Global cybercrime estimated cost 2029 | Statista Global cybercrime estimated cost 2029 | Statista
1. 2.
Sign up for Mastercard Signals
Sources
next
home
Navigate issue below
Share your feedback
Signals
May 2026
Conclusion
Confidential computing
Product development
Quantum fusion
Power struggle
Embodied AI
Agents as brokers
Distributed intelligence
small business, rewritten
This gap is now strategic. Providers are relying on signals that understate capability, miss hidden complexity and confuse lean operations with limited ambition. Headcount no longer measures capacity. Geography is no limit, either; a local retailer may depend on overseas suppliers, foreign-currency payments and global marketplaces. A digital business increasingly relies on services, agents and automated workflows provided by others. And financial activity spread across multiple accounts and platforms can hide the fact that an SME has recurring customers, diversified income and healthy cash flow. All this means valuable opportunities are being missed. This report shows where, why and how to address them. It draws on Mastercard research and conversations with thousands of small businesses across markets across the globe to set out five signals of the transformation, and what each means for the key players.
The small business has changed. The systems serving it have not. And the gap between them is becoming a serious constraint on growth. The assumptions used to recognize, underwrite and support small and medium enterprises (SMEs) were designed for a version of small that is out of date. This matters, because recognition shapes everything. It determines who gets credit, how risk is priced, which products are offered, who receives support and which businesses are seen as valuable customers. Both sides of the relationship are affected: small businesses are being overlooked, misunderstood and underserved, while providers risk being outmaneuvered and outplayed by new, emerging players. Here’s why: today’s SMEs span a vast range of businesses across different markets, from digitally native firms and solo creators to plumbers, restaurants, retailers and small manufacturers. Their business models aren’t uniform, but the market serving them assumes they are. This has created a recognition gap.
The SME recognition gap
As it appears
As it is
Result
Few employees
Limited premises
Fragmented accounts
Global suppliers
Platforms
Contractors
Agents
Multiple payment rails
High capability
Hidden complexity
Weak recognition
view section
Capability is separating from headcount, and the old proxies for business size are starting to misread the market.
Size is no limit
1
The modern SME is over-tooled and under-orchestrated.
Fewer tools, more simplification, better recognition
3
As SMEs become more digitally capable, they also become more exposed to failures, attacks and delegated authority risks they have limited capacity to absorb.
Cybersecurity: Smaller business, bigger risks
5
Small businesses are accumulating cross-border complexity before they have the treasury, reconciliation or risk capacity of international businesses.
Global by default
2
AI is expanding what small businesses can do, while shifting more capability into external systems they can’t fully control.
AI: New powers, new dependencies
4
In this issue
Mark Barnett | executive vice president, small and medium enterprises
“Serving SMEs better starts with recognition. If providers keep reading small businesses through old signals, they will miss the capability, complexity and ambition that now sits inside even the leanest firms.”
Produced by Mastercard Foundry Words: Matt Prodger, Ken McKenzie, Michal Rozynek Design: Dave Baxter, Sinead Fitzgerald
Issue contents
Executive summary
1. Size is no limit
2. Global by default
3. Fewer tools, more simplification, better recognition
4. AI: New powers, new dependencies
5. Cybersecurity: Smaller business, bigger risks
6. Conclusion
LISTEN · 5:47 min
Frequently Asked Questions About Small Business, February 2026 Solo Founders Report 2025 PYMNTS | The One-Person Billion-Dollar Company Is Here Dreamonomics – Mastercard 18 market global survey of 6615 SMEs, 2026 Dreamonomics – Mastercard 18 market global survey of 6615 SMEs, 2026 The creator economy could approach half-a-trillion dollars by 2027 | Goldman Sachs
1 2 3 4 5 6
listen to this section · 3:50 min
size is no limit
For much of modern business history, growth meant hiring: a second salesperson, bookkeeper, operations assistant or office manager wasn’t just a hire, it was a unit of capacity. That equation is breaking down. In the US, for example, over 80% of small businesses now have no employees at all, and that figure is increasing, with the number of non-employer firms almost doubling this century 1. There are several causes: better digital tools, wider use of contractors and platforms, more side-income activity, weaker access to stable employment, and the cost and complexity of taking on staff. Together, these forces are expanding the SME category to include sole proprietors, independent contractors, freelancers, self-employed professionals, creators, consultants, landlords, gig workers, and other owner-operated enterprises.
Tomorrow’s small business will deliver outsize impact with a fraction of the workforce. AI, platforms, contractors, creator tools and embedded software are putting capabilities once reserved for larger organizations within reach of one-person and low-headcount firms. This isn’t simply a leaner SME. It’s a different kind of business: small in visible form, broad in operating reach and increasingly misread by banks, payment providers, lenders and policy systems built around conventional signals.
The portfolio of one
Capability is separating from headcount
World Bank data shows that micro, small and medium-sized enterprises make up over 90% of all business organizations worldwide, account for 70% of total global employment, and around 50% of global GDP. But official definitions of the small business vary. Economists classify it as having anything between 1 to 500 employees, and turnover ranges from hundreds of thousands to millions of dollars. Variety within the sector is vast: a solo creator, a family-owned retailer, a high-growth software firm and a mid-sized manufacturer may all sit within the same broad category, despite having very different operating models, risk profiles, financial needs and levels of digital maturity. Geography adds another layer: connectivity, infrastructure, skills, regulation and access to trusted software differ sharply between markets. That’s important for how financial institutions and other enterprises should organize their activities to meet the needs of the future SME.
