Are We Too Small to Be a Cybersecurity Target?

Why "we're too small" doesn't hold up

The idea makes sense if you picture a hacker choosing a target. That's usually not how it works. Much of the activity is automated:

• Phishing goes to any address that can be found or guessed.
• Stolen passwords from other breaches are tried against business email accounts.
• Internet-facing devices, such as firewalls, remote access tools and old servers, are scanned for known weaknesses.

Size doesn't matter to those tools. What matters is whether the door is unlocked.

What a small firm actually has that attackers want

• Email accounts that can be used to send fake invoices or payment instructions to your clients and vendors.
• Client data such as tax records, Social Security numbers, legal files or account details.
• Money movement, including payroll, vendor payments and wire transfers.
• Trust. Your clients' trust in your email address is valuable to a criminal.

For CPA, law and financial firms, the data alone can bring legal and contractual obligations if it's exposed.

Are you too small to survive an attack?

A better question than "are we big enough to be a target?" is "could we survive an attack?" Criminals don't check the size of a business before they go after it. Small businesses are often easier to hit, because many don't have the security and procedures in place to protect what they've built. A large company can absorb a breach with a security team, insurance and cash reserves. For many small businesses, a serious attack means days of lost work, money out the door and damaged client trust, and some never recover. News coverage focuses on big companies, which is why this side of the story rarely reaches small business owners.

The honest part: you don't need everything

Small businesses get pitched a lot of security products. Not all of them are necessary, and buying more tools doesn't fix weak basics (we've written about why more tools won't fix weak security). A proportionate starting point:

1. Multi-factor authentication on email, remote access and admin accounts.
2. Updates applied promptly to computers, firewalls and key applications.
3. Backups you've tested by actually restoring something, kept separate from the systems they protect.
4. Endpoint protection that someone actually monitors.
5. Email authentication for your domain (SPF, DKIM and DMARC).
6. A simple plan for who to call and what to do if something looks wrong.

Beyond that, what you add should depend on your data, your clients' requirements, your insurance and any regulations that apply to you.

When small firms are at greater risk

Some situations raise the stakes even for a very small office: you move money for clients, you store tax or medical records, a client or insurer requires specific controls, or one person handles all the IT informally. If any of those apply, it's worth getting a clear picture of your current setup. A cybersecurity risk assessment is one way to do that.

FAQ

We've never had an incident. Doesn't that mean we're fine?

It may mean you've been fortunate, or that something happened and nobody noticed. Check whether you'd actually know, for example whether anyone reviews sign-in alerts or forwarding rules in your email.

Is antivirus enough for a small office?

It's one layer. See how to keep viruses away from your business for the rest.

What's the single most important step?

For most small offices, MFA on email is near the top. See password manager or MFA? why you need both.

Related Blue Tree Technology® pages

• What Security Does a Small Business Need—and Is IT Support Enough?
• Cybersecurity services
• Vulnerability scanner & security assessment

Still have a question?

Ask Little Sprout for general information. To talk through what's proportionate for your firm, schedule a free 15-minute discovery call.