Why would hackers target my small business?

By Michael Obraitis, Managing Partner, and Michael Dale, CEO·Published August 12, 2026·Last reviewed August 2026·ADAM Pulse Knowledge Base

The short answer: Cybercriminals do not always choose a specific business before attacking it. Automated systems continuously search the internet for exposed devices, vulnerable software, weak credentials, remote access services, and security misconfigurations. Your business can therefore encounter an attack simply because an automated system discovered something it could try to exploit.

That distinction is important.

Many business owners still imagine a cyberattack as a person sitting behind a computer who has researched their company and deliberately decided to break into it.

Sometimes that happens.

But many cyberattacks begin very differently.

The attacker may not know your company name.

They may not know what you sell.

They may not know how many employees you have.

They may not even know what country you operate in.

Their automated tools simply found a digital door worth checking.

And those tools can keep checking doors around the clock.

Why Would a Hacker Target a Small Business?

A better question may be:

Does a hacker actually have to target your business for your business to be attacked?

The answer is no.

Cybercriminals use automated tools to discover systems connected to the public internet. These systems can include servers, routers, firewalls, VPN appliances, websites, remote access systems, cameras, Internet of Things devices, and other infrastructure.

The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, specifically warns that organizations can unknowingly leave vulnerabilities and weaknesses exposed to the internet. CISA identifies misconfigured systems, default credentials, outdated software, remote access technologies, and other internet accessible assets as areas organizations should evaluate and protect.

Think about it like a burglar walking through a neighborhood trying every door handle.

The burglar does not necessarily know who lives in each house.

They are checking for an unlocked door.

Cyber automation changes the scale of that analogy.

Software can perform those checks repeatedly across enormous numbers of internet connected systems.

So the question is no longer simply:

"Why would someone target us?"

It should also be:

"What could an automated attacker discover about us?"

Are Small Businesses Really Targets for Cyberattacks?

Yes.

The Federal Trade Commission states plainly that cybercriminals target companies of all sizes.

The U.S. Small Business Administration similarly warns that small businesses can be attractive targets for cybercriminals and may have fewer resources available to protect their systems.

This creates an important cybersecurity misconception.

Myth:

"We are too small for hackers to care about."

Reality:

An automated attack does not necessarily care how large your company is.

A vulnerable internet facing device at a 20 person company can be discovered just as an exposed device at a 20,000 person company can.

The vulnerability is what matters.

How Do Hackers Find Small Businesses?

One common method is automated internet scanning.

Internet connected systems communicate using Internet Protocol addresses and network services. Certain services may be reachable from outside an organization's network when they are intentionally or accidentally exposed.

Automated scanners can look for these systems.

Attackers may search for things such as:

• Internet facing servers
• Remote access services
• VPN gateways
• Remote Desktop services
• SSH services
• Web applications
• Routers
• Firewalls
• Security appliances
• Cameras
• Internet of Things devices
• Outdated software
• Known vulnerabilities
• Default configurations
• Exposed administrative interfaces

CISA itself uses vulnerability scanning defensively to continuously assess internet accessible network assets for vulnerabilities and risky services.

Attackers can apply the same fundamental concept for a very different purpose:

Find exposed systems and determine whether they can be exploited.

What Is an Automated Cyberattack?

An automated cyberattack uses software to perform activities that otherwise would require a person to do them manually.

Instead of an attacker manually trying one server at a time, automation can help identify large numbers of potential targets.

For example, an automated system might:

1. Discover an internet connected device.
2. Determine what services appear to be running.
3. Identify the type of device or software.
4. Check whether a known vulnerability may apply.
5. Attempt common or compromised credentials.
6. Attempt exploitation.
7. Report successful access.
8. Download additional malicious software.
9. Attempt to establish persistent access.
10. Use the compromised system for additional malicious activity.

Not every scanner is malicious.

Security researchers, search engines, cybersecurity companies, network administrators, cloud providers, and government cybersecurity programs also scan internet connected systems for legitimate reasons.

The important point is that internet exposure creates discoverability.