The link between size and revenue is also weakening. A small but fast-growing set of businesses is proving that a handful of people, sometimes a single founder, can now run what would once have needed a proper department. The important measure is revenue per head: how much economic activity a business can generate for every person it employs. Solo founders now account for a third of new startups2. The much-anticipated “one-person unicorn”3 is an extreme signal: a test case for what happens when revenue, reach and operating leverage detach entirely from payroll.
Revenue is replacing headcount as the new scale signal
Traditional software helped owners work faster. But AI agents can do more: chase invoices, produce cash-flow forecasts, triage customer messages, adjust marketing spend, flag fraud or recommend a supplier payment route. Functions that once required specialist employees or expensive advisers are being rebuilt as always-on digital capability. That changes what a small firm can credibly attempt. Chapter 4 examines this in detail.
AI is expanding operating capacity
The cost of misrecognizing SMall businesses
21%
say accessing affordable loans is a significant challenge 4
54%
say they're using personal finances to run the business 5
This is key: small businesses aren’t just underserved; they’re increasingly misread too. Many of the systems used to classify, onboard and underwrite them still rely on signals built for an older model of firm formation: stable payroll, clear premises, conventional invoices, domestic customers and a visible separation between personal and business activity. Those signals still matter, but they now miss too much. The organization stays small, but its operating reach, and exposure, is growing. A creator with recurring subscription income, a portfolio operator with several profitable micro-ventures or an agent-native business with high revenue and almost no staff can look weak through a legacy lens. We explore this further in chapter 3.
Recognition systems are reading outdated signals
Tomorrow’s SME may not be one person building a clearly bounded firm. It may be a portfolio of micro-ventures, creator income streams, consulting work, subscriptions, marketplace activity and agent-run services. By 2027 the creator economy, for example, is forecast to be twice the size it was in 2023.6 Meanwhile, the number of gig workers in China is now thought to exceed the entire labor force of the European Union. These new ‘pico-businesses’ are not simply smaller versions of traditional firms. Some are side ventures created by people whose wages have not kept pace with rising costs. Others are the result of weaker access to stable employment as AI, contracting and platform work reshape white-collar pathways. The result is more solopreneurs, but often exposed to unstable earnings, limited benefits and fewer protections.
The enterprise is becoming modular
Small businesses are not just becoming more modular in how they use people. They’re becoming more modular in how they use software, platforms and agents. A task that once sat inside the firm can now be handed to a contractor, a specialist platform or an AI agent with access to calendars, catalogues, inventory, pricing, payments or customer data. That makes the business look leaner and more capable, but also harder to read. The visible firm may be only the owner and a few tools. The real operating model may depend on a wider network of external actors, delegated permissions and automated decisions that lenders, insurers and even the owner may not fully see. A contractor can miss a deadline. A platform can change its terms. An agent can act on poor instructions. A provider can alter pricing, access or data portability.
Invisible dependencies are reshaping risk
PLAUSIBLE FUTURE
Femi is hard to classify. From a single dashboard he runs a cycling jersey brand, a paid newsletter for freelancers and side-hustlers, and a small property venture, with agents handling invoices, customer queries, campaigns and supplier payments. The income is steady, but messy: revenue arrives through platforms, subscriptions and shared assets, while personal and business spending often blur in the same accounts. When demand for jerseys spikes and he applies for credit, the lender sees fragmentation rather than scale. One provider approves him by seeing the pattern underneath: repeat customers, recurring payments, clean cash flow and diversified income. Most still miss the signal because they only recognize yesterday’s small business.
What providers need to solve
Build a new recognition model around three questions:
Is the business’s activity verified and its revenue durable? How wide and complex is its operating reach? How resilient is it when suppliers, platforms, payments or digital systems fail?
This gives providers a practical alternative to judging SMEs by headcount, premises or conventional scale.
previous
Globally micro, small and medium-sized enterprises account for
listen to this section · 2:27 MIN
Mastercard - Money in Motion www.fxcintel.com Mastercard - Money in Motion Mastercard - Money in Motion Mastercard - Money in Motion Mastercard - Money in Motion Mastercard - Money in Motion
7 8 9 10 11 12 13
Agent as brokers
Cross-border is now a baseline expectation for small business. SMEs expect international payments to be as fast, transparent and predictable as domestic ones, whether they’re paying overseas suppliers, hiring foreign contractors, selling through global platforms or managing multiple currencies. Where established providers are failing to deliver, SMEs are moving to fintechs and emerging payment solutions that offer greater speed, clarity and control. Cross-border is no longer a specialist need confined to established exporters. It’s a core requirement of doing business, and a new front in the battle for the SME relationship.
Many SMEs become international through what they buy and not just what they sell. A business may serve an entirely domestic customer base while sourcing stock, components, packaging, software, creative services or specialist labor from abroad. From the outside, it looks local but operationally, it’s already cross-border. This is important because buying internationally creates different pressures from selling internationally. A delayed supplier payment can disrupt inventory. An unclear FX spread can erode margin. A deduction by an intermediary bank can damage trust with a partner. A settlement delay can create a cash flow problem even when the business is profitable. For a large company, these frictions are absorbed by teams and systems. For an SME, it’s often down to the owner. That’s why cross-border infrastructure needs to be designed around operating confidence, not just payment initiation. The more that international exposure becomes embedded in routine buying, the more these questions become central to business resilience.
