One of the most common things I hear when talking to small business owners is:
“We’re too small to be a target.”
I understand why people think that.
When the news reports a cyber attack, it is usually a household name, a major retailer, a government department or a large multinational company.
It creates the impression that hackers are carefully choosing their victims.
Most of the time, they are not. The reality is much less personal.
The hackers don’t always know whether you are a one-person plumbing business, a ten-person accountancy firm, a care provider or a multinational organisation.
They discover that after they have gained access.
The burglar doesn’t check the company size first
Imagine a burglar walking down a street at night.
They are not checking Companies House records before trying door handles.
They are looking for easy opportunities.
Cyber criminals work in a similar way.
Many attacks are automated. Criminal groups scan the internet looking for vulnerable systems, exposed services, weak passwords and unpatched software.
The process is often completely indiscriminate.
A vulnerable device is a vulnerable device.
The criminal does not initially care whether it belongs to a sole trader or a global corporation.
Ransomware has become a business
One reason small businesses are increasingly being targeted is that ransomware has become highly organised.
Years ago, launching a ransomware attack required significant technical expertise.
Today, criminal groups operate much like legitimate businesses.
They provide ransomware-as-a-service.
In simple terms, one group develops the ransomware while others carry out the attacks.
Some specialise in phishing.
Some specialise in negotiating payments.
Some specialise in laundering the proceeds.
Like any business, they are focused on efficiency and scale.
That means they need lots of victims. Not just large ones.
The rise of initial access brokers
Another growing trend is the emergence of Initial Access Brokers.
An Initial Access Broker does exactly what the name suggests.
They specialise in breaking into organisations and then selling that access to other criminals.
Think of them as the estate agents of cyber crime.
They do not necessarily carry out the ransomware attack themselves.
They simply find a way in and then sell the keys to somebody else.
A vulnerable remote access system.
A compromised Microsoft 365 account.
A server with an old vulnerability.
All of these have value.
The buyer may not even know who the victim is until after the purchase.
Small businesses are attractive targets
Many small businesses assume criminals only want large payouts.
That is not always true.
Smaller organisations often have:
Limited IT resources
Less security monitoring
Fewer security controls
Older technology
Less formal recovery planning
From a criminal’s perspective, that can make them easier to compromise.
The reality is that many small businesses hold information that criminals value:
Customer details
Financial information
Supplier records
Payment data
Email accounts
Microsoft 365 access
Even if none of that can be sold, disrupting a business often creates pressure to pay.
Automation has changed the game
One of the biggest misconceptions about cyber attacks is that somebody is manually selecting targets.
In reality, much of the process is automated.
Criminals use tools that continuously search the internet for:
Unpatched software
Exposed remote access services
Weak passwords
Vulnerable firewalls
Misconfigured cloud systems
The software does not know whether it has found a small electrical contractor or a national retailer.
It simply reports a potential opportunity.
That is why so many organisations are affected by the same vulnerability at the same time.
What about trades businesses?
Let’s use a typical example.
Dave runs a building company with six employees.
He stores quotes, invoices, contracts and customer details in Microsoft 365.
His staff use mobile phones and laptops on site.
He uses cloud accounting software and online banking.
He might think: “We don’t have anything worth stealing.”
The criminals disagree.
Access to Dave’s email could be used to:
Send fake invoices
Intercept supplier communications
Steal customer information
Launch attacks against other businesses
Disrupt projects
A week’s downtime could be expensive. A month’s downtime could be devastating.
The better question
Instead of asking: “Why would anyone target us?”
Ask: “How easy would it be for someone to get in?”
That is a far more useful question.
Most cyber criminals are not hunting specific organisations.
They are hunting opportunities.
What actually helps?
The good news is that many common attacks can be made significantly harder with practical controls:
Multi-factor authentication
Supported software
Regular patching
Security awareness training
Endpoint protection
Tested backups
Cyber Essentials certification
None of these are particularly glamorous. They are effective because they reduce the number of easy opportunities available to attackers.
Small businesses are not too small to be targets
The uncomfortable truth is that cyber criminals do not usually know your organisation is small until after they have gained access.
By that point, it is often too late.
The good news is that you do not need an enterprise-sized budget to improve your cyber security.
You simply need sensible, proportionate controls that match the way your organisation works.
Cyber security is not about being impossible to attack.
It is about being a harder target than the business down the road – and that starts with accepting that size alone is not a defence.