What Are Hackers Looking for When They Scan the Internet?

There is no single answer, but several categories are particularly important.

1. Exposed Services

A business may have a service accessible from the public internet that does not need to be publicly available.

CISA recommends organizations identify which assets are internet accessible and determine whether that exposure is actually necessary.

If something does not need to be publicly accessible, reducing that exposure can reduce attack surface.

2. Remote Access Systems

Remote access is essential to modern businesses, particularly companies with remote employees, multiple offices, outsourced IT providers, or cloud infrastructure.

But remote access also deserves careful protection.

CISA's ransomware guidance recommends avoiding direct exposure of services such as Remote Desktop Protocol to the internet. Where remote services are required, organizations should apply appropriate security controls.

Remote access should therefore be designed intentionally rather than simply opened because someone needs access.

3. Default Usernames and Passwords

Factory default credentials remain an important security concern.

A router, camera, appliance, server, or other device may arrive with predictable administrative credentials.

If those credentials remain unchanged and the device becomes reachable from an untrusted network, the risk increases significantly.

CISA's Internet Exposure Reduction Guidance specifically recommends changing default passwords on assets that must remain internet accessible.

4. Weak or Reused Passwords

Attackers can also attempt common passwords or credentials obtained from previous breaches.

This is one reason a strong password alone should not always be the only protection standing between an attacker and a sensitive system.

Multifactor authentication adds another layer.

The FTC recommends multifactor authentication as part of small business cybersecurity, while CISA recommends MFA where possible for systems that must remain exposed.

5. Unpatched Software

Software vulnerabilities are discovered constantly.

Once a vulnerability becomes known, organizations and attackers can both become aware of it.

That creates a race.

Defenders need to identify affected systems and apply appropriate updates or mitigations.

Attackers may search for systems that have not yet been fixed.

CISA warns that adversaries can make quick work of unpatched internet accessible systems and recommends rapid remediation of vulnerabilities affecting those systems.

This is why delaying an important security update is not merely a maintenance decision.

It can become a risk decision.

Why Do Old Cybersecurity Vulnerabilities Still Matter?

A vulnerability does not disappear simply because it is old.

If vulnerable systems remain connected to the internet, attackers can continue looking for them.

This is one reason patch management is so important.

A company may think:

"That vulnerability is five years old. Surely nobody is attacking it anymore."

Attackers may think:

"There are probably still systems that were never patched."

Automation makes searching for those remaining systems inexpensive and repeatable.

Cybersecurity teams should therefore care not only about newly announced vulnerabilities but also about older vulnerabilities that remain exploitable within their environment.

CISA maintains a Known Exploited Vulnerabilities Catalog specifically to identify vulnerabilities for which there is evidence of exploitation in the wild.

What Is a Botnet?

A botnet is a collection of compromised devices that can be controlled to perform coordinated activities.

Those devices could include computers, servers, routers, cameras, or other connected systems.

This matters because the device attacking your business may itself belong to an innocent organization or individual whose system was previously compromised.

Instead of imagining:

one attacker → one computer → your company

the real situation may look more like:

attacker or criminal organization → command infrastructure → thousands of compromised devices → thousands of potential targets

This makes simple IP blocking useful in some situations but insufficient as an entire cybersecurity strategy.

Blocking one address does not eliminate the underlying vulnerability.

Can Hackers Attack Routers and Firewalls?

Yes.

Routers, firewalls, VPN appliances, and other network infrastructure are themselves computers running software.

They require:

• Secure configuration
• Software and firmware updates
• Credential management
• Access control
• Logging
• Monitoring
• Vulnerability management
• Configuration review

CISA recommends that network defenders remove unnecessary internet facing infrastructure, monitor infrastructure that must remain accessible, ensure required exposed services are adequately protected, and continuously validate network architecture.

A firewall is extremely important.

But owning a firewall is not the same thing as having a secure network.

Configuration matters.

Updates matter.

Credentials matter.

Rules matter.

Visibility matters.

And monitoring matters.

Can Security Cameras and IoT Devices Be Hacked?

