Small Businesses Are the Preferred Target, Not an Afterthought
Attackers increasingly favor small and mid-size businesses over large enterprises for a simple reason: smaller companies have real money moving through their accounts but rarely have a dedicated security team. During our cybersecurity audits for Fresno-area clients, the same handful of attack patterns show up again and again.
The Five Attacks We See Most
Business email compromise (BEC). An attacker gains access to or spoofs an executive's email and instructs accounting to wire funds or change a vendor's bank details. This is consistently the costliest attack category by dollar loss, and it rarely involves any malware at all — it's pure social engineering.
Phishing with credential harvesting. A fake login page mimicking Microsoft 365 or Google Workspace captures a password, which the attacker then uses to log in directly, set up mail forwarding rules, and monitor for invoice threads to hijack.
Ransomware via exposed RDP or unpatched VPN appliances. Attackers scan the internet for exposed Remote Desktop Protocol ports and outdated VPN software, brute-force or exploit their way in, then encrypt file shares and demand payment.
Vendor and supply-chain compromise. A trusted software vendor or IT contractor gets breached, and the attacker rides that trusted access into every downstream client — including yours.
Point-of-sale and payment skimming. For retail and service businesses taking card payments, outdated POS software or unpatched payment terminals remain a common entry point for card-skimming malware.
Defenses That Actually Move the Needle
Multi-factor authentication on everything. Email, banking, and admin panels. MFA alone stops the overwhelming majority of credential-based attacks, even when a password is fully compromised.
A written wire-transfer verification policy. Any change to bank details or a wire request over a set dollar threshold requires a phone call to a known number — never a reply to the email itself. This single policy defeats most BEC attempts.
Close RDP and VPN exposure. Remote access should sit behind MFA and a VPN, never directly exposed to the internet. Patch VPN appliances immediately when updates ship — these are consistently the most exploited entry point in ransomware incidents.
Immutable, offsite backups. Backups that an attacker with domain admin access can still delete are not backups. Use a provider with immutable snapshots and test restores quarterly, not just on paper.
Least-privilege access. Most employees don't need admin rights on their own machine, let alone domain-wide access. Limiting lateral movement contains a breach to one machine instead of the whole network.
If You've Already Been Hit: The First Hour
Disconnect the affected machine from the network — don't power it off, which can destroy forensic evidence. Notify your IT provider or MSP immediately. Do not pay a ransom before consulting your cyber insurance provider, if you have one, since payment can affect coverage and doesn't guarantee data recovery. Change all passwords from a clean, uncompromised device. Document everything for your insurer and, if required by your state or industry, prepare breach notifications.
The Honest Cost-Benefit
A basic security hardening pass — MFA rollout, RDP lockdown, backup verification, and a wire-transfer policy — typically costs far less than a single ransomware incident's downtime, let alone the ransom itself. This is the highest-ROI IT spend most small businesses can make.
Want a cybersecurity audit for your business? Operon E2I offers a structured Cybersecurity Audit package — reach out at /contact.