Remote support changes the access surface, so security evidence should be part of the staffing decision rather than an afterthought. A virtual assistant may work in email, a CRM, a calendar, a help desk, or a document system. That access can be useful and risky at the same time. Verizon’s 2025 Data Breach Investigations Report analyzed 22,052 security incidents, including 12,195 confirmed data breaches, and reported third-party involvement in 30% of breaches, double the prior year’s share.
Small-business cybersecurity incidents and VA access
The DBIR aggregates incidents and breaches contributed by organizations and public sources. It helps show patterns in observed security events. It is not a risk score for one staffing provider, and its sample is not a census of every breach.
Key stats
Verified August 11, 2026Key takeaways
- The third-party relationship is a material part of breach exposure in the Verizon dataset.
- A security review should examine identity, permissions, data movement, and incident reporting, not only the worker’s location.
- The DBIR is an incident dataset, so its percentages describe reported cases and cannot predict one buyer’s probability.
Why third-party access matters
When a person outside the core team receives account access, the business must know which permissions are needed, how identity is verified, and how access is removed. The goal is not to eliminate useful delegation. It is to make the access path visible and limited.
Questions that produce useful evidence
Ask what systems the role needs, whether multi-factor authentication is supported, where work files live, who handles an incident, and how access changes are recorded. NIST and CISA provide security guidance, but the buyer still has to apply it to the actual tools and data.
Consolidated statistics
| Measure | Finding | Limit or use |
|---|---|---|
| Security measure | Evidence to request | Why it matters |
| Identity | Named account and MFA support | Reduces shared credential exposure |
| Permission | Role-specific access list | Limits unnecessary data access |
| Incident path | Named reporting route | Makes response more useful |
For a related buyer context, read the data security research. For a second comparison, see the access control research.
Methodology and limits
Facts were checked against the linked public sources on August 11, 2026. Findings include the unit, period, population, and source context available in each register. Survey and incident datasets can be revised or sampled, and none predicts an individual provider, worker, or buyer outcome.
Frequently asked questions
Does third-party involvement mean every provider is unsafe?
No. It is a pattern in a breach dataset, not a verdict about one provider. It is a reason to ask for concrete access and incident evidence.
Should a buyer share a master password?
A buyer should use named accounts and the least access needed. Security tools and qualified advice should guide the exact setup.
What is a reasonable first security question?
Ask which systems the role needs and why. A specific access list is easier to review than a general promise.
Sources
10 visible sources, verified August 11, 2026
- Verizon 2025 DBIR
- NIST Cybersecurity Framework 2.0
- NIST small business quick start guides
- CISA phishing guidance
- CISA small business resources
- FTC protecting personal information
- FTC Start with Security
- SBA cybersecurity
- NIST Privacy Framework
- Census BTOS cybersecurity questions
A practical next step
Use the evidence as a starting point, then compare one defined role with a safe work sample and a named review owner. A free consultation can help scope that comparison without treating a public statistic as a promise.
