Why Company Size Is Often the Wrong Way to Think About Cybersecurity Risk
Updated: Oct 6
One of the most persistent misconceptions in cybersecurity is that attackers are mainly interested in large organizations.
It is an understandable assumption. The breaches that make national headlines usually involve multinational companies, healthcare systems, government agencies, major retailers, or household names. A 40-person accounting firm or a regional professional-services company rarely receives the same attention.
That can leave smaller organizations asking a reasonable question:
Why would an attacker target us?
The problem is built into the question. It assumes every cyberattack begins with someone deliberately selecting a company and deciding it is worth attacking.
Many attacks do not work that way.
Some adversaries carefully research specific targets. Others scan for exposed systems, test stolen credentials across large numbers of accounts, exploit known vulnerabilities, send phishing campaigns at scale, or look for whatever access happens to work.
Sometimes an organization is chosen.
Sometimes it is simply reachable.
Company size matters in cybersecurity, but headcount alone tells us surprisingly little about what an organization has to protect, how exposed it is, or what an attacker could gain from access.
Attackers Follow Opportunity, Not Headcount
Different attackers have different objectives.
A nation-state conducting espionage behaves differently from a criminal group deploying ransomware. An attacker stealing credentials may want something entirely different from someone conducting payment fraud. Some operations are highly targeted. Others are designed to find opportunities at scale.
For financially motivated attackers, the economics do not require every victim to be a Fortune 500 company.
Microsoft's 2025 Digital Defense Report found that financial motives dominated the incidents its security teams investigated. Extortion and ransomware accounted for a large share of attacks with identifiable motives, while espionage represented a much smaller portion. Microsoft also described how automation and widely available criminal tools allow attackers to operate against more potential victims at lower cost.
That matters because a smaller organization can still offer something valuable.
A compromised email account can be used for fraud. Stolen credentials may provide access to financial systems or cloud applications. Ransomware can stop operations. Sensitive client information can be stolen. A trusted business relationship can provide a path into another organization.
The better question is rarely how many people work there. It is what an attacker can reach once access is obtained.
Smaller Organizations Are Already Part of the Threat Landscape
Available breach data does not support the idea that smaller organizations sit safely below an attacker's radar.
System Intrusion, Basic Web Application Attacks, and Social Engineering accounted for essentially all of the breaches categorized in Verizon's SMB analysis. Financially motivated external actors dominated the dataset, and Verizon found that smaller organizations continue to face many of the same attack patterns seen in larger enterprises.
Smaller organizations can also be hit particularly hard by ransomware because they often have fewer resources available to absorb disruption and recover.
None of that means a small company is automatically more likely to be breached than a large one. Raw breach counts cannot establish the probability that any individual organization will experience an incident, and datasets such as the DBIR have methodological limits.
The more defensible conclusion is simpler:
Being small does not remove an organization from the cyber threat landscape.
Credential theft, ransomware, social engineering, vulnerability exploitation, and account compromise do not require a company to be famous first.
Smaller Organizations Operate Under Different Constraints
A growing company may have one small IT team responsible for everything from laptops and Microsoft 365 to networking, backups, cloud applications, and user support.
Another may outsource most of its technology management.
A third may have no dedicated security staff at all, with security responsibilities spread among executives, IT providers, consultants, office managers, and employees who already have other jobs to do.
That is not automatically evidence of weak leadership. It is an operating reality.
There is evidence that capacity can matter when incidents occur.
A 60-person company does not need the same security organization as a multinational enterprise.
It still needs controls that make sense for what it depends on, what it holds, what it is exposed to, and what would happen if something failed.
Law Firms: Valuable Information Does Not Require a Large Headcount
Consider a small law firm.
It may employ only a few dozen people while holding confidential client communications, litigation records, contracts, transaction details, financial information, intellectual property, and personal data.
The meaningful questions are not simply how many attorneys work there:
How sensitive is the information? Who can access it, and how is that access protected? Which systems are essential to the firm's work? What happens if those systems become unavailable? What happens if confidential information is exposed?
A firm does not need thousands of clients for one file to matter.
The size of the organization is part of the context.
It does not define the exposure.
Accounting Firms: Access to Financial Trust
Accounting firms illustrate the same problem from another direction.
A relatively small practice may handle tax records, payroll information, financial statements, banking details, personally identifiable information, and other sensitive records for dozens or hundreds of clients.
The trusted relationships around that information may be just as valuable as the information itself.
A compromised email account might give an attacker access to company data. It could also allow the attacker to impersonate someone the firm's clients already trust.
That means risk can extend beyond the organization itself. A smaller company can be attractive because of where it sits inside a larger business ecosystem.
