%20-%20no%20white%20space%20-%20resized.png?width=200&height=40&name=logo%201%20(bold)%20-%20no%20white%20space%20-%20resized.png){kind=small}
Many SME owners think: we are too small to interest hackers. But most cyber attacks do not start with a choice. They start with a program that tries thousands of companies at once.
Small businesses are hit hard. In its 2025 report, Verizon found ransomware in 88% of data breaches at small and medium-sized businesses, against 39% at large organisations.
This article explains why cyber attacks also hit SMEs, where attackers usually get in, and what you can do about it.
Why do hackers attack small businesses?
Criminals do not choose a company first and then look for a way in. They work the other way round.
A hacker picks a large company, studies it and then attacks it.
A program tries thousands of companies at once and attacks every one where it finds a way in.
Four developments make this easy for them:
Automated scans
Programs search the internet day and night for devices with known weak spots.
Leaked passwords
Passwords from earlier data breaches are sold and tried on company accounts.
Phishing with AI
AI writes convincing e-mails without spelling mistakes, in any language and in large numbers.
Ready-made attack tools
Criminals rent complete attack kits. They need little technical skill to use them.
And every SME has something worth taking: money in the bank account, customer data, or access to the systems of larger customers.
So the question is not whether your company is interesting. The question is whether it has a weak spot.
Where do attackers get in?
At SMEs, attackers usually get in through one of four doors:
- A phishing e-mail. An employee clicks a link or enters a password. According to Statistics Netherlands (CBS), 23% of Dutch companies dealt with phishing or spoofing in 2024.
- A password without MFA. One leaked password is enough if there is no second check, such as a code on a phone.
- Software that is not updated. Known weak spots stay open. Read who actually installs security updates in your company.
- Remote access that is open to the internet. For example a VPN or a remote desktop tool that nobody keeps up to date.
Why do attacks hit SMEs harder?
Large companies have more protection in place. According to CBS, 86% of large companies take at least 10 of 12 basic security measures. Among the smallest companies, with 2 to 10 employees, 40% take three or fewer.
There is also often nobody watching at night or at the weekend. An attack that starts on Friday evening can run until Monday morning.
Checklist: 5 steps to make your company a harder target
Attackers move on when a company is harder to get into. These five steps close the most common doors.
Turn on MFA for every account
E-mail, cloud apps, VPN and admin accounts. A stolen password alone is then no longer enough.
Install security updates quickly
Start with devices that can be reached from the internet, such as the firewall and VPN.
Train employees to spot phishing
Short, regular training works better than one long session per year. Practise with realistic test e-mails.
Check what is visible from the internet
Let someone scan your company from the outside. Close what does not need to be open.
Make sure someone watches day and night
Unusual logins and suspicious activity must be noticed and stopped, also outside office hours.
In short
- Attackers do not choose companies by size. Programs try everyone and attack wherever they get in.
- Most attacks start with phishing, a password without MFA, missing updates or open remote access.
- A few basic measures make your company a much harder target.
SpySecure can take this off your hands. Our cybersecurity plans combine 24/7 monitoring of your devices, accounts and e-mail with security awareness training for your employees.
Want to know where your company is easiest to attack?
Leave your details and we will get in touch to look at your situation together.