When people picture a cybercriminal, they often imagine someone working alone in a dark room, targeting banks, governments and major corporations.
It is an image that belongs to another era.
Today, cybercrime is organised, well-funded and increasingly sophisticated. The people behind it are not only looking for one major payday. They are running campaigns at scale, searching for businesses that are easier to access and more likely to be caught unprepared.
That was one of the clearest lessons from our recent Ballarat Cyber Sip event.
We were honoured to welcome Paul Barge from Kaseya as one of our guest speakers. Paul brought decades of experience in the technology sector, including 15 years with Microsoft, and has spent the past several years focused closely on cybersecurity.
It was a fantastic session. Paul managed to make a serious and sometimes confronting subject practical, engaging and relevant to the people in the room.
Most importantly, he challenged a belief that still leaves many smaller businesses exposed:
“We’re too small for anyone to bother targeting us.”
Unfortunately, that is no longer how cybercrime works.
Cybercrime has become a global industry
Paul began by putting the scale of the problem into perspective.
Cybercrime is no longer a collection of isolated scams carried out by a few technically gifted individuals. It now operates like a major industry.
The organisations behind these attacks can have development teams, sales targets, marketing functions and support processes. They study different industries, identify opportunities and build campaigns around the businesses they believe will be most vulnerable.
A criminal group may target medical practices, real estate agencies, professional service firms or small manufacturers. They do not need to know the owners personally. They do not need to have a grudge against the business.
They simply need to believe there is money to be made.
That money may come from a ransom. It may come from redirecting an invoice, stealing customer details or selling compromised credentials. Sometimes the most valuable thing is not even the business itself, but the access it provides to customers, suppliers or larger organisations.
This is why the old assumption that cybercriminals only pursue large companies has become so dangerous.
Smaller businesses can be easier targets
Large organisations tend to understand that they are targets.
They often have internal IT teams, dedicated security specialists and formal processes for responding to incidents. That does not make them invulnerable, but it does mean an attacker may need more time, effort and resources to get through.
Smaller businesses frequently have the same types of valuable information without the same level of protection.
They may hold:
- Customer contact details
- Financial records
- Employee information
- Health or personal data
- Supplier banking details
- Confidential contracts
- Access to cloud systems and shared networks
The size of the organisation does not make that information less valuable.
In fact, a smaller business can be attractive precisely because its security may be less mature. The systems may have developed gradually over time, staff may not receive regular awareness training, and there may be no clear incident response plan.
From a criminal’s perspective, that can make the business low-hanging fruit.
Paul shared that a significant proportion of cyberattacks now focus on small and medium-sized businesses. His message was not intended to create panic. It was intended to correct a dangerous misunderstanding.
Being small does not make you invisible.
The real cost is rarely limited to stolen money
When business owners think about cybercrime, they often focus on the ransom or the amount that may be transferred from an account.
Those costs can be serious, but they are only one part of the damage.
A cyber incident can also bring the business to a standstill.
If staff cannot access files, email, customer systems or production software, they may not be able to work. Orders can be delayed. Customers may be left waiting. Suppliers may not be paid on time.
The business may also need to bring in legal advisers, forensic specialists, insurers and communications support.
Then there is the reputational impact.
In a regional community such as Ballarat, trust is personal. Customers know the people behind the business. They may have worked with them for years or recommended them to others.
When sensitive information is lost or operations are disrupted, the effect can travel well beyond the technical issue itself.
Even after systems have been restored, the business may still be dealing with questions from customers, uncertainty among staff and damage to relationships that took years to build.
That is why cybersecurity should not be viewed as an IT problem alone.
It is a business continuity issue, a financial issue and a leadership issue.
Every business has something worth protecting
One of the most useful takeaways from Paul’s presentation was the reminder that cybercriminals do not need every target to be a large organisation.
Every business holds something of value.
A medical practice holds patient information.
An accounting firm holds financial data.
A not-for-profit may hold sensitive details about clients and donors.
A real estate agency handles identification documents and large financial transactions.
A local trades business may have access to customer addresses, payment details and email conversations about upcoming jobs.
Even a business with relatively little sensitive data still depends on its technology to operate.
