Why are small businesses hit by cyberattacks, and what stops most?

Small businesses are attacked because attackers go where access is cheap, not where the name is famous. Stolen logins, unpatched internet-facing systems and weak backups work against any size of firm. The measures that stop most attacks are multi-factor authentication, prompt patching, tested backups and a practiced response plan.

Is a small business really a target?

The UK National Cyber Security Centre says there are 5.5 million small organisations in the UK with between 0 and 49 employees, and states that small businesses are just as likely to experience online crime as larger ones. It also cites an estimate that one in two small businesses suffer a cyber incident each year. That is the NCSC's figure, and surveys of this kind depend on how an incident is defined, so use it as a signal rather than a precise rate.

CISA makes a related point from the US side: small businesses often lack the resources to defend against threats like ransomware, and much common security advice is out of date or does not prevent the most common compromises.

How do attackers usually get in?

The joint CISA, NSA, FBI and MS-ISAC #StopRansomware guide groups prevention advice by common initial access vectors, and the first one it lists is internet-facing vulnerabilities and misconfigurations. Its examples include not exposing services such as remote desktop on the web, disabling unneeded protocols on internet-facing assets and running regular vulnerability scans. Other vectors in the guide are phishing, compromised credentials, precursor malware infections, social engineering and third parties and managed service providers.

MITRE ATT&CK describes brute force as a technique with four sub-techniques: password guessing, password cracking, password spraying and credential stuffing. Credential stuffing tries passwords leaked elsewhere, so a small firm with no breach of its own can still lose an account.

What does a ransomware incident look like for a small firm?

CISA describes ransomware actors encrypting data and also stealing it, then threatening to release it unless the victim pays. It calls the combination double extortion and notes some actors skip the encryption and extort over the stolen data alone. For a firm with ten staff, the impact is often the loss of customer records or invoicing for days, which is why CISA also stresses backups: many victims either had none or had damaged ones.

What actually reduces the odds?

CISA's small business advice is blunt and practical. Make multi-factor authentication mandatory by technical control, not by request, and check for gaps among new staff and people who changed phones. Enable it for every administrator. Patch, with priority for vulnerabilities in the Known Exploited Vulnerabilities Catalog. Back up and test restoring. Write an incident response plan and rehearse it with a tabletop exercise, such as a staff member discovering a ransomware message on a laptop.

Notice what is missing: no advanced tooling. The list works because it removes the cheapest routes in.

A constructed example

A six-person accounting firm runs a remote desktop server so staff can work from home. It is reachable from the internet with only a password. An attacker tries leaked passwords against it and succeeds on one. Under the guidance above, the fix is layered: take the server off the open internet or put it behind a VPN with MFA, enforce MFA on the accounts, keep it patched, and keep an offline backup the attacker cannot reach from that server. Any one of these would have changed the outcome, and together they make a repeat unlikely.

How to check or apply this

1. List what is reachable from the internet and close anything you cannot justify.
2. Enforce MFA on email, remote access and admin accounts, and audit it monthly.
3. Turn on automatic updates and review the KEV catalog for products you run.
4. Keep one backup copy offline or immutable, and test a restore each quarter.
5. Write a one-page response plan with phone numbers that work when the network is down.
6. Run a tabletop exercise twice a year.

Quick check

Sources

• NCSC, Small organisations guide to cyber security
• CISA, Cyber Guidance for Small Businesses
• CISA, #StopRansomware Guide
• MITRE ATT&CK T1110, Brute Force

Last reviewed: 18 October 2026.