Thirty percent of breaches involved a third party, roughly double the proportion reported in the previous year's dataset. Verizon expanded how it counts third-party involvement, so part of the increase reflects improved measurement rather than a change in attacker behavior alone.
An organization does not have to be the final target to become part of an attack path.
Healthcare Providers: Sensitive Data and Operational Dependence
Healthcare adds another dimension.
A small healthcare provider may hold highly sensitive personal and clinical information while relying heavily on technology for scheduling, records, communications, billing, prescriptions, and patient services.
A compromised password can eventually be reset. A patient's medical history cannot simply be replaced.
But confidentiality is only part of the risk. If scheduling, records, communication systems, or other critical applications become unavailable, the problem becomes operational as well as informational.
That means the impact of a cybersecurity incident depends not only on how much data an organization holds, but on how much the organization depends on the affected systems to keep functioning.
A smaller healthcare provider can face serious consequences without ever appearing on a list of major corporate targets.
Professional Services Firms: Trust Has Value
Consultants, engineering firms, financial advisors, marketing agencies, managed service providers, and other professional-services businesses often occupy trusted positions inside their clients' environments.
They may hold internal documents, strategic plans, financial information, credentials, confidential communications, or direct access to customer systems.
An attacker may want the firm itself. Or the firm may provide a route to something else.
This is where headcount becomes especially misleading.
Same number of employees.
Very different exposure.
Human Risk Is Part of the Picture
Many of these attacks also involve a human decision somewhere along the path.
An employee receives a phishing email. Someone processes a fraudulent invoice. A help desk employee receives a convincing password-reset request. A manager responds to an impersonated executive. Someone approves an unexpected MFA notification.
Those attacks can exploit ordinary human tendencies such as trust, urgency, responsiveness, authority, familiarity, and helpfulness.
But reducing the resulting incident to "human error" leaves too much out. The outcome may also depend on weak authentication, excessive permissions, poor verification procedures, unclear escalation paths, vulnerable systems, inadequate monitoring, or a work environment that pressures people to act quickly.
The more useful question is not why the employee made the wrong decision. It is what combination of behavior, process, technology, and organizational conditions allowed that decision to become a security incident.
That is where human risk and security culture fit into the larger security picture. They are not substitutes for technical controls. They help explain how those controls work, or fail, in actual business environments.
Sometimes the Organization Wasn't Chosen at All
This is one of the most important points for smaller organizations.
The question "Why would someone target us?" assumes there was a targeting decision.
Credential stuffing shows why that assumption can fail.
Attackers can obtain lists of compromised usernames and passwords and automatically test them against other services. They do not have to research every employer represented in those credentials.
Credential abuse accounted for 22% of known initial access vectors in Verizon's research accompanying the 2025 DBIR. In separate authentication analysis, credential-stuffing attempts represented a median 12% of authentication attempts even among organizations Verizon classified as small. These are different measurements and should not be added together.
The attacker does not necessarily need to know that a particular username belongs to someone at a 25-person accounting firm. The attacker needs the credential to work.
The same principle applies to vulnerable internet-facing systems. Verizon's 2025 DBIR found vulnerability exploitation accounted for 20% of known initial access vectors, close behind credential abuse.
This changes the question.
Instead of asking why someone would choose the organization, ask what someone can reach.
That is a much more useful place to start.
Company Size Still Matters, Just Not in the Way People Think
Company size belongs in a cybersecurity risk assessment. It can affect staffing, complexity, budget, purchasing power, regulatory obligations, the number of users and systems that need protection, and the organization's ability to absorb and recover from disruption.
A 20-person company and a 20,000-person company obviously do not have identical security requirements.
But size should be treated as context, not as a proxy for risk.
A useful assessment looks at what information the organization holds, which systems are essential, which identities have significant access, what third parties it depends on, what threats are relevant, how those threats could gain access, and what the consequences would be if important controls failed.
It also looks at what happens afterward:
Can the organization detect an incident? Can it keep operating? Can it recover? Can employees recognize and report suspicious activity? Are there controls that prevent one compromised credential, one fraudulent payment request, or one bad decision from becoming a major event?
Those questions tell us far more than employee count.
Risk Is About Exposure, Impact, and Context
A small company can have serious cybersecurity exposure. So can a large one.
The important difference is not simply the number of employees. It is what the organization values and depends on, what is reachable, which threats are relevant, how access is controlled, how people interact with those controls, and what happens when something fails.
For smaller organizations, this distinction matters.
You do not need to be a multinational corporation to hold valuable information. You do not need thousands of employees to possess a credential worth stealing. You do not need to be famous for an exposed system to be discovered. And an attacker does not always need to know who you are before finding something they can exploit.
Comments