If your business carries insurance, an attacker already knows you can pay. Here is how they pick targets, what they are actually after, and why no single tool will stop them.
The Assumption We Hear Most Often
“We’re not a bank.” “We don’t move large amounts of money.” “Nobody is going to bother with our systems.” We hear some version of this in almost every conversation about security, and it is an understandable way to think. It also rests on one costly misunderstanding: that an attacker picks you, specifically, before deciding to attack.
Most don’t. They run automated scans, feed stolen credentials into login pages, and rent ready-made phishing kits by the month. Initial access is often opportunistic, so an attacker does not need to know who you are. They need to know what you are running.
You Don’t Have to Be Interesting, You Have to Be Reachable
That describes nearly every business now: a public website, Microsoft 365 mailboxes, remote access for staff who work from home, and a firewall with something behind it worth reaching. Reachable is the only qualification that matters at the start.
Here is the part that is easy to miss, though. Malicious attackers are not only counting on you having money. They are counting on you having insurance. A business with coverage, a payroll it cannot miss and a client list it cannot lose is a business that will pay to make a problem go away, and ransomware operators research exactly that before they set a demand: revenue, headcount, cyber coverage limits.
So if you are a successful business carrying insurance, you are not a low-value target. You are a priced target. The insurance you bought to protect you from a bad year is part of what makes you worth the attacker’s time.
What Attackers Are Actually After
- Money, moved quickly. Ransomware, invoice fraud, and payment details switched in an email thread you were already having.
- Credentials and data. A mailbox is a filing cabinet of contracts, payroll and client records, and it is also the account every password reset funnels through.
- Time. For many businesses the disaster is not the theft, it is the days of trading lost while systems are rebuilt, and the customers who quietly do not come back.
- A way in to someone bigger. A small supplier with a trusted connection to a large client is a route past that client’s front door.
This is why a relaxed security posture is not neutral. It is a discount. An attacker who spends an hour on reconnaissance and finds no MFA, an unpatched remote access appliance and a firewall rule nobody can explain has found a business where half the work is already done. Hardening is not about making yourself unbreakable. It is about being more expensive to break than the business next door.
Security Isn’t a Product, It’s Layers, Each One Assuming the Last Has Failed
Cybersecurity is not a single piece of software or a policy written down once. Proper security is an onion: layers of overlapping monitoring, detection and prevention, built on the understanding that any one of them can be beaten. Multi-factor authentication protects your Microsoft 365 accounts. Conditional Access policies make sure MFA is enforced on every new sign-in, not just the first. Identity Protection watches those sign-ins and compares them against patterns to spot the one that does not belong. Your firewall filters traffic in and out so only legitimate traffic passes. Endpoint detection and response (EDR) on every workstation scans for the file that got past the firewall anyway. Servers are hardened and segmented so that a foothold on one machine does not become a path to all of them.
| Layer | What it does | What it assumes has already failed |
| Identity | MFA, Conditional Access, Identity Protection | The password alone is no longer proof of anything |
| Filtering, attachment scanning, external-sender warnings | Someone will still click it | |
| Network | Firewall, segmentation, restricted outbound traffic | Something inside is already compromised |
| Endpoint | EDR on every workstation | The firewall let through what it should not have |
| Server | Hardening, least privilege, just-in-time admin | Credentials have leaked somewhere |
| Backup | Immutable, offline copies, restore testing | Every layer above this one |
| People | Security awareness training and clear reporting habits | The attacker will talk to a human before a machine |
Read the right-hand column slowly, because it is the whole point. Every layer is designed around the assumption that the one before it did not hold. Each layer is there to contain, isolate and slow down an infection that is already inside, to give someone time to notice and time to respond. A single control is a hope. A stack is a plan.
The Two Layers Most Often Skipped
Backups come first, because ransomware’s entire leverage is your recovery time. Attackers now go for the backups before they go for the servers, which means a backup that lives on the same network, under the same admin account, with the same password, is not a backup. What counts is a copy that is immutable or offline, kept somewhere the compromised account cannot reach, and a restore that has actually been run and timed. A backup you have never restored is a hope, not a control.
