How Cyberattacks Shifted Toward Smaller Businesses

How the Threat Structure Changed

The shift occurred across three fronts, each making attacks cheaper.

Targets got smaller

As penetrating large organisations became harder, attackers moved toward the supply chain. Compromising a small supplier became the route to its larger customer.

Attacks got cheaper

Ready-made tools and automation lowered the technical requirement. What once demanded expertise now follows a template.

People became the target

As software vulnerabilities became easier to close, attackers turned toward people. The most common attacks are persuasion-based rather than technical.

Loss became directly financial

Data used to be stolen; now money is transferred. That makes the damage immediate and generally unrecoverable.

Where the Loss Occurs

Listing attack types matters less than knowing where the money is actually lost — that determines where defences belong.

At the moment of payment

Most of the loss happens in a single moment: a transfer to the wrong account. After that instant no technical measure helps; the defence is the verification step before payment.

During the period access stays open

A compromised account is typically used undetected for weeks. Damage accrues across that period rather than in one event.

In operational downtime

Every day systems are down is lost revenue. In a ransomware scenario the real cost is not the sum demanded but the days halted.

In the customer relationship

A fraudulent email sent to your customer in your name permanently changes how they work with you. That invoice appears nowhere.

Why It Goes Unnoticed

Most attacks remain undetected for months. The reasons are consistent.

No symptoms

A compromised email account keeps functioning normally. Detection usually requires damage to occur first.

Nobody is responsible

In smaller firms it is often unclear who owns security. An unowned area is an uncontrolled one.

No records are kept

If nobody logs who accessed which system, the source cannot be traced when something goes wrong.

Assuming you are too small

“We have nothing worth stealing” is common and mistaken. What is being targeted is not data but payment authority.

What Needs to Change

If the threat structure changed, the defence must too. None of these four requires technical investment.

Build the defence at the payment moment

Technical measures make attacks harder but do not stop them. The only point where loss is actually prevented is the verification step as money leaves.

Simplify access

A structure where everyone reaches everything fails on one weak password. Role-based permissions are among the most effective measures available at no cost.

Shorten detection time

Damage accumulates while an attack goes unnoticed. Login notifications and regular access reviews reduce that period from weeks to hours.

Test the backup

A backup taken but never restored is not a backup. In a ransomware scenario it is the only genuine defence.

What Was Learned

Three lessons hold even as attack methods change.

Security is not about size

Attackers look for exposure rather than scale. Being small provides no protection; it makes you a target.

People are the weakest link

As technical defences improved, attacks moved toward people. The highest-return investment is therefore awareness and written process.

Prevention is cheap, incidents are not

Most of the measures listed are free and amount to process changes. A single incident can erase a month’s profit.

Trust is an asset too

A firm whose customers receive fraudulent emails in its name loses reputation alongside money. That takes far longer to rebuild.

A Solid Digital Foundation

As the threat has shifted, so has the location of the defence: the question is no longer which software to buy but who has access to what, and how money leaves.

Domain, email and site are connected

A misconfiguration in one affects the others. These three should be established and managed together.

The second, invisible invoice

The cost of an incident does not end with stolen money. A site with malicious content injected can be flagged in search results, and years of accumulated visibility lost within days. How these risks are assessed is described in the Search Central documentation.

Collected data carries an obligation

Where names and phone numbers are collected through forms, protecting that data is a legal responsibility carrying regulatory consequences.

The first hours decide the outcome

The scale of a loss is determined by response speed rather than detection: which account is closed, who is called, which payment is stopped. Written in advance, the damage is contained within hours. Corporate email security is the technical side of that plan; growing through a downturn treats it as a continuity item.

Frequently Asked Questions