Security Basics 03｜Nothing worth stealing? Small companies get targeted for different reasons

When security comes up, a thought may cross your mind: we are only a small company, our website carries public product descriptions, we hold no state secrets and no vast store of customer credit card data — who would spend time coming after us?

If an attacker were one person at a desk, picking targets off a company register, that thought might hold. But The Security Landmines AI-Written Code Steps on Most: Permissions, Keys, Input Validation set out a blunt reality: attacks are programs scanning the whole internet, and they walk in wherever a door is unlocked, regardless of who you are. The UK's National Cyber Security Centre (NCSC) says the same in its guidance 10 Steps to Cyber Security: Vulnerability management — once a new vulnerability is made public, attackers tend to search the internet indiscriminately for any system that has not yet been patched.

This is the third piece in our security basics series. Having confirmed your versions in Security Basics 01｜An advisory just landed: how do you know whether it affects you, this one answers a question owners often have: even if a door really was left unlocked, what would anyone want from a small company? The answer: what they are after was never limited to the commercial secrets you had in mind.

First, a change of angle: does a small company count as a target

The UK's National Cyber Security Centre (NCSC) punctures this myth in the opening of its Small organisations guide to cyber security, updated in 2026: headlines tend to feature large enterprises being breached, but a small company's odds of meeting cyber crime are no different from a large one's. The guide cites UK figures: one in every two small businesses will face at least one security incident within a year.

Why would anyone want an obscure little system? Because once an automated program pushes a door open, even with no startling secrets inside, your system itself carries four ready-made resources: your host, your domain and mailbox, your list of customers and partners, and the fact that you still have to open for business tomorrow.

Valuable thing one: your host and your external service quotas

Each month you pay to rent cloud hosting and to connect an SMS or AI service. What you are buying is compute and sending allowance. To an attacker, all of that is free equipment they did not have to pay for:

• Using your host to mine, or as a staging post: once in, they do not delete your data or change your home page. They quietly run their own program in the background — consuming your processor, or using your host as cover to attack someone else. Your site still looks alive, only unusually slow, until your hosting provider notifies you about abnormal traffic and shuts the machine down.
• Running up charges on the external service keys you connect: as The Security Landmines AI-Written Code Steps on Most: Permissions, Keys, Input Validation noted, what sits between your code and an SMS provider, a mail sender or an AI model is a key acting as a pass. Whoever holds that key can act in your name and spend your money, and when the month-end bill comes in several times higher than usual, the company still pays it.

What to ask the person responsible: if our compute usage or external service consumption suddenly spiked in the middle of the night, is there monitoring and a spending cap that would tell us first? Or would we only find out from the month-end bill?

Valuable thing two: the reputation of your company domain and mailbox

An attacker wanting to send scam mail or phishing links from a free mailbox registered minutes ago will be filtered into junk folders quickly. A small company's domain, trading honestly for years, is a ready-made disguise:

• Borrowing your domain to send phishing mail: your company domain has a record of normal business correspondence, which makes it a sender with reputation in the eyes of mail systems. Once sending permissions or the administrative mailbox are taken, someone can send mail everywhere under your company's name.
• Turning your old pages into scam pages: if your domain still carries an old campaign page or staging site nobody watches, replacing its contents with a fake bank or retailer login page gives them a legitimate-looking address under a real company's domain — in the eyes of search engines and filtering systems, something that survives far longer than a freshly registered scam site.

What to ask the person responsible: do our company domain and mail service have anti-spoofing configured, so others cannot send mail in our mailbox's name? Are there old pages under the domain that nobody manages but that are still open?

Valuable thing three: your order list and your supply-chain trust

You may feel the site only holds names, phone numbers, email addresses and what someone bought — hardly a great secret. But in the division of labour of a fraud operation, a real list with purchase history is far more useful than phone numbers dialled at random:

• Using it to defraud your buyers precisely: when the caller can state the order number, the amount and the items, the person answering has little reason to doubt them. The Hidden Cost of No Maintenance: One Outage, One Breach, One System You Can't Change did that arithmetic: once customer data leaks, what you pay is the time to notify customers one by one, the cost of having someone establish what happened, and the hardest to calculate — the trust that makes a customer choose you next time.
• Using you as the way into the company you work with: if you supply or partner with a larger enterprise, what the attacker wants may not be you at all, but the correspondence and system connections between you and that enterprise. The UK's National Cyber Security Centre (NCSC) warns specifically in its 10 Steps to Cyber Security: Supply chain security guidance that an attack on a supplier can damage an organisation as severely as an attack on the organisation itself — and that when competing for government or large-enterprise contracts, being able to demonstrate basic security has become a condition of winning the work.

What to ask the person responsible: is our database backed up regularly, and is it restricted so only the site itself can connect? In the admin panel holding the contact list, is exporting data subject to permission controls and logging?

Valuable thing four: the pressure of not being able to stop

Even if they take none of the three above, there is a last move: lock up your entire database and all your files, and ask whether you would like to buy the key.

Ransomware of this kind does not need to know what commercial value your data holds. It bets on one thing only — this data is useless to anyone else, but without it you cannot ship tomorrow, cannot reconcile accounts, cannot open for business.

A large company that gets locked may still have a dedicated security team and off-site redundancy to switch to. A small company that discovers even its most recent backup sat on the same host and got locked along with everything else may be forced to choose between paying the ransom and starting over. The four baselines set in Does Your AI Product Have Backups: The Minimum Standard for Database and Files — automatic daily database backups, files backed up alongside them, backups kept on a different host or a different provider, and an actual restore rehearsal every quarter — exist to defend against precisely that day.

What to ask the person responsible: if the entire production host were locked or destroyed today, are our backups somewhere that host cannot reach? When did we last actually try restoring from a backup?

A table: what you think is worthless, and how they turn it into money

Put those four together and you can see that "nothing worth stealing" only looks at the left column and never the right:

Once that lands, which three things to do first

Knowing why small companies get targeted is not a reason to buy expensive equipment only large enterprises can afford. It is a reason to shut the basic doors. Three things you can check right now:

• Do not treat obscurity as protection: automated scanners do not read your signage, only whether the vulnerability is patched. Following the approach in Security Basics 01｜An advisory just landed: how do you know whether it affects you, apply security updates regularly and shut the known doors first.
• Move the backups off the host: against Does Your AI Product Have Backups: The Minimum Standard for Database and Files, confirm the backups live on a different host or provider and that a restore has actually been tried. A clean, independent backup is what lets you refuse to pay when you are locked out.
• Make anomalies arrive before the bill and the complaints: against Who Knows First When Your Site Goes Down, put the three basics in place — site liveness, application errors, host resources — and confirm someone receives the alerts and someone acts on them.

NT IT builds custom systems and now maintains AI systems long term. If you are not sure whether anyone applies security updates to your systems regularly, whether backups really sit outside the host, or whether your keys are at risk of leaking, a system health check is a place to start: it covers code, database, deployment and security, and What a System Health Check Actually Looks At: Code, Database, Deployment, Security describes the whole of it. Book a system health check