Why "too small to be a target" is a myth

It's the most common thing I hear from small business owners: "Why would anyone bother with us? We're tiny."

It's a completely reasonable thing to think. It's also the single most expensive assumption in small business security, because it misunderstands how attacks actually happen.

Attacks are automated, not personal

Picture a burglar who doesn't choose houses. Instead, they walk down every street on the internet at once, trying every door handle, and step through the ones that happen to be unlocked. They don't know or care who you are. They know your door was open.

That's what most attacks are: automated tools scanning millions of businesses for known weaknesses. Nobody sat in a dark room and picked you. A script found a gap. Being small didn't make you invisible to the script — it just meant you probably had fewer people watching the door.

What "convenient" looks like

The businesses that get hit rarely have exotic problems. They have ordinary, unlocked doors:

• A password reused across email, banking, and a dozen logins
• No second factor (that code from an app) on the accounts that matter
• A backup that exists but has never actually been tested
• An old employee's account that still works months after they left
• Software that hasn't been updated because nobody owns doing it

None of these are sophisticated. That's exactly why they get exploited — they're everywhere, and they're easy.

The good news: the fixes are boring and cheap

Here's the part that should be reassuring. Because attackers go after the easy targets, you don't have to be unbreakable. You just have to stop being the unlocked door on the street.

Most of what protects a small business isn't expensive software. It's a handful of boring habits, done consistently.

Turn on multi-factor authentication. Use a password manager. Test a backup. Keep a short list of who has access to what. That unglamorous list closes the doors that automated attacks actually walk through — and it costs far less than most owners fear.

If you'd like a clear picture of which doors are open in your business, a security and planning program lays it out plainly, or the free readiness check gives you a rough sense in about thirty seconds. Either way, "we're too small to matter" is the one belief worth retiring today.