SMEs are importing global complexity
Additional costs attributed to operational inefficiencies (%SMEs) 9
2024
$13.8tn
2030
$21.2tn
% SMEs Conducting Weekly Cross-Border Transactions 7
Digital capability is making international activity possible for even the smallest business. E-commerce platforms open access to overseas customers, digital marketplaces connect firms to global suppliers, collaboration tools make foreign contractors practical, and cloud software allows work to move across borders from day one. SMEs no longer need overseas offices, large teams or a formal export strategy to operate internationally. The same tools that expand their reach also introduce foreign currencies, cross-border payments and new regulatory obligations earlier in the business lifecycle.
Stablecoins demonstrate what SMEs now expect from cross-border payments: speed, fee clarity, settlement certainty and fewer surprises. Mastercard research13 found that roughly 40% of SMEs and middle-tier companies across 11 main global markets already use stablecoins in some capacity, while one in 10 rely on them as a primary cross-border provider. The reasons are telling. Companies that switch to stablecoin providers most often cite faster settlement, greater fee transparency and lower total cost. The customer satisfaction score (NPS, or Net Promoter Score) for stablecoin platforms is already +44, ahead of traditional banks at +37. Stablecoins won’t replace existing rails wholesale, but they’re exposing where legacy cross-border experiences still fall short. SMEs don’t care which rail wins. They care whether money arrives on time, in the expected amount, with enough visibility to plan around it.
Stablecoins are reframing the cross-border standard
SME Cross-Border Payments expected to Grow 54% by end of decade 8
13%
Almost half of SMEs say operational inefficiencies add more than 10% to XB costs.
27%
12%
7%
3%
38%
<5%
5-10%
11-20%
21-30%
41-50%
Proportion of SMEs
XB cost rise due to operational inefficiencies
This turns international growth into an administrative problem that creates relationship risk. A delayed or underpaid supplier doesn’t experience a “payments issue”: they experience an unreliable customer. So the bigger issue is not price alone, but control and predictability. Roughly nine in ten SMEs rate real-time liquidity visibility and predictability as important,10 and the strongest drivers of liquidity satisfaction include real-time fund tracking, notifications and payment scheduling. In other words, cross-border capability is increasingly judged by whether a business can see, plan and reconcile what is happening across the payment lifecycle.
Money in Motion survey
SME in USA
"Transparency is the most important factor, then keeping cost low, then speed of transaction"
SME in Uk
"I'd prioritize total fee transparaency so there are no hidden exchange rates markup"
SME in INDIA
"Operational clarity matters as much as transaction speed"
For SMEs, the burden is rarely just the headline cost of sending money abroad. It’s also uncertainty. Mastercard research has found that about half of SMEs estimate operational inefficiencies such as delayed settlement and manual reconciliation add more than 10% to total cross-border payment costs. Hidden FX margins and unclear deductions also matter, with 36% saying they make providers appear cheap upfront but more expensive overall.
Payment uncertainty is creating hidden operating costs
Mastercard research shows that 85% of SMEs use two to four cross-border payment providers, because different corridors, suppliers, platforms and use cases demand different capabilities, client and supplier requirements, FX-rate comparison, corridor-specific performance, coverage gaps, optionality, enterprise resource planning systems or accounting integrations. No single provider solves every need. Instead SMEs are often assembling their own cross-border operating stack, which makes orchestration a core need. A business that pays one supplier abroad twice a year can tolerate friction. A business that pays workers, suppliers and platforms across borders every week needs visibility, predictable delivery, reliable reconciliation and a way to understand which provider or rail is best for each flow.
Cross-border is becoming an orchestration problem
of SMEs use 2-4 cross border payment providers 11
85%
6+
4%
15%
41%
32%
8%
This desire for greater control over cross-border payments is one reason SMEs are turning toward fintechs, with a net migration of around 20% from banks over the past three years. The same Mastercard research shows this is most often triggered by speed, cost and transparency. But those triggers point to a broader need: SMEs want the payment experience around the transaction to be clearer, more predictable and easier to manage. Three in four firms are exploring or actively looking for value-added services providers. Fintechs gain when they package execution, information and workflow into one experience.
SMEs are choosing fintechs over banks and traditional money transfer operators
Mastercard Move is Mastercard’s portfolio of money movement capabilities, enabling banks, fintechs and businesses to send and receive funds across multiple rails, markets and endpoints through a single global network. It connects to more than 200 countries, more than 150 currencies and around 17 billion endpoints, including cards, accounts, digital wallets, cash and stablecoin wallets. For SMEs managing suppliers, workers, platforms and customers across borders, that reach supports faster, more transparent and more predictable payments without requiring each business to build the infrastructure of a larger enterprise.
Mastercard Move
product
Cross-border is becoming basic SME infrastructure. Providers that fail to make international activity feel domestic, visible, predictable, transparent and easy to reconcile will lose the relationship to those that do. The prize at stake is more than payment volume. It’s the role of operating partner for the next generation of small multinationals.
Strategic implication
Local business, global back office
Amara runs a three-person interiors business. Most of her customers are local. Her brand is local. Her reputation is local. On paper, she looks like a domestic small business. Behind the scenes, the business is already international. She sources tiles from Portugal, lighting from Vietnam and custom fixtures from Poland. A freelance designer in Mexico prepares client mock-ups overnight. A marketplace in Germany now accounts for a small but growing stream of orders for her own line of cabinet handles. By 2030, Amara’s financial dashboard no longer separates domestic and international activity the way her old banking tools did. It shows supplier payments due, currency exposure, expected delivery windows, platform payouts and cash-flow risk in one view. Her payment agent recommends when to pay in dollars, when to settle in local currency and when to hold a payment until an invoice is validated. Amara still thinks of herself as running a local business. Operationally, she is running a small multinational without the staff, systems or margin for error that larger international businesses rely on.
