Why small businesses get targeted
Criminals are not hunting a logo. They are hunting a mailbox that can pay a bill and a company that has not turned on the boring controls.
Small companies sometimes assume they are too small to bother with. The people sending the email do not see it that way. They see a mailbox, a login page, and a chance that multi-factor authentication is still “on the list.”
A small business is a good target when a few things are true at once. One person can approve a payment. The same person uses that password in more than one place. The backup has never been restored. And there is no written “call us before you click.” None of that requires a famous name.
The attacks are repetitive on purpose. Password reuse. A fake Microsoft login. A fake shipping notice. A fake payroll change. An attachment named like an invoice. The repetition is the business model. It only has to work sometimes.
That is also why the defense is repetitive, and why that is good news. You do not need a movie-style security program. You need:
- Multi-factor authentication on email and on anything that pays a bill
- Separate admin accounts
- Updates that actually get installed
- A backup of the server and of Microsoft 365, with a test restore
- A person the staff can call when a message feels off
Those are the same items on our cybersecurity checklist and the same work described on the cybersecurity service page.
If you have been told you need a dozen tools before you are “serious,” ignore the pile and do the list. Tools help after the basics exist. They do not replace them. If you want a local team to put the basics in and keep them there, that is the managed plan, and it starts with an assessment.