Why SMBs are targeted by cybercriminals

Available in:ENIT

We picture hackers as hooded computer wizards, lit by the pale glow of their monitors, shadows flickering as their fingers race across the keyboard like skittering spiders.
Sometimes freedom fighters, other times dangerous guns-for-hire of cyberspace.

A US prosecutor once argued Kevin Mitnick could "start a nuclear war by whistling into a telephone."

This couldn't be further from the truth.
But this lie, as romantic as it can be, comes with a dangerous side: the wrong assumption that "it won't happen to me, I'm not a target."
We think that cyber criminals carefully pick their next victim, and while this sounds scary, there's comfort in not being interesting enough, like a drop in the ocean.

The Reality

First and foremost, we have to stop thinking about cyber criminals as lone individuals and face the fact that there are organizations (sometimes state-sponsored) engineering the process of extorting businesses and selling their secrets. This is not vandalism; this is organized crime in a market making more money than drug smuggling with a fraction of the risks. Sounds appealing? It is.

Secondly, but of no less relevance, the targeting process is mass-scale and automated.
It's much, much easier and more effective to choose a vulnerability and look for targets than the opposite, and targets are in the thousands.

This process is as effortless as making a Google search. All it takes is a query for a product and a version with a known vulnerability in databases constantly indexing anything exposed to the internet.

Do you want to try it yourself? Search __product:exim "4.91"__ on Shodan (requires login).
At the current date (11/24/25), there are over 18,000 potential targets, still vulnerable from a 2019 critical bug.

And that’s a single one; tens of thousands are discovered every year—not all critical, of course.

The Takeaway

The goal of this article is not to scare-pitch you into buying our solution. The goal is to shed some light on an unknown world that largely benefits from its obscurity.

Understanding the threat landscape is the first and most important step to prepare in a meaningful way for an event that will, sooner or later, occur. The large numbers that we thought were hiding and protecting us are, in reality, sharp edges pointed at us.

Found this helpful?

Join The Hive for curated attacker insights and cybersecurity webinars - easily explained from an actual hacker