Become the operating layer that helps SMEs manage international complexity. Make cross-border activity manageable for SMEs with clearer pricing, predictable settlement, better tracking and easier reconciliation across providers and corridors.
Pratik Khowala | executive vice president, transfer solutions at
“The new cross-border standard for SMEs is speed and predictability. They need to know what a payment will cost, when it will arrive, what the recipient will receive and how quickly they can reconcile it afterward”
The continued migration away from banks to fintech postion the latter as preffered option in the next 3 years 12
CURRENT
3 YEARS
Fintechs / payment providers
Stablecoin platforms
Traditional banks
Traditional MTOs / FX brokers
"I want everything more automated, everything faster. A little click and I can see everything. A dashboard on a single screen, consolidated" Sheila | Brazil, civil construction, partner
The invisible bank
Connected workflows are replacing standalone tools
Time savings are becoming the proof point
Priya runs a ten-person cleaning business. She used to start each day in her banking app, then spend Friday reconciling statements, invoices and payroll risk in a spreadsheet. The bank showed what had happened. It did not help her decide what to do next. By 2030, that relationship sits inside her workflow. Her operating system tracks expected receipts, supplier terms, payroll dates and seasonal cash flow pressure. When two customers pay late, it shows which payments can wait and whether short-term credit would cost less than delaying payroll. Crucially, her bank can now see the evidence that legacy models missed: repeat customers, regular card receipts, low disputes and predictable payroll. It pre-approves credit before a cash flow gap becomes a crisis. Matched invoices are paid automatically. Unusual payees, changed account details and larger invoices are escalated. Priya no longer thinks of this as banking. She thinks of it as one less thing standing between her and the work she needs to do.
The modern SME doesn’t lack tools. It lacks simplicity. Payments, accounting, payroll, marketing, inventory, banking, fraud, customer service and cash flow applications each solve a problem in isolation. Together, they can make the business harder to run and harder to read. The owner sees fragments. So does the provider. Better orchestration will give owners more time, while helping providers recognize performance, risk and need more accurately.
Small businesses are already digitized. Mastercard research reveals SMEs use an average of five or more business tools, employ three different payment methods when making payments, and accept five different payment methods from customers. Each tool solves a specific problem, but together they create more work: switching between interfaces, reconciling partial views of the business, checking which system is correct and manually moving information from one workflow to another. Every new dashboard, workflow, prompt, approval step or self-service journey competes with the more important tasks of selling, serving customers and keeping the business moving. This is important to recognize because SMEs don’t always share the same priorities as bigger businesses: the same Mastercard research found that 68% of SMEs prioritize stability and predictability over rapid growth. That helps explain the appeal of platforms designed to simplify the operating environment: examples include Acumatica,14 which combines more accessible ERP tools with flexible licensing for SMEs, and Odoo,15 which brings CRM, accounting, human resources, inventory, marketing and sales into a single customizable, open-source platform.
SMEs are being over-tooled and under-orchestrated
"I just wish I could have everything in one place... banks, suppliers, accounts receivable, accounts payable, everything I do financially in one single tool. That to me is my end goal. It will be easier and faster to expand and escalate my business." Daniel | U.S, hospitality and travel, owner
“I want everything
more automated...”
This is already changing where SME financial relationships begin. As more operating activity moves into software, banking and finance are increasingly embedded in the setup, workflow and management journeys where work gets done, rather than accessed through traditional branch, comparison or relationship-banking channels. In startup and new business journeys, incorporation platforms, legal tools and setup services can steer founders toward fintech banking providers right at the start, making the financial account part of the business setup workflow rather than a separate procurement decision. This signal is important: SME financial relationships are increasingly formed inside software journeys, and the provider that controls the workflow often controls the moment of choice.
54% prefer bundled solutions
27% want consolidated financial tools
41% seek greater efficiency
29% want clearer financial visibility
Consolidation
VISIBiLITY
78%
INTEGRATION
Many SMEs crave...18
say business tools that work well together / are integrated are critical
24
number of days each year that British small businesses lose to financial admin21.
SMEs are getting harder to read. They’re more diverse, more digital and less likely to fit the stable signals providers have traditionally used to assess them. As a result, they can look riskier, smaller or less attractive than they are. Credit decisioning illustrates this gap. Mastercard research finds that nearly half of small business borrowers say they’ve faced denial or unfavorable terms in the past two years.22 A big issue is recognition: the data used to judge many SMEs often fails to capture how they actually operate. This requires a shift to verified operating signals beyond the traditional credit file: sales patterns, payment regularity, repeat customers, bookings, disputes, platform income, supplier commitments and cash flow rhythm can reveal operating strength that conventional records miss.
Recognition is moving from identity to activity
A recent survey shows how SME lenders are responding 23
say modernizing credit decisioning is a high or critical priority over the next two years.
76%
plan to invest in real-time credit assessment capabilities.
88%
say alternative data has had a positive impact on operational efficiency.
82%
This is why embedded finance and vertical software matter. Sector-specific platforms which sit inside daily workflows can see the signals that lenders often lack. In one Indian bazaar study, wholesalers extended 11% more credit to retailers who shared fuller sales information. 24 Toast, a restaurant technology platform, illustrates the same principle in software: payments, ordering, payroll, inventory and financing sit in one operating environment, allowing funding to be shaped by fresher business signals and repaid in line with daily sales. 25 In Europe almost half of surveyed SMEs already use some kind of embedded finance, and two-thirds plan to use new or additional products through their software provider in the next 12 months.26
Kaushik Gopal | executive vice president, business and market insights at
“Too many credit decisions are still being made with an incomplete view of the SME. Expanding access to capital isn’t about lowering standards, it’s about improving how we understand real financial behaviors.”