That is the shape of EnVault, our backup system. It is hardened, so the backup infrastructure itself is not an easy route in. It is separated from the environment it protects, so a compromised account cannot reach the copies it would most like to delete. And it is tested automatically, so a restore is proven rather than assumed. The point is not that a backup exists. It is that the backup is still there on the day you need it.
Admin rights come second. A standing domain administrator account is a single point of total failure, and it is the first thing an attacker looks for once they are inside. The better pattern is that nobody holds admin rights day to day: they are issued just in time, for a limited window, for a specific task, and the permanent accounts stay disabled as break glass only. If nobody can tell you who holds domain admin right now, that is the finding.
We have moved fully to that model. Administrative accounts are not left enabled day to day; access is issued just in time and expires on its own. Any account that does get enabled is monitored, and enabling one raises an alert, so it is disabled again rather than left standing. The same reasoning applies down at the desk: every endpoint uses LAPS, so the local administrator password is unique to that machine and rotated for you, instead of being one password someone set once that half the company quietly knows.
AI Didn’t Invent New Attacks, It Made the Old Ones Cheap
AI has quickly become an invaluable tool in many businesses, whether that is composing emails or writing custom software. Malicious actors have been just as busy with it, and the effect is not a new category of attack so much as a collapse in the cost of the old ones.
- Phishing lost its tells. Clumsy grammar and odd phrasing used to be the giveaway. A fluent, correctly branded email written in your own industry’s language is now cheap to produce at scale.
- Voice became forgeable. A convincing call from an owner who is travelling, in their own voice, asking for a payment to be released, is no longer a plot device. A short recording of someone accepting an award or leaving a voicemail is enough material.
- Exploits arrive faster. AI is very good at finding flaws in code, and that research does not stay on the defensive side.
A note on one word, because it gets used loosely. A zero-day is a flaw the vendor does not know about yet and has no patch for. What most real attacks actually use is an n-day: a flaw that was disclosed and patched months ago, on a system where nobody applied the fix. Both are on the rise as AI accelerates vulnerability research, but only the second one is something you can act on this week, and acting on it is unglamorous and effective.
The same capability works in the other direction. It is what lets modern detection tools spot a login that used the right password from the wrong place at the wrong hour, or a mailbox rule that quietly forwards invoices to an outside address. Detection is no longer a person reading logs; it is a model comparing behaviour, backed by people who act on what it finds.
The Inconvenient Trade-Off
Some of what we do makes your tools less convenient. Features get restricted or switched off, and occasionally someone asks why we are making their job harder. The honest answer is that a feature convenient for your staff is convenient for anyone who has their password. Blocking a convenience is not a judgment about your team; it is an acknowledgment that trust is not a security control. Where we can, we replace a risky shortcut with a safe one, and where we cannot, we would rather you be mildly annoyed on a Tuesday than have a very bad month.
What Good Actually Looks Like
None of this needs to be complicated to check. A well-run business can answer yes to most of the following without going to look it up.
- [ ] MFA on every account that can reach email, files or money, and a phishing-resistant method on the accounts that matter most
- [ ] Patches applied on a schedule you could name, including firewalls, remote access and anything with a login page facing the internet
- [ ] Backups that are immutable or offline, and a restore that has been tested and timed in the last year
- [ ] No standing administrator rights; access issued just in time and logged
- [ ] Detection you actually review, with someone on the hook to act on it at 2am
- [ ] Staff who know how to report a strange email in one click, and do it without embarrassment
The Only Question That Matters
The useful question is not “would anyone attack us?” It is “if someone did, how long would we be down, and how much would we pay to come back?” For most businesses those two numbers are the whole argument, and they are usually larger than anyone expected.
Attackers are not looking for the most interesting company in your industry. They are looking for the one with a relaxed posture and a reason to pay. If you would like to know which layers you already have and which ones are still assumptions, ask us, and we will show you rather than tell you.
Director of Operations
