1566.001 — Spearphishing Attachment
HTTP Security Headers Missing — 61% of Domains
61% of scanned domains were missing one or more critical HTTP security headers: Content-Security-Policy (CSP), X-Frame-Options, Referrer-Policy, or Permissions-Policy. Missing CSP enables cross-site scripting (XSS) attacks. Missing X-Frame-Options allows clickjacking — embedding your site in a hidden iframe to steal credentials.
Remediation
Configure security headers at the web server or CDN layer. For Microsoft 365-hosted sites, headers must be set via a proxy or WAF. IDENETY MSP's Network Security Stack add-on includes WAF configuration with hardened header policies.
Affected Sectors
OWASP Top 10 A05:2021 — Security Misconfiguration
Expired or Weak TLS Certificates — 38% of Domains
38% of scanned domains had an expired certificate, a certificate expiring within 30 days, or a weak cipher suite (TLS 1.0/1.1 still accepted). Healthcare organizations accounted for a disproportionate share — 52% of healthcare-sector domains scanned had a TLS issue. An expired certificate triggers browser warnings that destroy customer trust and, for HIPAA-covered entities, represents a direct technical safeguard failure.
Remediation
Enable auto-renewal on all certificates. Enforce TLS 1.2 minimum; disable TLS 1.0 and 1.1 at the server and load balancer. IDENETY MSP monitors certificate expiration as part of 24/7 RMM on all managed plans.
Affected Sectors
NIST 800-52 Rev 2 — TLS Implementation Guidelines
Exposed Admin Interfaces — 29% of Domains
29% of scanned domains had a publicly accessible admin panel, login endpoint, or management interface reachable without VPN or IP restriction. Common exposures included WordPress /wp-admin, cPanel login pages, and vendor-default management ports. Exposed admin panels are a primary target for credential stuffing and brute-force attacks — and a direct path to ransomware deployment.
Remediation
Restrict admin interfaces to VPN or allowlisted IP ranges. Enforce MFA on all admin accounts. Rename or relocate default admin paths where possible. IDENETY MSP's COMPLETE and IDENETY plans include admin exposure monitoring.
Affected Sectors
MITRE ATT&CK T1078 — Valid Accounts
Industry Analysis
Security Posture by Industry Sector
Average Zone Intelligence grade across all scans in Q3 2026, by primary industry vertical.
HIPAA technical safeguard gaps remain widespread. TLS and email auth are the primary failure points.
Strong DNS hygiene but persistent security header gaps. Client confidentiality risk from missing CSP.
Best-performing sector. PCI-DSS pressure drives stronger baseline. Admin exposure remains an issue.
Lowest-performing sector. Email auth and security headers both weak. High BEC risk.
CMMC readiness gap. DNS and admin exposure are the primary concerns for defense contractors.
Resource constraints drive poor security hygiene. DMARC adoption near zero in this sector.
Trend Analysis
Quarter-Over-Quarter Trends
Change in pass rate vs Q2 2026 across all Zone Intelligence checks.
Active Threats
Q3 2026 Threat Intelligence — San Antonio
Active threats and campaigns observed targeting San Antonio businesses this quarter.
BEC Campaign Targeting SA Healthcare
A business email compromise campaign specifically targeting San Antonio medical groups was observed in Q3. Attackers spoofed vendor domains with no DMARC enforcement to redirect ACH payments. Three confirmed incidents in the metro area.
Credential Stuffing via Exposed Admin Panels
Automated credential stuffing attacks against exposed WordPress and cPanel admin interfaces increased 34% quarter-over-quarter. Attackers are using leaked credential databases from prior breaches to gain initial access.
Ransomware Pre-Positioning via RMM Abuse
Two San Antonio SMBs experienced ransomware incidents traced to compromised RMM agent credentials. Attackers used legitimate RMM tools to deploy ransomware payloads, bypassing traditional AV detection.
Methodology & Data Sources
This report is based on Zone Intelligence scan data collected from San Antonio-area businesses during Q3 2026 (July 1 – September 15, 2026). All scans are performed with domain owner consent or as part of IDENETY MSP's managed client baseline assessments. Data is anonymized and aggregated — no individual business or domain is identified in this report. Sector classification is based on primary NAICS code or self-reported industry. Scans include real DNS lookups, HTTP header inspection, SSL certificate validation, and AI visibility checks. No simulated or synthetic data is used.
This report reflects observed data from a sample of San Antonio SMBs. It is not a statistically representative sample of all San Antonio businesses. IDENETY MSP publishes this report to advance cybersecurity awareness in the San Antonio business community.
See Your Domain's Grade
Run a free Zone Intelligence scan on your domain — same methodology used in this report. Get your A–F grade in under 60 seconds. No account required.
Previous reports: Q2 2026 · Q1 2026 · Q4 2025