Why small businesses are a target

Module 1: Why you're a target · Reading time: 9 minutes

Learning objective: After this lesson, you can explain how attackers operate (automated, profit-driven, opportunistic) and why "we're too small" doesn't hold up.
Key concepts: threat, vulnerability, risk, opportunistic attack, targeted attack, cybercrime as a service, attack surface

"What would they want with us?"

You hear that question from almost every small business. A bakery, a three-person admin office, a football club: surely there are bigger fish to fry? The idea behind it is that an attacker first picks a target and then works out how to get in. For a small share of attacks, that's true. For the vast majority, it works the other way round: the attacker looks for a weak spot first, and it makes little difference to them whose it is.

To understand this properly, you need three concepts that come back throughout this course.

• A threat is something that can cause harm: a scammer sending fake invoices, a piece of ransomware, a colleague who accidentally shares the wrong file.
• A vulnerability is a weak spot that lets the threat succeed: a password you also use on a webshop, a plugin that hasn't been updated in a year, a payment process with no checks.
• A risk is the combination: how likely is it that a threat exploits a vulnerability, and how bad would it be? This is often written as risk = likelihood x impact.

A business with no vulnerabilities doesn't exist. So the goal of security isn't "zero risk", but shrinking the biggest risks until you can live with them.

Opportunistic or targeted

There are broadly two types of attacks.

In a targeted attack, the attacker picks a single organisation. They find out who works there, who pays the invoices, which suppliers are involved, and tailor the attack accordingly. That takes time, so it has to pay off. Think of a scammer who knows your business is settling a large invoice for machinery this month, and sends a "changed account number" from the supplier at exactly that moment.

In an opportunistic attack, it works the other way round. The attacker targets a weak spot that exists at thousands of organisations at once, and takes whatever they find. There's no personal choice involved for your business. You're simply one of the addresses on the list.

Small businesses are mostly hit by the second type. That's not bad luck, it's maths: if an attack costs nothing to repeat, it pays to launch it against everyone.

How automation makes attacks cheap

An attacker doesn't sit typing IP addresses by hand. They use programs that scour the internet day and night. A scanner like this asks address after address: what service is running here, which version, is there a login page open? Within a few hours, a large part of the internet has been scanned.

Say a vulnerability becomes known in a widely used webshop plugin. The next day, a scanner searches for every site with that plugin. It finds the webshop of a law firm that never looks at its site any more, a club's website, and www.example.com belonging to Bakkerij Example. The scanner doesn't know what a bakery is, and it doesn't care. It only sees: old version, so it's a hit.

The same happens with logging in. Lists of millions of leaked email and password combinations are tried automatically against mail, accounting and social media accounts (lesson 1.4). And phishing emails go out in huge batches; if even a small share of recipients clicks, the campaign is already profitable.

On top of that, you no longer need to be a hacker yourself to attack someone. A whole market has sprung up for cybercrime as a service: one person develops the ransomware and rents it out, another sells stolen login details, a third sells access to company networks that are already wide open. Microsoft describes on its security blog how stolen data is bundled, resold and ultimately offered as ready-made access to businesses. That lowers the bar to getting involved, which means more attackers.

Where the money goes

Almost all attacks on small businesses are about money. That money comes in through a few routes:

1. Direct payment. You or a colleague transfers money to the wrong account: a fake invoice, an urgent request "from the director" (lesson 1.2).
2. Ransom. Your files are encrypted and you have to pay to get them back, or to stop stolen data being published (lesson 1.3).
3. Resale. Login details, customer data or access to your systems are sold to whoever wants them (lesson 1.4).
4. Using your systems. Your mailbox sends spam, your website spreads malware, your server mines cryptocurrency. You pay the bill in the form of a damaged reputation or a blocked email address.
5. Through you, to someone else. You're a supplier to a larger business. An attacker who takes over your mailbox can send fake invoices to your customers in your name.

Small businesses are attractive for two reasons here. They do have money in the account and do pay invoices, but they often have no IT department, no four-eyes principle for payments, and no well-maintained backup. That increases the chance of success.

Your attack surface

Everything an attacker could try from the outside is called your attack surface. For a small business, that's bigger than you think:

• your website, including the CMS, plugins and the admin page;
• your email: the mailboxes, but also your domain, which a scammer can impersonate if your SPF, DKIM and DMARC aren't set up properly (module 4);
• all online accounts: bank, accounting, webshop platform, social media, your domain's registrar;
• devices: laptops, phones, the router, the network drive, the printer;
• people: anyone who reads mail, pays invoices or answers the phone;
• your suppliers: the web developer with an admin account, the IT company with remote access (module 7).

Every part you no longer use but that's still online is extra surface with no benefit. An old test site at test.example.com, a forgotten FTP account from a previous web developer, an account with a service you cancelled three years ago: nobody keeps an eye on these any more, so that's where the vulnerabilities sit.

Pitfalls in how we think about this

"We have nothing of value."

You have a bank account, a mailbox customers trust, and customer data, at the very least. That's enough.

"We have antivirus, so we're safe."

Antivirus helps against some malicious software. It does nothing against a colleague paying a genuine-looking invoice with a different account number, or a password leaked from another site.

"Our IT company handles that."

Maybe. But do you know what they actually handle? An IT company often takes care of updates and a virus scanner, but not your payment procedure, your password policy, or your web developer's access. Who does what needs to be agreed (module 7).

"It won't happen to us, it never has."

Often you simply don't know. A hijacked mailbox can be read unnoticed for months before anyone abuses it.

In practice: what it looks like

An example, pieced together from situations that occur often. A small accountancy firm (four people) had a website on a CMS built by a previous web developer. Nobody logged in to it any more, so nobody saw the update notifications. One Monday morning, a notification from the hosting provider appeared in the mailbox: phishing pages were being distributed from the site. The logs showed that a scanner had found a known vulnerability in an old form plugin, on the same day as hundreds of other sites. The firm was never "chosen". Recovery took a week, and the domain name ended up on a blocklist for a while, which meant the firm's email landed in customers' spam folders.

A single update would have prevented the breach. That's what the rest of this course is about: not perfect security, but the basics that stop cheap, mass attacks.

Summary

• A risk is the combination of a threat and a vulnerability: likelihood x impact.
• Most attacks on small businesses are opportunistic: the weak spot comes first, the victim second.
• Automation and cybercrime as a service make attacks cheap, so it pays to launch them against everyone.
• Almost everything is about money: fake payments, ransom, reselling data, or abusing your systems.
• Your attack surface consists of your website, mail and domain, accounts, devices, people and suppliers; forgotten parts are the most dangerous.

Quiz

Exercise

Exercise A1.1: Threat, vulnerability and risk. You'll get four short situations from small businesses. For each one, state what the threat is and what the vulnerability is, and estimate likelihood and impact (low, medium, high). Then rank the four from highest to lowest risk. The programme checks your answers and explains the reasoning for each situation.

Exercise D1.1: Mapping your attack surface. Make a list of everything your business has online: websites and subdomains, accounts, devices with an outward connection, and who has access from the outside. For each item, note whether you still use it and who owns it.

Further reading

The steps in the WebOké articles apply to the WebOké environment; with other providers, it works in a similar way.

• Help! My site has been hacked. How can I fix or prevent this?
• NCSC, Cyberveilig Check for sole traders and SMEs: https://tools.ncsc.nl/cyberveilig-check/
• Microsoft Security Blog, StealC and Amadey: Breaking down infostealers and the cybercrime services that deliver them: https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/