Security marketing skews toward sophisticated adversaries because that is what sells enterprise tooling. The realistic picture for a business under a hundred people is considerably more mundane, and the mundanity is useful — it means the defences are achievable.

What actually happens

  • Business email compromise, producing the largest single losses through diverted payments.
  • Ransomware arriving through stolen credentials or an exposed service.
  • Credential stuffing against accounts with reused passwords.
  • Invoice and payment fraud, sometimes without any system compromise at all.
  • Website compromise through an unpatched plugin or component.

How you are selected

Mostly you are not. Internet-facing systems are scanned continuously and indiscriminately; phishing is sent in volume; credential lists are replayed automatically. You appear because something was exposed, not because anyone researched you. The exception is business email compromise, where an attacker inside a mailbox does study your specific relationships before acting.

Why small organisations are attractive

Thinner defences, no dedicated security staff, frequently meaningful payment flows, and often a relationship with larger organisations that makes you a route to them. "Too small to target" describes a selection process that does not exist — automation does not check your headcount.

The controls that address most of it

  • Phishing-resistant MFA on email, identity, and remote access.
  • A verification rule for payment detail changes, enforced without exception.
  • Offline or immutable backups with a tested restore.
  • No management interfaces exposed to the internet, and prompt patching of what is.
  • A password manager with unique credentials, and prompt offboarding.

The honest summary

You are unlikely to face an adversary who has selected you specifically and will adapt to your defences. You are very likely to face automated attacks and opportunistic operators who move to easier targets when the basics are in place. That is a genuinely winnable position, and it is why the roadmap matters more than the tooling.