It's one of the most common reasons a small business puts cyber security off: the sense that attackers go after big, recognisable names, not a 12-person firm nobody outside the local area has heard of. It's an understandable assumption. It's also backwards.
Most attacks aren't aimed at anyone specific
The image of a hacker deliberately targeting your business is misleading. Most attacks are automated, scanning huge numbers of businesses for the same handful of weaknesses - an outdated system, a weak password, an unpatched piece of software, a convincing-looking email sent to thousands of addresses at once. Size doesn't make you invisible to a scan. If anything, smaller businesses are more likely to have the weaknesses those scans are looking for.
Small businesses are often the easier target, not the harder one
Larger companies tend to have dedicated security teams, bigger budgets, and layers of protection built up over years. A smaller business usually has none of that, not through carelessness, but because nobody's job is specifically to think about it. That gap is exactly what makes smaller businesses attractive rather than safe - less resistance, for a similar payoff once ransomware or fraud is involved.
What's actually being targeted
It's rarely about the size of the business - it's about what the business holds. Customer data, financial records, access to supplier or client systems, even just a working email account that can be used to impersonate you and defraud someone else. A small accountancy practice or a two-person consultancy can hold exactly the kind of data an attacker wants, regardless of headcount.
The cost lands the same way regardless of size
A larger business can usually absorb a bad week. A smaller one often can't - a ransomware incident, a fraud loss, or even just the time spent recovering can be genuinely threatening to a business that doesn't have the same reserves. The stakes aren't smaller just because the business is.
What this actually changes
Not that every small business needs enterprise-grade security - that would be its own kind of waste. It changes the starting assumption. "We're too small to bother with" becomes "we're exactly the kind of target these scans are designed to catch," which is a much more useful place to start when deciding what's actually worth doing - sensible baseline protection, aligned with a recognised standard like Cyber Essentials, rather than nothing at all.
If you're not sure where your business actually stands, book a complimentary IT call and we'll give you an honest read on it.
