The ransomware gang’s ideal victim has changed. It is no longer only the hospital or the pipeline operator; it is the forty-person accountancy firm, the regional dentist chain, the components supplier with one overworked IT generalist. Incident responders report that small and mid-sized businesses now absorb the majority of attacks, precisely because their defences lag their connectivity.
The economics favour attackers. Automated scanning finds exposed remote-access services within hours, initial-access brokers sell footholds cheaply, and ransomware-as-a-service platforms let low-skill criminals run polished extortion campaigns. A five-figure ransom that a small firm might actually pay is worth more than a headline demand that triggers a national response.
The unglamorous fixes that work
Security agencies repeat the same short list because it works: multi-factor authentication on every remote login, prompt patching of edge devices, offline or immutable backups that are actually restore-tested, and email filtering with attachment sandboxing. The guidance collected by CISA and its international partners reads like a maintenance schedule, not a moonshot, and our security coverage keeps returning to how rarely it is fully applied.
Insurance is reshaping behaviour too. Cyber insurers now demand evidence of those basics before issuing policies, effectively becoming private regulators of small-business security hygiene.
When it happens anyway
Preparation decides outcomes. Firms with an incident plan, a retained responder and tested backups measure recovery in days; firms improvising measure it in months, and some never reopen. Paying the ransom remains discouraged by authorities and guarantees nothing.
The supply-chain back door
Attackers increasingly arrive through the front office’s trusted suppliers. The managed service provider that looks after a firm’s IT, the accountancy software update, the remote-support tool — compromise one provider and dozens of small clients come with it. Vendor risk, once an enterprise obsession, now belongs on the small-business checklist too: ask who can access your systems, insist their access is authenticated and logged, and treat any provider who resents the question as an answer in itself.
Governments are edging toward the problem with baseline schemes — certification programmes that give small firms a recognisable security floor and give their customers and insurers something to require. The direction across jurisdictions is consistent: basic hygiene is becoming a condition of doing business, not a private virtue.
A note for the one-person IT department. If the entire checklist feels like a second job, prioritise ruthlessly: backups you have test-restored, multi-factor authentication on email and remote access, and automatic updates switched on everywhere. Those three, done properly, defeat the majority of small-business intrusions the responders describe. Security for a small firm is not a department; it is a short list of habits, maintained — and the firms that treat it that way are quietly ceasing to be the soft targets this article describes.
The encouraging shift is that protection has become a checklist rather than a research project. For the cost of a single incident’s first day, most small businesses can close the doors attackers actually walk through — and increasingly, that is exactly what they are doing.
