Most attacks that reach smaller companies are not sophisticated. They hit a gap that has been known for months, and they hit it automatically: a scanner finds an exposed system, a bot tries a password that leaked from someone else's service.
So the question is rarely «who is after us?» but «which of the known gaps is still open here?». The points below are sorted by the second question — not by drama, but by how often they are genuinely open in the environments we take over.
Why smaller companies get hit
Attackers do not look for the most rewarding target. They look for the cheapest one. A company with thirty people holds the same kinds of data as a corporation — customer records, quotes, payment details, contracts — but rarely has anyone whose job is protecting it.
There is also an asymmetry in the damage. A corporation survives three days of standstill. For a company whose orders all run through a single system, three days decide whether next month gets invoiced at all.
And the incident does not stay internal. Under Swiss data protection law you have to report a breach of data security to the Federal Data Protection and Information Commissioner as soon as it creates a high risk for the people affected.
Passwords that someone has already read
The most common gap is not software. It is a password used for several services at once. When a database leaks somewhere else, the address-and-password combination gets tried automatically against other services — including yours.
The remedy is unspectacular: a password manager, so every system gets its own long password, and an end to the habit of passing credentials around by chat or email.
More important than any complexity rule is the second factor. Multi-factor sign-in devalues a stolen password — the attacker has it and still cannot get in. That applies to management and finance exactly as much as to everyone else; the «not for me» exemption is why this step so often fails in practice.
Phishing: the route that works most reliably
Phishing remains the most-used way in, because it needs no technical flaw. An email that looks like an invoice from a supplier you know is enough.
A lot can be caught technically: an email security layer that inspects attachments and links, and correctly configured sender authentication for your own domain so nobody writes in your name.
The rest is practice. Not one training session a year, but a short recurring one: what a genuine invoice from us looks like, who you report a suspicion to, and what happens if someone did click. The last point decides more than the first two — where a mistaken click is embarrassing, it gets hidden, and ten minutes turn into ten days.
Software that is out of date
Missing updates are the gap with the shortest half-life. Once a vulnerability is published, automated scanners start looking for systems that still carry it.
More than the operating system is affected: browsers, servers, firewalls, industry software and anything reachable from the internet — especially remote access that was opened during a home-office period and never closed again.
What matters is not whether someone installs updates, but whether it is knowable which devices exist and what state they are in. That is the core of managed IT: an overview that does not live in one person's head.
Devices outside the office
Laptops, phones and tablets reach company data every day, and they do it in places where no network is under your control. A lost device is therefore not primarily a hardware loss.
Four things separate an annoyance from an incident:
- Disk encryption, so the data is worthless without a sign-in
- Central device management that knows which device belongs to whom
- Remote wipe for a device that does not come back
- Current malware protection on every device, including personal ones
The last point is the uncomfortable one. Anyone reading company mail on a private phone has company data on a device no policy covers. That is solvable — but only once someone says it out loud.
Backups nobody has ever restored
Almost every company has a backup. Far fewer have ever restored one. The difference shows on the worst day: a backup whose restore has never been rehearsed is an assumption, not a safeguard.
The 3-2-1 rule has held up well — three copies of the data, on two different media, one of them off site. The addition ransomware made necessary matters just as much: at least one copy has to sit where an infected system cannot delete it.
Two questions belong answered before the emergency, not during it. How many hours of work may be lost, and how long may the restore take? Those two numbers produce the concept — not the other way round. How we set that up is on the backup and cloud page.
Cloud services and permissions that grew along
Cloud services move responsibility, they do not remove it. The provider secures the platform; who may reach which data inside it stays your job.
The most common finding is permissions that accumulated over years: folders «everyone in the company» can read, accounts of people who left, shared links with no expiry date.
That was a theoretical risk for a long time. With AI assistants in daily work it became a practical one, because an assistant sees everything the signed-in person can access and makes it findable. Cleaning up permissions therefore comes before the rollout, not after it — the same order that applies to Microsoft 365.
