Why cybercriminals go after small and medium-sized businesses
Many people believe hackers only attack corporations: big banks, retail chains, global groups. That is a dangerous myth. Small and medium-sized businesses are now a preferred target, and for specific reasons.
Easier target, faster profit
Large corporations have security teams, advanced detection and budgets in the millions. Breaking into them takes months of preparation and sophisticated techniques. Smaller companies often run outdated software, skip basic protection and use passwords like "company123". For an attacker it is the difference between cracking a bank vault and walking through an unlocked door.
According to Accenture, 43% of all cyberattacks target small businesses, yet only 14% of them are adequately prepared. Criminals exploit that gap every day.
Valuable data, weak protection
Your business may be small, but the data you hold is not. Customer details, card numbers, employee records, commercial contracts and know-how all have a price on the black market. Small firms collect the same kinds of data as corporations and protect it far less well.
Small businesses are also a gateway to larger ones. If you supply or partner with a big company, an attack on you can be the first step into their systems. These supply chain attacks have become one of the most common attack routes in recent years.
Costs that can finish a company
The average cost of a data breach for a small business in 2025 is $140,000, up 13% on the previous year. That is only the direct loss. Add downtime, lost customers, regulatory fines and the cost of rebuilding your reputation.
The most worrying figure: 75% of small and medium-sized businesses admit they would not survive a ransomware attack. Even when a company pays, recovering the data and getting back to normal can take weeks or months.
The fundamentals: five pillars of protection
Before the specific tools, one principle: cybersecurity is a continuing process, not a one-time purchase. Buying antivirus and forgetting about it is not enough. Effective protection rests on five pillars.
Identity and access management
Verizon's report says 86% of web application attacks use stolen credentials, so passwords are your weakest link. Habits make it worse: 49% of employees reuse passwords across several work applications, and 36% use the same password for personal and work accounts.
What to put in place:
multi-factor authentication (MFA) on all critical systems, which alone can block over 99% of account attacks
a company password manager, to end weak and reused passwords
least privilege, so each person can reach only the data their job needs
regular access reviews, with access updated at once when someone changes role or leaves
Updates and vulnerability management
In 2024 nearly 29,000 new software vulnerabilities were found, many of them critical. Attackers rely on companies putting updates off as a nuisance. Every day of delay is an open door.
What to put in place:
automatic updates wherever possible
a regular schedule for systems that need manual updating
an inventory of all devices and software in the company, because you cannot protect what you do not know about
tracking of end-of-support dates for the software you use
Backups and the 3-2-1 rule
Backup is your last line of defence. If everything else fails, a current backup lets you rebuild the business without paying a ransom. That works only if it is done properly.
The 3-2-1 rule means:
3 copies of the data (the original and two backups)
2 different kinds of media (for example a local disk and the cloud)
1 copy kept offsite (offline or in another location)
Test restoring from backups regularly. A backup you cannot restore is worthless.
Perimeter protection and network segmentation
A firewall is not a relic. It is still the foundation. But on its own it is not enough. A modern setup divides the network into isolated zones, so an attacker who gets past one barrier does not automatically reach everything.
What to put in place:
a next-generation firewall with traffic inspection
segmentation that separates critical systems (CRM, ERP, financial data) from the general office network
a VPN for remote workers
monitoring of network traffic for anomalies
Employee awareness
82% of breaches involve the human factor: phishing, malicious links, infected attachments. You can have the best systems in the world, and it is all for nothing if an employee hands over a password in reply to a convincing email.
What to put in place:
regular phishing training, quarterly rather than once a year
simulated phishing attacks to test the team
a clear procedure for reporting suspicious messages
a culture where people are not afraid to admit a mistake
A practical security checklist for small businesses
Theory is one thing. You also need a concrete list. This one is the minimum every business should have, whatever its industry and size.
Technical measures for day one
Start with the basics, which you can introduce almost immediately:
antivirus and antimalware on all devices, which sounds basic but many companies still lack it
a firewall that is configured and monitored, not just switched on
MFA on email, CRM and ERP systems and cloud access, which is the top priority
disk encryption on laptops and mobile devices, so data stays safe if one is stolen
automatic screen lock after a period of inactivity
Processes and procedures
Technology without process is half a solution:
a password policy: minimum length, complexity, regular changes
onboarding and offboarding procedures for granting and revoking access
an incident response plan saying who does what when something goes wrong (77% of organisations have none)
a quarterly security review to check that everything works as it should
infrastructure documentation with a current map of systems and connections
Protecting customer data
GDPR is a legal requirement, and it is also good business practice:
a data inventory, so you know what you collect and where you keep it
data minimisation: collect only what you really need
encryption of sensitive data, at rest and in transit
access control, because not every employee needs all customer data
deletion procedures, so you can comply when a customer asks
How CRM and ERP systems can strengthen or weaken your security
CRM and ERP systems are the operational heart of most companies. They hold the most valuable data: customers, transactions, business processes. That makes them both the main target and a key part of your security strategy.
