Do small companies need to plan for APTs? A decision guide

Most small companies do not need a dedicated APT program, but nearly all of them need the basic controls that APT advisories keep recommending. Public CISA reporting shows these actors reach victims through edge devices, valid accounts and trusted software, so the same hygiene that stops commodity attacks also raises the cost for them.

Three questions that decide your exposure

Skip the abstract debate and answer these.

Do you hold something a patient adversary wants? NIST SP 800-172 Rev. 3 exists for a narrow case: controlled unclassified information in nonfederal systems tied to a critical program or high value asset, where a federal agency chooses to apply enhanced requirements. If that is not you, you are not in its scope.

Are you a route to someone else? The CISA alert on the SolarWinds Orion compromise described victims across government, critical infrastructure and private sector organisations. A software or service vendor can matter to an attacker because of its customers, not because of its own data. If you ship code, run a managed service, or hold admin access into customer systems, you are a route.

Would you notice? CISA's Volt Typhoon advisory says that actor mostly uses built-in system tools, which makes activity look like normal administration. If your logs are short or scattered, a quiet intruder has room.

What to do at each answer

If all three answers are no, keep to baseline hygiene and review once a year.

If you are a route, add supply chain controls: pin and review dependencies, protect build and signing systems, and keep an inventory you can query quickly. MITRE's Supply Chain Compromise technique page lists vetting third-party libraries and locking dependencies to specific versions among its mitigations.

If you hold sensitive government related data, read your contract. Requirements come from the agreement, not from this article.

The baseline that carries over

The CISA advisory on Volt Typhoon recommends several controls that fit any company:

• Patch internet-facing systems quickly, especially appliances such as VPNs and firewalls.
• Use phishing-resistant MFA.
• Limit privileged accounts and separate user from admin accounts.
• Keep logs on and store them centrally.
• Plan for end of life of technology beyond the vendor's supported period.

None of these needs an APT budget. They need an owner and a calendar.

What to skip

Do not buy a product because a report mentions a scary group. Do not build a bespoke hunting team before you can answer basic questions such as which accounts have domain admin rights and which devices face the internet.

You can start the inventory side with a free scan at https://gold.safeguard.sh/scan, which covers your code dependencies. It does not replace identity or network reviews.

Quick check

Sources

• NIST SP 800-172 Rev. 3
• CISA AA24-038A, PRC state-sponsored actors compromise critical infrastructure
• CISA AA20-352A, advanced persistent threat compromise
• MITRE ATT&CK T1195, Supply Chain Compromise

Last reviewed: 19 October 2026.