Smaller organizations are often told they are too small to be a target. The data says the opposite: attackers are deliberately moving toward them, because they pay faster and defend less. The response is not to buy more fear. It is to do a small number of things well, in the right order.
The Shift Toward Smaller Targets
Verizon's 2025 Data Breach Investigations Report, based on more than 22,000 incidents and 12,000 confirmed breaches, found ransomware in 88 percent of breaches at small and medium-sized businesses, against 39 percent at large organizations. Chainalysis's analysis of 2025 ransomware activity found that claimed attacks rose about 50 percent while total ransom payments fell, and that attackers are shifting toward small and medium-sized targets on the assumption that smaller victims pay faster.
The economics explain why. Chainalysis reports that the typical price of access to a victim's network on criminal markets fell from about $1,427 at the start of 2023 to $439 at the start of 2026. Cheap access and ready-made tools mean attackers no longer need a large target to make an attack worthwhile. They need an easy one.
How Smaller Organizations Are Actually Breached
| Way In | What the 2025 Data Shows | The Practical Defense |
|---|---|---|
| Stolen credentials | The most common initial access vector, in 22 percent of breaches | Multi-factor authentication on email, remote access and administrator accounts |
| Exploited vulnerabilities | 20 percent of breaches, with edge devices and VPNs a rising focus | Patch internet-facing systems first, and fast |
| Third parties | Involvement doubled from 15 to 30 percent of breaches | Know which vendors can reach your systems and data |
| The human element | Present in about 60 percent of breaches | Short, regular training and an easy way to report |
An Order of Priorities
1. Name an Owner
Someone must own cyber risk, even part-time. For a small organization this is often an executive supported by outside expertise, not a full-time hire. What matters is that decisions have an owner and a rhythm.
2. Know What Would Hurt Most
List the few business processes that would stop revenue if interrupted, and what they depend on. This takes a day, costs nothing, and determines where everything else should go.
3. Close the Common Ways In
Multi-factor authentication, prompt patching of internet-facing systems, and a current list of vendors with access address the four entry points in the table above. Most small organizations already own the tools to do the first two.
4. Make Recovery Certain
Backups that are tested, and stored where an attacker who reaches your network cannot reach them. The 2025 DBIR found that 64 percent of ransomware victims did not pay. The organizations that can refuse are the ones that can recover.
5. Use What You Own Before Buying More
Many small organizations pay for security features they have never switched on, in email, productivity and endpoint platforms they already license. Configuring those well is usually worth more than adding a new product.
What Not to Buy
Fear is the most expensive product in cybersecurity. A small organization that buys a technology after a frightening story, without an owner to run it, has added a cost and a new system to maintain, not protection. The test before any purchase is simple: which of the priorities above does it serve, and who will run it?
Conclusion
Smaller organizations are now a deliberate target, and the ways attackers get in are well understood. A calm, ordered program that names an owner, protects what matters most, closes the common entry points and makes recovery certain will outperform a larger budget spent in fear. That same discipline, applied continuously, is what AQUILA C4I was designed to support at any scale.
Sources
- Verizon, 2025 Data Breach Investigations Report, SMB Snapshot
- Verizon, 2025 DBIR press release
- Keepnet Labs, summary of 2025 DBIR entry points
- Cointelegraph, on Chainalysis's 2025 ransomware analysis
- Quisitive, on 2025 DBIR ransomware payment refusals