The good news: small practices don’t need to outrun the bear. They just need to be harder to penetrate than the practice down the street.
Attackers are opportunistic. Most ransomware groups run automated scanning that flags easy targets — unpatched VPNs, legacy protocols left exposed, admin accounts without MFA. Solid MFA, current patches, and offline backups will stop a large percentage of the automated attacks before they ever become incidents.
The sophisticated operators — the ones who do hands-on intrusion, move laterally, and exfiltrate data over weeks — are typically targeting larger organizations with deeper pockets and more valuable data. A regional medical practice, a local accounting firm, a construction company with $10M in annual revenue: these aren’t their primary targets.
That doesn’t mean small businesses are safe. It means the bar is different. You’re not defending against nation-state APT groups. You’re defending against automated toolkits, opportunistic ransomware operators, and the occasional targeted attack that lands in your inbox.
**Multi-factor authentication on everything.** Every remote access point, every admin console, every cloud service. This alone stops the majority of automated attacks. If your VPN doesn’t support MFA, replace the VPN.
**Patch management that actually runs.** Not “we try to patch within 30 days.” Automated patching for endpoints, and a documented process for critical infrastructure patches within 72 hours. Most exploited vulnerabilities in recent attacks were known and patched months before the incidents happened.
**Offline backups, and test them.** Ransomware operators know backups. They target them. Your backup strategy needs to assume that your online backups will be compromised alongside the primary systems. One offline copy, tested quarterly, with a documented restore procedure.
The goal isn’t perfection. It’s making your practice harder to compromise than the one down the street. Attackers aren’t making emotional decisions — they’re running economics. The time and cost to breach your network versus the likely payoff.
When you harden your environment, you move yourself off the automated target list and into the “too much work for too little return” category. That’s a winning security strategy for a small organization.
You don’t need a massive security budget. You need the right controls, applied consistently, with backups you can actually rely on when it matters.
