Mastercard's Dreamonomics research found that 79% of SMEs in Türkiye treat protection from cyber threats as a key priority, while only 40% use basic tools such as antivirus software and firewalls.
Mastercard published the Türkiye findings of Dreamonomics, its research into how small and medium-sized businesses see the years ahead, on 14 October 2026. The quantitative work was carried out for Mastercard by Hypothesis between 23 February and 1 April 2026: an online survey across 18 markets with 6,615 owners, founders and senior decision-makers at companies employing fewer than 250 people.
The sharpest finding is the distance between intent and practice. 79% of SMEs in Türkiye describe protecting the business from cyber threats as a key priority, ahead of the 71% global figure. Yet only 40% use basic security tools such as antivirus software and firewalls. The same research reports that 75% prioritise predictability in how they run the business, and 52% avoid taking risks in order to keep their financial position predictable.
Why the gap matters
Treating security as a priority is not the same as putting it on a system. The numbers suggest most businesses understand the issue but have not finished even the first layer of protection. Without current endpoint protection, a properly configured firewall and a backup routine that actually runs, the layers above them - training, cyber insurance, AI-assisted tooling - cannot deliver what is expected of them.
The research also shows that 69% of SMEs in Türkiye are excited about what AI could do for their business and 36% are interested in AI-powered fraud prevention and security products. 82% say it is critical that the digital tools they use work together, against a global figure of 78%.
What this means in Türkiye
Basic technical measures are not merely good practice here; they are a legal expectation. Article 12 of Law No. 6698 on the Protection of Personal Data requires data controllers to provide an appropriate level of security to prevent unlawful access to personal data. Access control, a working patch routine and backups sit directly inside that duty. Law No. 7545 on Cybersecurity, in force since 2025, has raised supervisory and reporting expectations on the corporate side as well.
What we see on site matches the survey. Construction offices, maritime and agency firms, logistics operators and manufacturing plants usually do have a firewall. But the rule set has not been reviewed in years, remote access is open to everyone, or the backups sit on the same network as the data they protect. What is missing is not willingness to invest. It is routine maintenance.
What we recommend at Kamer Bilişim
- Inventory first, tools second. Put every server, NAS, firewall and laptop that is reachable from the internet on a single list. Nothing that is absent from that list should keep its remote access open. In most SMEs this takes less than a day and usually turns up a forgotten VPN account or an old camera recorder.
- Move backups to the 3-2-1 rule and test the restore. Three copies, two different media, one kept off the network. Once a month, actually restore a sample file and, where you can, a server. A backup that has never been restored is not a backup.
- Put patching on the calendar. Set a fixed monthly maintenance window for firewall firmware, server operating systems and endpoint protection. A corporate maintenance agreement runs that window without relying on anyone's memory, and folds regular review of system logs and access rights into the same cycle.
All three steps aim at the "basic tools" layer the research found missing. For businesses across the Anatolian side of Istanbul we can assess your current setup on site, and remotely elsewhere. You can reach us through our contact page.
Source: Mastercard "Dreamonomics" research, Türkiye findings, 14 October 2026 - Fintechtime; Donanim Haber.
Source: Fintechtime