Any internet connected device can potentially introduce security risk if it contains exploitable vulnerabilities, weak credentials, insecure configurations, or unnecessary exposure.

That includes devices businesses may not traditionally think of as "computers."

Examples can include:

• Security cameras
• Network video recorders
• Building access systems
• Digital signage
• Printers
• Environmental sensors
• Point of sale related devices
• Smart building systems
• Industrial equipment
• Routers and wireless equipment

CISA specifically includes Internet of Things and industrial Internet of Things systems in its internet exposure guidance.

This is why organizations should maintain an inventory of connected devices and understand which ones can communicate outside the network.

You cannot adequately protect equipment you do not know exists.

Does a Firewall Stop Hackers?

A properly configured firewall is a critical cybersecurity control, but a firewall should not be viewed as a magical barrier that makes everything behind it secure.

A firewall controls network traffic according to configured rules.

Problems can still occur when:

• An unnecessary service has intentionally been exposed
• A firewall rule is overly permissive
• Credentials are compromised
• A VPN appliance contains a vulnerability
• An administrator interface is exposed
• Software is outdated
• A cloud resource sits outside the traditional perimeter
• A user falls for phishing
• Malware communicates through permitted traffic
• A third party connection becomes compromised

Modern cybersecurity therefore relies on layers of protection rather than one device.

How Do I Know if Someone Is Trying to Hack My Network?

This is where visibility becomes extremely important.

Organizations can use multiple sources of information to identify suspicious activity, including:

• Firewall logs
• Authentication logs
• Failed login attempts
• Endpoint security alerts
• Network monitoring
• Vulnerability scanning
• Intrusion detection
• DNS activity
• VPN logs
• Cloud security logs
• Threat intelligence
• Traffic anomalies
• Configuration changes

One failed login does not necessarily mean your company is under a sophisticated targeted attack.

Likewise, simply seeing an unfamiliar IP address does not automatically mean it is malicious.

Security monitoring requires context.

The goal is to determine:

What happened?

Where did it happen?

Is it expected?

Is the source suspicious?

Was access successful?

What changed?

What should happen next?

Why Continuous Monitoring Matters

Cybersecurity is not a one time project.

Networks change.

Employees change.

Applications change.

Firewall rules change.

Vendors change.

Cloud environments change.

Devices get replaced.

New vulnerabilities are discovered.

New remote access requirements appear.

CISA recommends routine assessments of internet accessible assets because an organization's environment evolves over time.

This leads to an important principle:

> A network that was secure when it was configured is not automatically secure today.

Organizations need a process for continually identifying changes, vulnerabilities, outages, anomalies, and potentially suspicious behavior.

Attackers Automate Discovery. Defenders Need to Automate Visibility.

This may be one of the most important changes in how businesses should think about cybersecurity.

Attackers use automation because automation provides scale.

Businesses should use automation for the same reason.

Security and network monitoring can help organizations continuously watch infrastructure rather than relying exclusively on someone manually checking systems.

Automation can help identify:

• Device availability changes
• Network connectivity problems
• Unexpected configuration changes
• Vulnerable systems
• Suspicious authentication activity
• Internet service failures
• Performance anomalies
• Security alerts
• Unexpected exposure
• Repeated failures

But automation should not eliminate people from the process.

The more useful model is:

Automation detects.

Context helps validate.

People investigate.

Processes determine escalation.

Teams remediate.

What Should a Small Business Do to Reduce Its Risk?

No cybersecurity program can guarantee that an organization will never experience an attack.

The objective is to reduce unnecessary exposure, make successful attacks more difficult, detect problems earlier, and respond effectively when something happens.

A practical starting point is:

1. Know what you have.

Maintain an inventory of computers, servers, routers, firewalls, applications, cloud services, cameras, IoT devices, and other technology.

2. Know what is exposed.

Determine which systems and services are accessible from the public internet.

3. Remove unnecessary exposure.

If something does not need to be publicly accessible, restrict or remove that access.

4. Change default credentials.

Never rely on factory default administrative credentials.

