“Why would anyone bother with us? We’re a twenty-person company.”
It is the most common thing we hear, and it rests on a reasonable assumption: that an attack requires a person to choose you, study you, and decide you are worth the effort. That assumption was fair once. It is not how most attacks work now.
Nobody chose you
The bulk of what reaches your business is automated. Software scans enormous ranges of internet addresses looking for a specific weakness — a firewall missing a patch, a remote access service left open, a login page that accepts unlimited attempts. It does not know what industry you are in or how big you are. It knows you have the flaw it was written to find.
The same is true of most phishing. Millions of near-identical messages go out, and the sender is indifferent to who replies. The scale is what makes it profitable.
So the question is not whether you are interesting enough to attack. It is whether you have the weakness the scan is looking for.
Small businesses are, in practice, the better target
When attackers do choose deliberately, smaller businesses often look more attractive than large ones:
- There is rarely a dedicated security team, and often nobody whose job it is to watch alerts
- Money moves with fewer approvals, which makes invoice fraud simpler
- Smaller businesses tend to pay ransoms, because the alternative is closing
- You may be the way into someone larger — suppliers get compromised as a route to their clients
That last one matters more each year. If you serve larger organizations, your security is part of their risk, which is why their questionnaires keep arriving.
What indiscriminate attacks mean for your defenses
There is good news buried in this. Automated, indiscriminate attacks are stopped by unglamorous fundamentals, because they are not tailored to you:
Patch quickly. Mass scanning targets known vulnerabilities. The window between a fix being published and being exploited is short, and businesses that patch within it are simply skipped.
Turn on multi-factor authentication everywhere. Stolen passwords are traded in bulk. MFA makes a working password insufficient, which removes most of the value of the theft.
Close what does not need to be open. Remote desktop exposed to the internet remains one of the most reliable ways in. Every service reachable from outside should be there deliberately.
Train people on the patterns, not the specifics. Staff do not need to recognize a named campaign. They need to recognize urgency, unexpected payment changes, and requests that bypass normal process. Our awareness training is built around exactly those reflexes.
Make sure someone is watching. Alerts nobody reads are the same as no alerts. This is most of what managed support quietly does.
Being small is not a strategy
The businesses that come through this well are not the ones that stayed uninteresting. They are the ones that did five ordinary things consistently. If you are not sure which of them are true at your business today, that is a short conversation — let’s have it.