The battle for the SME relationship will be won inside the operating workflow, not at the account level. Providers that remain as standalone products risk being pushed behind another’s interface and reduced to interchangeable utilities. Those that connect financial and operational activity, remove administrative drag and turn live business data into better decisions will become harder to displace. They’ll also gain the intelligence advantage: faster onboarding, sharper credit decisions, earlier risk detection and more relevant support.
Become the operating layer that turns live business activity into better recognition. Connect fragmented workflows, remove administrative drag and use verified operating signals to make faster, more accurate decisions on credit, risk and support.
Mastercard Credit Intelligence helps lenders build a more complete view of small business creditworthiness by complementing traditional credit information with payments network and Open Finance insights. This broader view of business performance supports more informed lending decisions and can help expand access to capital for small businesses.
Mastercard Credit Intelligence
Acumatica | Cloud ERP Business Management System Open Source ERP and CRM | Odoo Dreamonomics – Mastercard 18 market global survey of 6615 SMEs, 2026 Docyt Dreamonomics – Mastercard 18 market global survey of 6615 SMEs, 2026 Small Business & Entrepreneurship Council – Small Business Technology Use Survey, 2026. bppblog.com 13 months of work, 12 months of pay: the hidden admin burden on small businesses Expanding access to credit through smarter insights | Mastercard Europe Expanding access to credit through smarter insights | Mastercard Europe Information Preference and Credit Allocation in a Bazaar Economy Toast POS How Embedded Finance Is A Growth Engine For SMEs And ISVs
14 15 16 17 18 19 20 21 22 23 24 25 26
Mastercard Dreamonomics survey
The signal is clear: SME technology demand is moving from access to coherence. Seventy-eight percent of SMEs say integrated tools are critical. More than half prefer bundled solutions. Forty-one per cent want greater efficiency through better workflows, and many are seeking clearer visibility into business performance.16 The owner doesn’t need five more dashboards. They need fewer points of failure, cleaner hand-offs between systems and a more reliable view of what is happening across the business. One example is Docyt, 17 a real-time bookkeeping and reporting platform that is aimed at the hospitality vertical; its proposition leads with a ‘one stop shop’ benefit for SME users, removing the pain point of working across several platforms.
Small business owners experience administrative overload most directly. Providers can help by showing owners exactly how time can be saved and where work can be removed. SMEs don’t have the division of labor opportunities that large enterprises have, and so bottlenecks recur when small business owners or their employees have to do something new in their working day. Every new tool demands the owner learn another interface, trust another recommendation, maintain another login and absorb another workflow into a day that is already under pressure. A survey of US small business owners found that using AI yielded a median time saving of 5 hours per week for each owner, and a median of 11.5 hours per week for each employee.19 Time is money for small business owners in a way it often isn’t for enterprise employees. A service that saves ten minutes a day may be more valuable than one that promises transformation but requires a new operating habit to unlock it. That changes how providers should think about engagement. Before launching a new service, providers should run a sludge audit: how many steps, decisions, documents, logins, explanations and minutes are being demanded from the owner, and what work must be displaced to make room for it?20
Good work, weak signals
The autonomous firm doesn’t yet exist as a mainstream category, but there is a clear progression towards it. First, owners use AI to automate isolated tasks. Then they connect those tasks into workflows. Next, agents begin to hold delegated authority over parts of the business: responding to customers, adjusting marketing spend, chasing invoices, recommending supplier payments or escalating fraud. This changes the operating system: in effect, the business owner moves from controlling digital tools to granting agents the power to decide and execute, with the capacity to continuously optimize all aspects of the business. But delegation only scales when owners can trust agents to act within intent, authority and limits, and when every action can be seen, stopped, explained or reversed.
The autonomous firm is emerging
Noor runs a five-person firm installing heat pumps and home energy systems. Her scheduling agent keeps vans full, her pricing agent adjusts quotes by urgency and her service agent answers routine questions while engineers are on jobs. The business is well run, but then new leads start drying up. More customers now rely on home-management apps and buyer agents that compare installers before a homeowner sees a shortlist. Those agents increasingly favor providers that can confirm appointments instantly, expose live capacity, attach verified insurance and ratings data, and offer standardized service guarantees. Noor’s reputation is real, built through repeat customers, careful advice and jobs fixed properly the first time. But much of that reputation comes from recommendations, local referrals and fragmented platforms. To the agents assembling shortlists, larger competitors simply look easier to verify, book and recommend. AI has expanded Noor’s operating capacity, but it has also made visibility depend on structured data, verified credentials and real-time signals she doesn’t fully control.
AI is rewriting small business from the inside. The revolution is happening quietly, as everyday software starts doing the work, making decisions and running parts of the business. SMEs will gain extraordinary operating power, but risk losing visibility and control over the systems behind it. The prize belongs to providers that make AI essential, trusted and governable, not another black box SMEs can’t escape.
AI increasingly enables SMEs to do the tasks that used to need big budgets, specialist teams or expensive advisers. A founder can produce campaign copy, analyze customer segments, forecast cash flow, draft policy documents, test product ideas and automate routine service interactions without hiring for each function. That changes the competitive baseline. The small firm no longer competes on headcount. It competes by using the operating system it can assemble around itself. AI lowers the cost of capability and lets SMEs attempt work that previously would have been out of reach.
