Las Vegas, Memphis, and Charlotte top the list of least cybersecure US cities, according to a Tuesday report from security firm Coronet.

Coronet examined data from more than 1 million endpoints to determine the vulnerability level of devices and infrastructure in each metro area to obtain an overall Threat Index score of 0 to 10. An acceptable risk level falls below 6.5, the report determined, and any higher score represents “unacceptable exposure.”

Small- and medium-sized businesses (SMBs) in these metro areas are at increasing risk of cyberattacks, as they tend to have fewer cybersecurity resources than large enterprises, according to the report. SMBs have unintentionally increased their level of risk in recent years thanks to the rise of the cloud, BYOD policies, and remote workers, which result in less control over the devices and networks employees use, the report found.

SEE: Security awareness and training policy (Tech Pro Research)

Here are the 10 least secure metro areas in the US.

1. Las Vegas, NV

Threat Index Score: 10.0

What happens in Vegas may stay in Vegas, except when it comes to cyberattacks, the report found. As one of the world’s top tourist and trade show destinations, Las Vegas exceeds the national average in every network and device vulnerability category. Public Wi-Fi in hotels, casinos, and restaurants, along with an underfunded statewide cybersecurity budget, add to the city’s security woes, according to the report. In Vegas, users face a 43% probability of connecting to either medium- or high-risk networks, impacting both the local population and the millions of tourists and conference attendees.

2. Memphis, TN

Threat Index Score: 9.8

Memphis is home to FedEx, which is consistently found at the top of the list of most spoofed brands used in phishing attacks, the report found. As a logistics hub, SMBs in Memphis may be especially prone to threats, as cyberattacks aimed at the supply chain have grown by more than 200% in recent years, according to the report.

3. Charlotte, NC

Threat Index Score: 9.8

Charlotte is the southern headquarters of many global financial institutions and energy conglomerates, the report noted, making it a prime target for cyber threats. The state of North Carolina recently announced a new cybersecurity unit to combat cybercrime in the area.

4. Houston, TX

Threat Index Score: 9.2

Houston is home to a number of oil, gas, and energy companies, many of which still use legacy networks and industrial control systems that were not built for today’s interconnectivity. Attacks against critical infrastructure could impact businesses citywide, the report found.

SEE: Intrusion detection policy (Tech Pro Research)

5. Providence, RI

Threat Index Score: 9.0

Rhode Island’s fastest growing industry is healthcare, which includes a vast attack surface with the rise of online medical data and patient records, the report found. The state named its first cybersecurity director in 2017, who is tasked with developing a statewide cyber strategy for both the public and private sector.

6. Birmingham, AL

Threat Index Score: 9.0

Birmingham is home to several large manufacturing companies that are increasingly reliant on automation, which may be susceptible to cyber threats. The state recently formed the Alabama

Office of Information Technology under the leadership of the state CISO to help reduce cyber risks in the private sector.

7. Jacksonville, FL

Threat Index Score: 8.9

Jacksonville is the nation’s largest city by land size, and home to many manufacturing, aerospace, and insurance jobs. These industries all rely heavily on legacy equipment, which makes them attractive targets for cybercriminals.

8. West Palm Beach, FL

Threat Index Score: 8.9

West Palm Beach is home to one of the most elderly populations of any major city, who are often targeted by financially-motivated cybercriminals. President Donald Trump’s Mar-A-Lago home has also been recognized as a growing cyber target, with the city estimating spending an additional $400,000 to defend against cyber threats when the president is in town, according to the report.

9. Orlando, FL

Threat Index Score: 8.5

Orlando is the second fastest-growing metro area in the US, and attracts workers from across the globe to work in its tourism and agriculture industries. With more than 60 million visitors last year, attackers are likely to trick tourists into joining compromised Wi-Fi networks at hotels, restaurants, and theme parks.

10. Tampa, FL

Threat Index Score: 8.3

Like West Palm Beach, Tampa includes an above average elderly population, making the city a large target for financial cybersecurity scams. The city’s primary industries of defense and financial services also make it a prime target.

Building a slide deck, pitch, or presentation? Here are the big takeaways:

  • Las Vegas, Memphis, and Charlotte top the list of least cybersecure US cities. — Coronet, 2018
  • In Las Vegas, users face a 43% probability of connecting to either medium- or high-risk networks. — Coronet, 2018