Cybersecurity · Small business
Why small firms get attacked, what the FBI and Verizon figures show, and the seven controls that stop most of it.
$20.9 billion reported to the FBI in 2025
Small firms pay and defend thinly
Seven controls stop most attacks
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time on the calendar below. Or call 954-539-5678.
Small businesses need cybersecurity for the same reason they need locks: most attacks are not aimed at anyone in particular. They are aimed at whoever is easy and will pay. A 15-person company with a shared admin password and no tested backup is easier than a bank, and it still has a payroll account, a client list and a mailbox that suppliers trust. That makes it a perfectly good target.
“We’re too small to be a target” is the belief attackers rely on. I don’t say that to frighten anyone. I say it because the businesses that get hurt worst are usually the ones that believed it, and so never turned on the handful of controls that stop most of what happens.
The FBI’s Internet Crime Complaint Center (IC3) received 1,008,597 complaints in 2025, the first year it passed one million, with reported losses of $20.877 billion, up 26 percent from 2024. Business email compromise alone accounted for about $3.05 billion in reported losses. That is the scam in which someone gets into, or imitates, a mailbox and redirects a payment. It needs no clever malware, only a believable email at the right moment, and small firms that pay suppliers by wire or ACH are squarely in its path.
Verizon’s 2026 Data Breach Investigations Report found that 48 percent of breaches now involve ransomware, and that 31 percent start with an attacker exploiting a software vulnerability, ahead of stolen passwords as the most common way in. Both point to the same unglamorous truth: unpatched systems and weak logins are how most incidents begin.
Keep in mind what these figures are. IC3 numbers are only what people reported, and plenty of small businesses never report anything. The real totals are higher. Be that as it may, nobody needs a precise number to see the pattern.
Attackers are, more or less, running a business. They want the most money for the least effort. A small company suits that model well. Money moves through it every week (supplier invoices, payroll, the odd wire), and the person moving it is usually also doing six other jobs, so a fake change of bank details sent to the bookkeeper often works. There is rarely anyone whose job is security, the MFA policy has exceptions, and the backups have never been restored.
There is also a less obvious reason. Small firms are connected to bigger ones. A small supplier’s mailbox is a trusted route into its customers’ accounts payable departments, which is why an attacker may care about you mainly because of who pays you.
None of this requires anyone to have heard of you. Automated tools scan the internet for unpatched devices and try leaked passwords against every Microsoft 365 and Google Workspace login they find. You are on the list because you have an email address.
Picture a 20-person property management company, as an illustration. The bookkeeper gets an email that appears to come from the landscaping contractor they have paid every month for years. It says the contractor has changed banks and attaches a letter with new account details. The email is real in the sense that it came from the contractor’s own mailbox, which someone took over a few weeks earlier with a stolen password. The bookkeeper updates the details, the next two payments go to the new account, and nobody notices until the contractor calls asking where the money is.
No malware touched the property management company’s computers. Its antivirus was fine. What would have stopped it was a dull rule: bank changes are confirmed by phone, to a number already on file. That is why my list starts with logins and payments rather than gadgets.
The good news is that a small set of controls covers most of the common attacks. This is the list I would start with at any 10- to 100-person company, in this order:
That is seven items, and none of them is exotic. CISA’s Cyber Essentials covers similar ground for small organizations. What it costs depends on your size and setup; our guide to cybersecurity costs for small business explains the drivers.
If you do one thing, find out which of those seven you actually have, as opposed to the ones you assume you have. In my experience, the gap between the two is where most of the risk sits. The MFA policy turns out to exclude the CEO, or the backup turns out to have failed quietly since spring.
That is exactly what our free Technology Health Assessment checks. It takes 30 minutes of data collection, and the next day you get a plain-language report that rates cybersecurity, backups and the rest of your IT as controlled, needs attention, significant exposure or unknown, with a short list of next steps in order. It is yours to keep, no obligation. Book your free assessment.
If business email compromise worries you most (and for many firms it should), start with our guide to preventing business email compromise. When you want the controls run for you, our cybersecurity service covers MFA, access reviews, endpoint protection, updates, encryption, email security, monitored backups with tested restores, and a written recovery plan.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Because most attacks are automated and opportunistic. Small firms pay invoices and payroll, often have thin defenses, and are connected to larger customers. Nobody needs to have heard of you.
Phishing and business email compromise are among the most common and costly. The FBI’s IC3 recorded about $3.05 billion in reported business email compromise losses in 2025.
Start with MFA everywhere, a call-back rule for payments, updates, endpoint protection, tested backups, prompt removal of leavers, and email security. Add more once those are working.
No. Endpoint protection is one of seven basic controls. On its own it does nothing about stolen passwords, fake invoices or untested backups.