Off-the-shelf or custom
Popular "boxed" CRM and ERP systems have advantages. They deploy quickly and cost relatively little. They also have a security drawback: their architecture is widely known. Attackers know where to look for vulnerabilities, what weaknesses to use and how to get round standard protections.
A custom system has one modest advantage: attackers do not know how it is built, which makes a successful attack harder. This does not replace other measures, it adds one more layer.
Security built in from the start
When you build a custom system, you can put security into the architecture itself:
granular access control that follows your organisation's structure
automatic logging of all actions, at whatever level you need
encryption fitted to your data, not a generic solution
integration with your security systems, without the compromises of an off-the-shelf product
Automation as a security measure
Well-designed process automation reduces the risk of human error, the main source of breaches. A system can automatically:
detect unusual activity patterns and alert administrators
block suspicious operations that need additional verification
enforce compliance with security procedures
generate compliance reports without manual work
What security costs, and what its absence costs
Many owners put off security spending because they see it as a cost rather than an investment. That is a serious miscalculation. Look at the numbers.
Cost of prevention against cost of an incident
According to recent analyses, basic preventive measures cost a small business about $12,000 a year. Compare that with the average cost of a breach, $140,000. For every dollar spent on prevention, an avoided attack saves about $11.
And $140,000 is only an average. Real costs run from tens of thousands to $7 million, depending on the scale of the breach, the type of data and the length of the downtime.
Hidden costs people forget
Direct financial loss is the tip of the iceberg:
downtime: the average time to identify a breach is 194 days, and the whole cycle from detection to containment takes 277 days
lost customers: after a public breach some customers move to competitors
regulatory fines: GDPR allows fines up to €20 million or 4% of global revenue
legal costs: class action lawsuits from affected customers are becoming the norm
higher insurance premiums: after an incident, cyber insurance gets much more expensive
lost business: more and more tenders require security certifications
Budgeting for security
The usual recommendation is to put 7 to 20% of the IT budget into cybersecurity. For many small businesses that means several hundred to several thousand dollars a month. It is not trivial, but compare it with the potential losses.
How you spend matters. Instead of buying the most expensive tools "because they are the best", invest in what covers your biggest risks. A security audit shows where your money will return the most.
Where to start: a 30-day plan
After reading this you may feel there is too much to do while you still have a business to run. So here is a plan you can carry out over the next month.
Week 1: audit the current state
Before you fix anything, find out what is broken. In the first week:
list all devices, software and systems in your company
check who has access to what, because the list may surprise you
verify that you have current backups and that data can be restored from them
decide which data is most valuable and most exposed
Week 2: quick wins
Do what has the biggest effect for the least effort:
enable MFA everywhere you can, starting with email and CRM or ERP systems
force a change to strong, unique passwords for each system
update all systems to the latest versions
set up automatic updates wherever possible
Week 3: processes and people
Technology is only part of it. Now it is the people's turn:
run basic cybersecurity training for all employees
set clear procedures for reporting suspicious emails and incidents
name someone responsible for security, even as an additional role
write down a basic incident response plan
Week 4: long-term planning
Spend the last week on strategy:
set your cybersecurity budget for the coming year
identify gaps that need professional help
consider a security audit by an external expert
schedule regular reviews and procedure updates
Security is a process, not a product
Cybersecurity for a small business does not need a million-dollar budget or an army of specialists. It does need a conscious approach, consistency and a view of security as part of running the business, not a problem for "someday".
The main points:
you are not too small: 43% of attacks target small and medium-sized businesses
the basics decide most outcomes: MFA, updates, backups and staff awareness will stop most attacks
prevention is cheaper: every dollar spent on security saves roughly eleven in potential losses
security is a process: a one-time action is not enough, it needs steady attention
your IT systems can help: a properly designed CRM or ERP strengthens the security of the whole organisation
If you want a system built around your company's processes, with security designed in from the start, get in touch. We will help you turn business goals into IT solutions that streamline operations and protect what matters most: customer data and business continuity.