If email, accounting software, booking systems or shared documents become unavailable, the impact can be immediate.
The question is not whether your data would make headlines.
The question is whether losing access to it would affect your ability to operate.
For most businesses, the answer is yes.
Cybercriminals are looking for ordinary human moments
Paul also spoke about how many successful cyberattacks begin.
It is rarely a dramatic technical breach that someone could see coming.
Often, it begins with a normal moment during a busy day.
Someone receives an email that looks familiar. They are dealing with several things at once, so they click the link.
A staff member receives a message that appears to come from a supplier asking for bank details to be updated.
An employee uses the same password across several services, and one of those services is later compromised.
These incidents do not happen because people are stupid or careless.
They happen because the attacks are designed to feel legitimate, urgent and routine.
Paul shared his own experience of clicking a malicious link, despite having worked in technology for many years. He realised something was wrong before entering further information and was able to get support involved quickly.
His willingness to share that story was valuable because it made the risk real.
Cyber awareness is not about assuming that knowledgeable people never make mistakes.
It is about recognising that anyone can be caught at the wrong moment and building protections around that reality.
Why planning matters before anything goes wrong
Paul asked a simple question during the presentation:
What would you do if a ransomware message appeared on your screen tomorrow?
Who would you call?
Which systems would need to be shut down?
How would you communicate with your staff?
Would customers need to be notified?
Most businesses have a fire plan. They know where the exits are and who is responsible during an emergency.
Cyber incidents require the same kind of preparation.
The worst time to develop an incident response plan is while the incident is already unfolding.
By that point, people are stressed, information is incomplete and every decision feels urgent.
A basic plan can provide clarity when it is needed most. It should identify the first people to contact, the immediate steps required to contain the issue and the responsibilities of key staff.
It should also be tested.
A document saved somewhere on a shared drive may not be particularly helpful if the shared drive is no longer accessible.
Training is part of the protection
Technology plays an important role in cybersecurity, but it cannot remove every risk.
People still receive messages, approve payments and work with sensitive information.
Regular awareness training helps staff recognise the techniques criminals are using now, rather than relying on outdated ideas about what a scam looks like.
Phishing simulations can also give businesses a clearer picture of where the risk sits.
This is not about catching employees out.
It is about identifying the people who may need additional support and giving everyone an opportunity to practise before they are faced with a real attack.
The strongest security culture is one where staff feel comfortable reporting a mistake immediately.
If people are afraid they will be blamed, they may try to fix the issue themselves or hope that nothing happens.
That delay can give an attacker more time.
A fast report gives the IT team a better chance of containing the threat before it becomes a larger incident.
Good cybersecurity does not require panic
The purpose of Paul’s presentation was not to suggest that every small business needs an enormous security department.
It was to encourage businesses to understand the risk and take sensible, proportionate steps.
That might include:
- Using multifactor authentication
- Improving password practices
- Keeping systems and applications updated
- Training staff regularly
- Backing up important information properly
- Monitoring for compromised credentials
- Creating and testing an incident response plan
- Working towards an appropriate cybersecurity framework
The right approach will depend on the business, the information it holds and the consequences of downtime.
What matters is that these decisions are made deliberately.
Cybersecurity should not be left to chance simply because the business has never experienced a serious incident before.
Why this matters to us
At eManaged, events such as Ballarat Cyber Sip are about more than talking about technology.
They give local businesses access to practical information that can help them make better decisions, protect their people and strengthen their organisations.
We were incredibly grateful to Paul Barge for joining us and sharing his experience. His presentation made one point especially clear:
Cybercrime is not only a problem for large corporations.
Small and regional businesses are being targeted, and the consequences can be significant.
The good news is that businesses do not have to become cybersecurity experts themselves.
They do need to understand where they are exposed, what protections are already in place and what needs to happen next.
That is where the right technology partner can make an enormous difference.
At eManaged, we work with businesses to understand their risks, strengthen their systems and build a practical plan that fits the organisation rather than applying a one-size-fits-all approach.
Because your business may be smaller than a bank or a national retailer.
But it is not too small to protect.
Talk to eManaged about how prepared your business is for today’s cybersecurity risks.