Cyber criminals have done the arithmetic that many small firms have not: a business with twenty staff and no dedicated IT department is a softer target than a bank, and automated attacks cost the criminal almost nothing to aim at thousands of such firms at once. Ransomware, invoice fraud and account takeovers now reach companies that once assumed they were too small to notice. Insurers and police units report the same pattern — modest ransoms, devastating disruption, and victims chosen by software rather than by name.
Why Attackers Target the Smallest
The entry routes are drearily familiar. Phishing emails still lead, followed by reused or stolen passwords, unpatched software and remote-access tools left exposed to the internet. Most incidents investigated by response firms involve at least two of these basics failing together. That is also the good news: because the routes are familiar, the defences are known, comparatively cheap and well within the reach of a business with no security staff at all.
The controls that stop the majority of attacks fit on one page. Multi-factor authentication on email and remote access blocks most account takeovers outright. Prompt patching closes the holes automated scanners hunt for. Backups that are separate from the main network — and actually tested by restoring them — turn ransomware from an existential threat into a bad week. A password manager ends the reuse that lets one leaked login unlock everything else. Further background is available in our tech coverage for readers following this story.
The Controls That Stop Most Attacks
Human habits complete the picture. Invoice fraud, in which a convincing email diverts a genuine payment to a criminal’s account, is defeated by a single rule: verify bank-detail changes by phone, on a known number, every time. Staff who are thanked rather than blamed for reporting suspicious messages report them faster, which is why response experts rate culture alongside software. A one-page incident plan — who to call, what to disconnect, how to contact customers — written before it is needed is worth a shelf of theory.
Support exists for firms willing to look. Government-backed certification schemes for small businesses codify the basics into a checklist, and several insurers now discount premiums for certified firms while refusing cover to those without multi-factor authentication. Local IT providers increasingly sell the whole bundle as a managed service at a price point aimed at companies that will never employ a security specialist. Additional reporting from BBC Technology provides further detail on the background.
Building a Culture of Caution
None of this promises immunity, and honest advisers say so. It promises something more useful: that the cheap, automated attacks sweeping the internet will mostly bounce off, and that a determined attack will meet a business able to recover rather than fold. In cyber security, that is what winning realistically looks like for a small firm — not impregnable, just not easy, and ready for a bad day. Analysts caution that the full picture may take months to emerge, even as the early evidence already points in a consistent direction.
