ARTICLE | October 19, 2026

I hear some version of this in nearly every first conversation.

“We’re a small business. We don’t really have proprietary data. If somebody wants our trade secrets, honestly, they can have them.”

I understand the logic, and I don’t think it’s careless. It’s a fair read of a risk that usually gets explained badly. The trouble is that it answers a question nobody is actually asking.The clearest way I can show you what I mean is to tell you what happened to a construction company and one of its clients.

Nothing was hacked

An employee fell for a phishing email. No malware, no alarm, nothing to notice. The attacker didn’t break anything. They logged in with a working password, and then they sat in that mailbox and read.

Staying quiet is the whole strategy.

What they were reading was an active project with one of the company’s clients. Months of ordinary correspondence, enough to learn the people, the schedule, and the rhythm of when money moved.

Then they registered two lookalike domains. One impersonating the construction company, one impersonating the client, each a character or two off from the real thing. On a phone, at six in the morning, on a job you have been working for months, nobody notices a transposed letter in an address they have read a hundred times.

With both sides covered, they placed themselves in the middle. Messages were intercepted, altered, and passed along. Both companies believed they were still talking to each other. They were talking to the attacker.

When the moment came, an invoice went out with new banking details.

Here is the part I most want you to sit with. The client did verify. They followed their protocol, picked up the phone, and called to confirm the change, using the number in the email signature. That number belonged to the attacker.

A hundred thousand dollars, sent to a fraudulent account, by a business that followed its own procedure.The compromise went undetected for over a month.

Notice what wasn’t taken

No trade secrets left the building. No customer database, no credit cards, nothing that would appear on anyone’s list of assets worth stealing. That’s why the objection troubles me. It assumes cybersecurity is about protecting things of value, and for most of the businesses I work with, that simply isn’t where the exposure is. It sits in two other places.

The first is access. Can you run payroll if you can’t get into your accounting system? Can you invoice? Can you reach your schedule, your files, your email, your project documentation? Losing those for three days costs real money whether or not anyone wants your data. Downtime is indifferent to how interesting you are.

The second is the one almost nobody raises, and it’s why I push back when an owner tells me they’re willing to accept the risk.You’re not only accepting it for yourself.

Look again at where that money went. The account that was compromised belonged to the construction company. The hundred thousand dollars came out of their client’s account. The business whose security failed is not the business that absorbed the loss.

A compromised mailbox is a tool, and it gets used on the people you email. Your clients. Your subcontractors. Your vendors. Your bank. Every one of them trusts mail from your address, and they should be able to. What you are actually deciding, when you decide this can wait, is how much of your customers’ money you are willing to stand behind your own password habits. So when someone tells me they’ll take their chances, the question I usually ask is whether the risk is actually theirs to accept.

The requirements were never scaled to your size

Technology tends to get sold in tiers. Basic, standard, premium, with security treated as something you buy more of as you grow. It’s an easy model to understand, and matching what you spend to the size of your business is usually good sense. The trouble is the assumption underneath it, which is that a smaller company has less to protect.

Very little outside your business works that way. Attackers don’t check your headcount before trying to steal a password. A cyber insurance application asks a twenty-person company the same questions it asks a two-hundred-person one. The methods aimed at a thirty-person firm are the same ones aimed at a firm ten times its size, because they’re automated and they don’t care who’s on the other end.

Your business will go through real stages and it will change a great deal along the way. The list of things that have to be true underneath it won’t. That list was true when you had two employees, and it’ll still be true at fifty.

Nothing felt wrong, and that was the trap

Go back to that month and more the attacker spent reading. Through all of it, everything looked normal. Email worked. Invoices went out. Projects moved. Nobody did anything reckless, and nobody had the slightest reason to suspect a thing. The absence of a problem wasn’t evidence that things were fine. It just meant nobody was looking.

This is the part of security that’s hardest to sell and easiest to skip, because the whole value of it is invisible. A stolen password doesn’t announce itself. Someone reading your mail is careful not to be noticed. Unless something is specifically watching your accounts and devices for that kind of behavior, being compromised feels exactly like being fine, right up until it doesn’t.

That’s the piece I’d keep if I could only keep one. Not because it prevents the phish, but because it decides whether you find out in hours or find out from your customer.

What this actually looks like

Think about it the way you think about safety on a jobsite. A hard hat alone doesn’t make a site safe. You need habits, controls, checks, and people paying attention. No single tool protects you either. The layers work together.

Here’s where I’d tell any business to start, regardless of size:

• Multifactor authentication everywhere, email first, then banking, payroll, and accounting. You’re very likely already paying for it and it simply isn’t turned on.
• Protected identities and devices, with something watching them for the behavior described above.
• Employee awareness training. Your people are your detection layer.
• Backups that someone has actually restored from, rather than backups you assume are working.
• A response plan. Decide who you call now, not at six in the morning on a Saturday.

And one that costs nothing. Any change to payment or banking details gets confirmed by phone, on a number you already had, never a number printed in the email. That single distinction is the whole story above. The client did call. They called the attacker. Write the rule down, put it in the file, and make it apply to the owner too, because plenty of these work precisely because the request appears to come from the person nobody wants to question.

That rule is free, it takes five minutes, and on its own it would have stopped the hundred thousand.

The curve doesn’t exist

You will change many times as a business, and you should. But whether you can control access, catch a compromise early, recover your data, and count on your people to pause before money moves is the same question at every size.

So let me go back to where this started. When an owner tells me they have nothing worth stealing, I usually believe them. It is often perfectly true, and it is beside the point. Nothing in that story required the business to hold anything valuable. It took a password, a month of quiet, and a phone number nobody thought to question.

Nobody is grading you against companies your size. Not attackers, not insurers, not the client whose money moves through your inbox. The only question that really matters is whether anyone is responsible for that short list of things that have to be true.

Right now, in your business, you either know who that is or you don’t.

The incident described here is based on a real client situation. Identifying details have been changed.