The idea that ransomware operators only go after large enterprises is one of the more costly misconceptions in small-business security. Most ransomware today is deployed by affiliates running semi-automated campaigns against whatever’s reachable and under-defended, and small businesses are, on average, both.
Why smaller businesses are efficient targets
- Fewer resources dedicated to security monitoring means longer dwell time before detection
- Backup practices are often untested, files exist, but nobody has confirmed they actually restore
- Smaller IT teams mean patching frequently falls behind
- Insurance and the pressure to reopen quickly make smaller businesses more likely to pay
- Supply-chain targeting: a small vendor is sometimes the easiest way into a larger client
What actually moves the needle
The highest-leverage fixes aren’t exotic: tested (not just scheduled) backups, MFA on every account that supports it, a patch cadence that doesn’t slip for months, and network segmentation so one compromised device can’t reach everything. None of this requires an enterprise security budget, it requires actually doing the basics consistently, which is where most gaps come from in practice.