5. Use multifactor authentication.

Especially protect remote access, administrative accounts, email, cloud platforms, and other sensitive systems.

6. Patch systems promptly.

Pay particular attention to vulnerabilities affecting internet facing infrastructure and vulnerabilities known to be actively exploited.

7. Protect remote access.

Review VPNs, Remote Desktop, SSH, remote administration platforms, and third party support access.

8. Review firewall configurations.

Remove obsolete rules and verify that exposed services remain necessary.

9. Monitor important systems.

Collect enough information to recognize outages, abnormal behavior, failed access attempts, configuration changes, and security events.

10. Have an incident response process.

Know who should be contacted, what should be isolated, what information should be preserved, and how incidents should be escalated.

The Question Every Business Should Be Asking

Cybersecurity discussions often begin with:

"Why would anyone attack us?"

That question assumes a person has to choose your company before an attack begins.

That is no longer a safe assumption.

A better set of questions is:

What parts of our technology environment are visible from the internet?

Are we exposing anything unnecessarily?

Are our systems properly patched and configured?

Are administrative and remote access systems protected by MFA?

Would we recognize suspicious activity if it happened tonight?

Who would investigate the alert?

How quickly could we respond?

You cannot stop someone on the internet from checking whether a digital door exists.

You can make sure that door is properly secured.

You can reduce the number of doors you expose.

You can monitor the doors that need to remain accessible.

And you can have a plan for what happens when someone tries to get through one.

How USA Telecom and ADAM Approach Network Visibility

USA Telecom helps organizations improve visibility into the technology infrastructure their businesses depend upon.

The ADAM platform and associated USA Telecom services are designed around a straightforward principle:

Problems are easier to address when you know they are happening.

Monitoring can help provide earlier awareness of network outages, connectivity changes, infrastructure problems, and other conditions that deserve investigation.

Combined with sound cybersecurity practices, properly configured firewalls, vulnerability management, secure remote access, endpoint protection, strong identity controls, and disciplined escalation procedures, monitoring becomes another important layer in a business's operational and security posture.

The objective is not to create fear about what might be happening on the internet.

It is to create visibility into what is happening within the environment you are responsible for.

Key Takeaway

Your business does not have to be specifically selected by a hacker to encounter a cyberattack.

Internet connected systems can be discovered automatically.

Vulnerabilities can be searched for automatically.

Credentials can be tested automatically.

And those activities can happen whether your office is open or closed.

That is why modern cybersecurity depends on reducing exposure, maintaining systems, protecting identities, continuously monitoring critical infrastructure, and having people and processes ready to respond.

The bots do not need to know your company name.

They only need to find an opportunity.

Frequently asked questions

Sources

• CISA — Internet Exposure Reduction Guidance. Evaluating necessity of exposure, and removing or restricting access to assets that do not need to be internet accessible.
• CISA, NSA, FBI and MS-ISAC — #StopRansomware Guide (v3.1, October 2023). Limiting RDP exposure, MFA on remote access, network segmentation, centralized logging and prioritized patching.
• CISA — Known Exploited Vulnerabilities (KEV) Catalog. Only vulnerabilities with reliable evidence of active exploitation in the wild; scanning activity and public proof-of-concept releases do not qualify.
• CISA — Cyber Hygiene Services. Free vulnerability and web application scanning for enrolled federal, SLTT and critical-infrastructure organizations.
• NIST — NIST Cybersecurity Framework 2.0: Small Business Quick-Start Guide (NIST SP 1300, February 2024).
• FTC — Cybersecurity for Small Business, including the Understanding the NIST Cybersecurity Framework fact sheet.
• U.S. Small Business Administration — Strengthen your cybersecurity.

USA Telecom Consulting LLC is a Service-Disabled Veteran-Owned Small Business running a 24/7 NOC. We monitor networks, circuits and firewalls for regulated and defense-supply-chain organizations.

← More from the ADAM Pulse Knowledge Base

Prepared by ADAM Pulse (USA Telecom Consulting LLC) — managed AI governance, network, and NOC services. Support: (888) 989-4872 · support@adampulse.us