AI is democratizing capability at the surface
Greg Ulrich | chief AI and data officer at
“For small business owners, AI adoption will be judged by the value it creates. If a tool saves time, removes work, reduces uncertainty, improves decisions, or makes the business easier to run, it becomes valuable. If it adds complexity, it becomes just another system to manage”
AI is breaking the link between the size of a business and the scale of its ambition. Small firms will be able to act with the speed, reach and sophistication of much larger organizations, but more of their judgment will sit outside the firm, inside models, agents and platforms. That makes AI both a force multiplier and a new source of concentration risk. Competitive advantage will shift from owning capability to controlling how external intelligence is used, where authority sits and how easily the business can switch when costs, performance or trust change.
From digitalization maturity to AI readiness: Dreamonomics – Mastercard 18 market global survey of 6615 SMEs, 2026 Mastercard launches Agent Suite to ready enterprises for a new era | Mastercard Global Polsia — AI That Runs Your Company While You Sleep Locus Founder — AI Co-Founder & AI Business Builder Runable - Build, Grow and Run your Business naïve — Autonomous companies dodopayments.com Luca | AI Operating System for E-Commerce Brands andonlabs.com Virtual C-Suite Human + Synthetic Research - Qualtrics Edge Audiences Marketing Execs Drowning in Data Still Rely on Gut Instinct When Algorithms Attack: Small Businesses Getting Lost Online Q2 Cloud Market Passes $143 Billion; Highest Growth Rate in Eight Years | Synergy Research Group Half of AI's record $407B went to OpenAI, Anthropic in H1 2026 as mega-deals reign - PitchBook OpenRouter is Joining Stripe — OpenRouter Blog
27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43
Current benefits of AI cited by small business owners 28
There’s a risk that the public narrative around AI pushes small businesses toward the wrong starting point. Market hype often celebrates the most transformative use cases, while underplaying the practical value of routine automation. For an owner with limited time, this can distort adoption. If AI feels like another system to manage, rather than a way to remove unwanted work, it becomes a burden, not a benefit. A better approach is to aim for automation first, and transformation later: prove AI in time-consuming, repetitive tasks, then expand into higher-order decision support once trust and habit have formed. A study of Swedish manufacturing SMEs blended survey data and financial records to show that even early- to intermediate- stage use of AI was correlated with higher revenue per employee (RPE).27 For many SMEs, especially everyday businesses and those operating in markets with weaker digital infrastructure, adoption will be indirect. AI will arrive inside the software they already use, rather than as a separate technology decision. The evidence supports this: nearly two-thirds of surveyed SMEs use at least one AI-enabled application, but three-quarters of AI-using firms are still “AI novices.” Most are using off-the-shelf tools for isolated tasks, and not yet redesigning operations around AI. This is a maturity spectrum, rather than a divide between technology firms and everyone else.
Automation is building the case for transformation
Saves time on routine tasks
Supports marketing and content creation
Reduces errors and oversight
Provides learning and problem-solving support
Improves customer communication
Supports planning and forecasting
Helps attract and target customers
Supports better business decision-making
44%
34%
31%
29%
28%
Mastercard Agent Suite shows how this can work in practice. Mastercard-built agents can be customized, tested and deployed around specific business needs and use cases, from product discovery and enhancing shopping to streamlining merchant onboarding, simplifying dispute resolution and helping banks deliver financial guidance to their SME customers. For SME owners, the immediate benefit is removing narrow, repetitive work that already absorbs too much owner time. When tasks are automated reliably, broader change becomes easier to justify. Transformation follows trust, not the other way around.
Mastercard Agent Suite 29
A new market is forming around the agent-operated business. Polsia30 and Locus Founder31 are testing AI systems that build and run companies, while Runable32 can turn an idea into the external assets needed to launch and grow, including websites, campaigns, apps and content. Naïve33 provides the identity, permissions and budgets needed to govern teams of agents. Dodo Payments34 provides AI-native billing and payment infrastructure. Luca AI35 points to the next stage: an AI operating system that connects commerce, marketing, inventory and cash data for e-commerce SMEs, with plans to underwrite dynamic capital based on the operating intelligence it can access; and Andon Labs36 tests how autonomous organizations perform in the real world. Together they reveal a recognizable stack: creation, orchestration, identity, payments, connectivity and control.
The autonomous-business stack
Mastercard's own product thinking points in this direction, exploring a "Virtual C-Suite" for small businesses: a virtual CFO, CMO and CISO, each coordinating narrower worker agents such as cash-flow managers, B2B payment advisors, fraud monitors and outreach agents. The signal is not simply automation. It is delegation: giving trusted agents bounded authority to act on the owner's behalf, while keeping the owner in control of permissions, exceptions and final accountability.
Mastercard Virtual C-Suite37
Market intelligence is one example of capability moving within reach of the small business. Research that once required panels, agencies and analysts can increasingly be approximated through AI-generated personas, synthetic audiences and rapid concept testing. AI personas can be queried in hours rather than the weeks required for recruitment, fieldwork and analysis, and synthetic audiences can cut research costs by up to 50%.38 Early movers in the sector include Electric Twin, Aaru, Simile and Wevo. Early adoption is already broad: among marketing and insights teams, 68% already use synthetic approaches to generate customer insights.39 For SMEs, this means sophisticated customer intelligence can become part of the operating model.