A network with no internal walls
In many companies everything sits in one network: workstations, servers, printers, the point-of-sale system, the tablet in the meeting room and the guest Wi-Fi. Whoever gets in anywhere reaches everything.
Splitting it into zones limits the damage to the zone where the attack started. Alongside that come the pieces that are rarely missing but often outdated: a maintained firewall, a VPN instead of open remote access, and logging that makes unusual access visible.
That last piece gets skipped most often. Without it you notice a break-in when it takes effect — and with ransomware, that is the moment everything is already encrypted.
People who were never told what is expected
Technology stops a lot, but not the email in which a supposed manager asks for an urgent payment. What works here is not a briefing on threat landscapes but a handful of clear procedures.
Three are enough to start. Changes to payment details get confirmed through a second channel, never by email. Suspicious messages go to a known address, not to the bin. And whoever clicked reports it immediately, without fearing consequences.
Those three sentences cost nothing and close the gap where the most expensive incidents begin.
From individual measures to an order
The tenth and final finding explains the other nine: no measure is missing, the order is. Companies buy a firewall before the permissions are right, and introduce an AI assistant before anyone knows who can see which folder.
A workable order looks almost always the same:
- Multi-factor sign-in on every account, with no exceptions
- Clean up permissions and storage structure
- A backup outside the platform, with a rehearsed restore
- Inventory devices, encrypt them, keep them current
- Segment the network and log access
- Define and practise the procedures for a suspected incident
Only after that do the wider concepts earn their place: zero trust as the principle of checking every access instead of trusting a network, proper identity and access management, or an ISO 27001 certification where customers ask for one. They are good destinations — and poor starting points.
Security is a state, not a project
An environment that is clean today will not stay clean on its own for six months. Devices get added, people leave, a service is introduced, a vulnerability becomes public.
What that means in operation is manageable: review permissions periodically, test the restore instead of only reading the backup log, close the accounts of people who left, and once a year have someone check from the outside what of your systems is visible.
That is the part with ongoing effort — and the reason most companies hand it over. What belongs to it is on the IT security page.
Conclusion
Cyber security for smaller companies is rarely a question of missing technology. It is a question of gaps that are known and still open: the same password in several places, no second sign-in factor, a backup nobody has tested, permissions from another era.
Closing those gaps is not an investment against an event that may happen. It is what keeps an incident down to one day of work instead of a question about the business itself.
If you want to know which of these points are open in your environment and in what order they should be dealt with, we will look at it together. How we set up and run security sits with the ALPENIQ IT division, and the simplest way to talk it through is a free strategy call.
Frequently Asked Questions (FAQ)
Why would anyone target a smaller company?
Because most attacks do not choose a target. They search automatically for known weaknesses and for passwords that leaked elsewhere. A smaller company is not less interesting, only less well protected — and the damage hits harder, because a single system often carries the whole operation.
Which measure gives the most if I can only do one?
Multi-factor sign-in on every account. It devalues stolen passwords and closes exactly the route automated attacks take most often. In Microsoft 365 or Google Workspace it costs no extra licence, only the decision that there are no exemptions.
Is a backup enough protection against ransomware?
Only if it meets two conditions. It has to sit where an infected system cannot encrypt or delete it, and the restore has to be rehearsed. A backup that has never been restored is an assumption — and the worst day is a bad time to test one.
What does zero trust mean in practice?
That no access is permitted merely because it comes from inside the company network. Every access is checked: who, on which device, to which data. For smaller companies this is not a product you buy but a direction — and it starts with sign-in and permissions, not with new software.
What does ALPENIQ take on in IT security?
We review the existing environment, clean up permissions and storage, set up sign-in, device protection and backup, and segment the network where that is needed. After that we keep running the environment — including updates, monitoring and the periodic review, without which the tidy state does not hold.