There is a dangerous belief that still exists in business.
“We’re too small. Why would a hacker bother with us?”
It might have been a reasonable assumption years ago, but it isn’t anymore.
In fact, I would argue that thinking your business is too small to be attacked is now one of the biggest cyber security risks you can have.
Because attackers don’t necessarily need to know who you are. They don’t need to know your turnover. They don’t need to know how many employees you have. They don’t need to have a personal interest in your business.
They just need to find a gap.
And increasingly, machines are doing the searching for them. The old way of attacking businesses has evolved.
Historically, a criminal might choose a target. They might research the company. Find the people. Work out who the finance director is. Send a convincing phishing email. They spent a lot of their time getting access.
That still happens, but there is another model emerging.
Automated systems can scan enormous numbers of businesses, websites, applications, devices and online services looking for weaknesses.
The attacker doesn’t necessarily care whether you’re a multinational corporation or a 10-person engineering company. If your business presents an opportunity, you’re a target.
AI makes this problem more significant because it can help attackers automate and accelerate parts of the process that previously required significant human effort and that changes the economics of cyber crime.
The question is no longer: “Why would somebody attack my business?”
The better question is: “When someone is automatically looking for businesses with weaknesses, what will they find when they scan mine?”
Security by obscurity is dead
For years, some businesses have relied on being small, unknown or uninteresting as a form of protection. This is not a security strategy, it’s hope.
You cannot assume that because nobody has heard of your company, nobody will discover it.
- Your website is public.
- Your email infrastructure is public.
- Your internet-facing systems are discoverable.
- Your employees are online.
- Your technology leaves a footprint.
- Your suppliers may have access to your systems.
- Your credentials may already exist somewhere they shouldn’t.
You are visible.
The question is whether you know what that visibility looks like from the outside.
Here is an important distinction.
Your business doesn’t necessarily have to be targeted to be attacked, you can simply be found.
Imagine thousands of automated systems continuously looking across the internet.
They’re not sitting there thinking; “Let’s attack that particular company.” They’re looking for weaknesses.
- An exposed service.
- A vulnerable application.
- A compromised credential.
- A poorly protected account.
- An unpatched machine.
- A misconfigured cloud environment.
- A supplier with excessive access.
Once they find something that works, the business suddenly matters.
Not because it was selected, because it was vulnerable.
So what should businesses do?
Firstly, do not panic. There is so much noise around the AI threat, calm down, breathe and think.
You should not just jump and buy another security product because someone told you it will solve the problem.
Build resilience.
That means understanding where you are exposed and putting layers of protection around the business. Building cyber resilience means:
- Creating visibility across your business.
- Knowing who has access.
- Protecting identities.
- Monitoring Microsoft 365 and email.
- Protecting endpoints and machines.
- Understanding what is happening to your data.
- Knowing what your business exposes to the internet.
- Critically it means having someone watching for signs that something isn’t right.
While prevention matters, assuming you will prevent every attack is unrealistic.
Resilience is what happens when prevention fails.
- Can you detect the attacker?
- Can you investigate what happened?
- Can you contain them?
- Can you recover?
- Can you keep the business operating?
That is the difference between simply having security controls and actually being resilient.
The attacker doesn’t care how big you are
This is the part I want business owners to think about.
Your size is not your security strategy.
Your lack of fame is not your security strategy.
Being an “uninteresting” business is not your security strategy.
Security by obscurity is dead. The world has changed.
Attackers have more automation, more intelligence and more scale available to them than ever before.
So we need to change the question.
Stop asking; “Why would anyone attack us?”
Start asking; “What would happen if someone did?”
You may not be important enough for a criminal to target personally.
But you may be important enough for a machine to find you.
And if that machine finds a weakness, the attacker will be only one step behind.
You don’t need to be a big business to be a target. You just need to be a business.
Build resilience. Before someone finds out you haven’t.