Insight is becoming part of the one-person operating model
Agentic commerce changes visibility in ways that currently favor large brands with the budgets, teams and infrastructure to shape how they appear in search, marketplaces, recommendation engines and reviews. Even before the arrival of agents, over a third of small businesses said their search visibility had declined despite increased digital marketing. 40 As buyer agents proliferate, discoverability becomes less about persuasion and more about machine-legible data: verified products, prices, policies, credentials, availability and trust signals. That shift from marketing to metadata extends beyond discovery. Agents may compare prices, check delivery terms, apply spending rules, select substitutes, initiate returns or reorder from the supplier that is easiest to verify and transact with. Brand, service and local reputation still matter, but they may be filtered through structured signals first, creating thinner customer relationships, more margin pressure and less room for SMEs to explain value beyond price, availability and policy fit. Early products show a new optimization market forming around this problem: Pie helps local businesses appear in AI search and respond through an AI front desk, ReFiBuy enriches catalogue data for shopping agents, and Mastercard’s Agent Suite helps businesses create agent-ready shopping experiences. The signal is clear: visibility is becoming a data and infrastructure problem, not just a marketing problem.
Customer relationships are becoming agent-mediated
While AI generates new opportunities for SMEs, it is also creating new dependencies on those providing the intelligence. The models, cloud platforms and orchestration layers that make AI useful are expensive to build and unevenly distributed. Many SME-facing tools may look diverse at the front end while relying on a relatively narrow set of infrastructure providers behind the scenes. Cloud concentration provides an early example of why this matters: nearly two-thirds of enterprise cloud spending goes to just three providers: Amazon, Microsoft and Google.41 AI workloads deepen reliance on external platforms because model training, inference and agentic systems require massive compute. Between them, OpenAI and Anthropic captured over half of the VC funding for AI in the first half of 2026.42 Even when a small business thinks it’s choosing between AI tools, the underlying dependency may resolve back to a much smaller set of providers. If the same external systems help decide which suppliers to pay, which customers to prioritize, which risks to flag, which content to produce and which products to promote, the platform no longer only shapes market access. It shapes a business’s judgment architecture.
Platform dependency is a growing risk
The market is responding by building products which manage AI platform dependency. Model routing is a new solution which allows businesses to combine proprietary and open-source models, shift lower-value tasks to cheaper inference options and save higher-performing models for work where quality matters most. This is important because token costs are becoming a meaningful operating expense for agent-native SMEs. As agents handle service, marketing, analysis, coding, procurement and payments work, AI usage is becoming a significant variable cost of doing business. Stripe’s recent agreement to acquire OpenRouter43 points to this shift: routing and usage optimization are becoming part of the infrastructure of AI-native commerce. For most SMEs, this won’t be something they manage directly. A local retailer, trades firm or services business adopting AI on top of legacy processes is unlikely to choose between models task by task. But the routing decisions may still shape its economics, because they will increasingly happen inside the software platforms SMEs already use. Providers that can show SMEs what AI work is being done, what it costs, which systems are doing it and when a cheaper or safer route is acceptable will be better placed to turn AI from a hidden dependency into a managed operating capability.
AI lock-in is spurring routing innovation
Turn invisible AI into trusted operating power. Give SMEs the benefits of automation without the black boxes, hidden decisions and platform lock-in. Make delegation safe, transparent and reversible.
Cybersecurity Smaller business, bigger risks
The agent as a point of failure
Agentic systems change the cybersecurity problem because they do much more than simply store information. They act, remember and communicate on behalf of the business. That means the attack surface is no longer limited to accounts, devices and data stores; it includes delegated authority. And risk becomes about more than adversarial attacks by bad actors. Instead, it’s a broader concern about whether legitimate agents can be governed well enough for owners to trust them with consequential work (this “trust gap” is discussed in detail in our previous edition of Signals).48 There are three connected risks:
Delegated authority is becoming the new attack surface
Maya runs a small firm servicing fridges for restaurants and convenience stores. Her AI support agent handles routine queries, confirms engineer visits and checks service histories. When the agent is compromised, customer records are quietly copied: faulty equipment, service dates, site contacts and open repair requests. The data is then used for targeted scams. One restaurant receives a phishing email with a fake alert about the freezer that failed the week before. A store manager gets a call just before a real engineer visit and is asked to approve remote diagnostics. The scams work because they use details only a trusted supplier should know. The issue is not downtime. It is doubt. Customers now see Maya’s firm as the source of risk inside their own operations. Some pause new jobs; others move contracts elsewhere. Agents will increasingly carry customer trust, and when that trust is compromised, reputation can take longer to restore than any system.
For a small business, a cyberattack can be an extinction event. Lean, software-led SMEs may have greater reach and capability than ever, but they have little capacity to absorb disruption. As more of the business runs through digital tools, AI agents and external platforms, a single failure can stop payments, expose customers and erode trust. The threat is no longer confined to IT: it can put the entire business at risk. Mastercard research found that one in five SMEs closed down after experiencing a cyberattack.44
Every provider serving SMEs is now in the resilience business. Payments, software, lending and insurance relationships are only as strong as the business’s ability to keep operating through attack or failure. Protection is no longer a product category. It is part of the core proposition.
Small business cybersecurity: Survey shows reason for worry | Mastercard Newsroom Dreamonomics – Mastercard 18 market global survey of 6615 SMEs, 2026 Outstanding WEF_Global_Cybersecurity_Outlook_2025.pdf Signals | Encoding Trust | July 2026 - Summary CounterShadow | AI SOC & Autonomous Security Operations AI SOC Platform with Agentic AI SOC Analyst | Prophet Security Unaware, Unfunded and Uneducated: A Systematic Review of SME Cybersecurity Dreamonomics – Mastercard 18 market global survey of 6615 SMEs, 2026 Coro
44 45 46 47 48 49 50 51 52 53
interest in ai-generated products46
Small businesses typically have smaller budgets, weaker security coverage and less tolerance for downtime. Ransomware attackers understand the pressure this creates: a business that cannot process orders, access accounts or pay suppliers may feel forced to resolve the incident quickly. The smaller the margin for disruption, the more powerful the threat becomes. As a result, fraud and security protection tops the list of AI products SMEs are interested in buying.45 The future SME is not defined by ignorance of risk. It is defined by the distance between the sophistication of threats and the resources available to manage them.
Threat sophistication is outrunning SME defences
Al-powered fraud and security protection
Smart invoice and payment follow-up
Al-driven expense control and savings suggestions
Al-assisted pricing and margin guidance
Automated bookkeeping and expense categorization
Personalized learning and guidance for business growth
Predictive cash-flow and revenue forecasting
Smart recommendations for payments and financing
35%
33%
30%
The same qualities that make agents risky also make them powerful defensive tools. Agents can monitor signals across email, payments, devices, identity, cloud tools and customer workflows in ways most small businesses can’t. They can flag unusual supplier requests, detect changes in payment behavior, challenge suspicious logins, quarantine risky attachments, tighten permissions and guide owners through response steps when something looks wrong. This matters because SME cyber resilience can’t depend on the owner becoming a security professional. An emerging market for AI-powered Security Operation Centers (AI SOC) points to a different model: a virtual security team for smaller firms, embedded into the tools they already use. Companies such as CounterShadow49 and Prophet AI50 are building toward that proposition, using AI to package threat detection, investigation and response into services that are simpler and more affordable than traditional enterprise security operations. Well-governed agents can reduce the gap between rising threat sophistication and limited SME capacity.
The virtual security team is arriving
Awareness is not the same as readiness. Many small business owners understand that cyber risk matters,51 but that doesn’t mean they have the time, expertise or budget to address it. While 71% prioritize protection from cyber threats, only 37% currently use cybersecurity tools.52 Security competes with sales, payroll, customer service and cash flow. Even when the owner intends to act, the work is easy to defer because its value is most apparent only after something goes wrong. That’s why cybersecurity for SMEs cannot rely on education alone. It needs to be built into the tools, workflows and permissions they already use. Coro’s53 proposition is built on the idea that SMEs don’t have large teams of cybersecurity professionals that they can call on to keep their business running; such propositions explicitly identify the limits that SME owners are operating within and make it easier to address them.
Awareness is increasing, but readiness is not
Cyber resilience is becoming part of how small businesses are read. A breach can interrupt trading, drain working capital and damage customer confidence. But the consequences increasingly extend beyond the incident itself. Insurers, lenders, platforms and larger customers may start to treat weak security posture as evidence of operational risk. A capable firm may still look harder to insure, finance or contract with if it cannot show how it protects critical systems, governs delegated authority and recovers when something fails.
Security posture is becoming a financial signal
Make resilience automatic. Detect threats before they become crises, contain failures before they spread and restore operations before customers lose confidence. SMEs need protection that works without demanding a security team.
my organization’s cyber resilience is insuffficient 47
Small business
Large business
2022
2025
5%
An attacker doesn’t always need to shut down a system or steal money directly. Compromising an agent can reveal operating knowledge, impersonate a trusted workflow or help target customers and suppliers with more credible scams. Security models built around human credentials are evolving for a world in which non-human actors hold operational authority and carry customer trust.
what agents are allowed to approve, change or trigger.
Authority risk
what agents know about customers, suppliers, sites, prices, complaints and pending work.
content risk
whether customers, suppliers and owners can trust what agents say.
communication risk
ConClusion
Small business has outgrown the systems used to define it. Headcount, premises and geography reveal less and less about a firm’s capability, complexity or ambition. Providers that continue to read SMEs through yesterday’s signals will misprice their risk, underestimate their value and fail to understand where the relationship is moving.
Recognition models
that price activity, complexity and resilience rather than size alone.
What leaders should do now
Providers that recognize these changes early can become part of tomorrow’s SME operating model. Those that don’t will be left to serve a version of small business that no longer exists.
This recognition gap will decide who owns the next generation of SME relationships. The advantage will shift to providers that can see the whole business, simplify how it operates and extend finance, protection and support at the moment of need. Those that cannot will be pushed behind better-informed platforms, reduced to interchangeable utilities or left serving a version of small business that no longer exists.
Move from processing transactions to orchestrating money movement across platforms, currencies and corridors.
Set a higher cross-border standard built on total cost clarity, predictable settlement, real-time tracking and rapid reconciliation.
Payment providers
Treat AI maturity as a progression. Embed useful automation into familiar workflows, prove value through work removed and expand delegated authority only as trust grows.
Own the simplification problem: connect fragmented workflows, remove administrative drag and turn operational data into usable intelligence.
Software platforms
Reward businesses that can demonstrate strong governance, recoverability and operational controls.
Expand from cyber protection toward resilience, recovery and delegated-authority risk.
Insurers
Use those signals to identify viable firms earlier, price risk more accurately and extend support before a cash flow gap becomes a crisis.
Replace blunt proxies for scale with verified signals of revenue quality, live activity, operating complexity and resilience.
Banks and lenders
in which machine-readable trust signals shape who is discovered, recommended and chosen.
Agent-mediated commerce
becoming a core governance issue as AI systems evolve from advice to action.
Delegated authority
toward integrated operating environments, where providers embedded within workflows can capture more value.
Competition shifting
Ken Moore | chief innovation officer at
Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re building a resilient economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.
“Small no longer means limited. The next generation of SMEs will create more value with fewer people, fewer fixed assets and far less warning to incumbents. Institutions that underestimate them will underestimate the market itself. Now is the time to rethink what small business can become.”
