Most breaches do not begin with a genius in a hoodie defeating a firewall. They begin with something ordinary: a password reused across three accounts, a server that missed an update, a contractor whose login still works two years after the job finished.

That is the uncomfortable part. Attacks rarely succeed because a business was careless. They succeed because a small, unremarkable weakness sat unaddressed while everyone got on with their work. Understanding how hackers target businesses is not about becoming a security specialist. It is about recognising the handful of gaps attackers look for first.

Key takeaways

• Attackers choose targets by opportunity rather than size, scanning automatically for exposed systems instead of hand-picking companies.
• Phishing is still the most common entry point, recorded by the OAIC as the leading cyber incident type behind reported breaches.
• Weak passwords are a security risk because reuse hands attackers a working login rather than a break-in they have to engineer.
• An unpatched systems vulnerability on anything internet-facing is one of the fastest routes in, which is why critical patches are expected within 48 hours.
• Poor access control turns one compromised account into a whole-network problem; least privilege and prompt offboarding are the core access control best practices.
• The most common security vulnerabilities in business are known and fixable, so regular assessment matters more than buying new tools.

How attackers actually choose their targets

Very few small and medium organisations are singled out. Attackers scan the internet for specific conditions: an open remote desktop port, a firewall running old firmware, a login page without multi-factor authentication. Only once something responds does a human get involved and ask what this organisation holds.

That is why “we are too small to be a target” has stopped being true, and why growing businesses now face the same advanced threats as large enterprises. According to ASD’s Annual Cyber Threat Report, the average self-reported cost of cybercrime for a small business rose 14 per cent to roughly $56,600 per report.

Phishing and social engineering: still the front door

Phishing works because it targets the one part of your environment that cannot be patched. The OAIC’s most recent full breach report recorded phishing as the most reported cyber incident type at 34 per cent, ahead of ransomware at 24 per cent and compromised credentials at 21 per cent.

 

Generative AI has also stripped out the tells people were trained to spot, so poor grammar and clumsy logos no longer give an attacker away. The costliest variant is business email compromise: an attacker watches a mailbox, waits for a genuine invoice conversation, then interrupts it with new bank details. Nothing looks wrong, because until that moment nothing was. Two controls handle most of this — verify payment changes by phoning a number you already hold, and require a second approver above a set value.

Weak passwords are a security risk you can measure

The most efficient attack is not an attack at all. It is a login.

When a staff member reuses a password across a personal shopping site and the company email, a breach at that site hands an attacker working credentials, and automated tools then test them against hundreds of business services. That is why the weak passwords security risk is really a reuse problem rather than a complexity problem. Information-stealing malware makes it worse by lifting saved passwords and session cookies straight from browsers.

The fix is unglamorous: move staff to long passphrases rather than short complex passwords, issue a password manager, and enable multi-factor authentication on email, remote access and finance systems first. Several other practical ways to minimise cyber threats follow the same principle: low effort, high return.

Unpatched systems and the equipment nobody owns

Every piece of software eventually has a flaw published against it. From that moment the details are public, and automated exploitation usually follows within days.

An unpatched systems vulnerability is most dangerous on anything facing the internet, because a weakness in a firewall, VPN appliance or remote access gateway exposes everything behind it. The Essential Eight mitigation strategies set the expectation plainly: patch internet-facing services within two weeks, or within 48 hours where the vulnerability is critical or a working exploit exists.

The harder problem is ownership. Laptops and servers get updated because someone is responsible for them. The switch installed by a previous provider, the wireless controller in the ceiling, the old accounting server kept running “just in case” — those quietly fall years behind. You cannot patch what nobody has written down.

Poor access control turns one account into every account

Once inside, an attacker’s next move is to see how far the stolen account can reach, and that distance is set entirely by your access controls.

Most organisations grant permissions generously and remove them rarely. Staff change roles and keep old access. Contractors finish projects and keep their logins. Everyday accounts hold administrator rights because it was easier at the time. Together, those small decisions mean one phished password reaches finance records and backups.

Sound access control best practices are straightforward:

• Grant the least access a role genuinely needs, and review it when people change jobs.
• Separate administrator accounts from day-to-day accounts, so routine browsing never runs with elevated rights.
• Disable accounts the day someone leaves, including supplier and third-party logins.
• Protect physical entry too, because server rooms and comms cabinets deserve the same discipline as digital systems — this is where access control systems earn their place.

Common weaknesses, how they are exploited and what closes them

Common weakness	How attackers exploit it	What closes the gap
Phishing and business email compromise	Watch a mailbox, join a genuine invoice thread and redirect the payment	Phone verification of payment changes; a second approver above a set value
Weak or reused passwords	Test credentials leaked elsewhere against business logins; lift saved passwords and session cookies from browsers	Long unique passphrases, a password manager, and MFA on email, remote access and finance systems
Unpatched internet-facing systems	Exploit a published flaw in a firewall, VPN appliance or remote access gateway to reach everything behind it	Patch within two weeks, or 48 hours when critical or actively exploited; keep an accurate asset list
Excessive access and dormant accounts	Move from one stolen login to finance records, customer data and backups	Least privilege, separate administrator accounts, and disable logins the day someone leaves

 

What these weaknesses actually cost

The damage is rarely the ransom. It is the fortnight of disrupted trading, the invoices paid into the wrong account, the investigation and the customer notifications. Breach volumes are still climbing: the OAIC recorded 1,205 data breach notifications in 2025, an 8 per cent rise and the highest annual figure since mandatory reporting began.

Reputational cost lands hardest on smaller organisations, and recovery depends on preparation that already exists, which is why security, backup and connectivity work together as three pillars rather than as separate purchases.

Turning known weaknesses into a plan

You do not need an enterprise budget to become a harder target. You need to close the gaps attackers actually use, in order:

1. Enable multi-factor authentication everywhere, starting with email, remote access and financial systems.
2. Patch on a schedule that includes network hardware, not just computers.
3. Build an asset list so nothing sits unowned and unmonitored.
4. Review who has access to what, and remove what is no longer needed.
5. Isolate and test your backups, because an untested backup is an assumption.
6. Train staff on payment verification, which stops the costliest attacks outright.

The small business cyber security guide published by the national cyber security centre maps closely to this list and is free to work through.

Being proactive matters because reactive security arrives as a single, badly timed bill. Patching a firewall takes an afternoon; recovering from an intrusion through that firewall takes weeks.

How ICTechnology can help

Knowing where weaknesses usually sit is one thing; finding yours is another. ICTechnology works with small and medium businesses to identify and close those gaps in a way that suits real budgets and real teams.

Through managed cyber security services and vulnerability assessment services, the team can review your environment for missing patches, exposed services, weak authentication and excessive permissions, then prioritise findings by real risk rather than by alarm level. That work typically covers monitoring, patch management, access control reviews, firewall and network security, backup oversight, staff training and incident response.

Security is not a project that finishes; it is a set of habits that need maintaining. Having engineers and consultants who notice an unusual login at six in the morning is a large part of why businesses stay with ICTechnology.

Frequently asked questions

How do hackers target businesses?

Hackers target businesses mainly through automated scanning rather than deliberate selection. Tools sweep the internet for exposed remote access, unpatched systems and logins without multi-factor authentication, then attackers follow up on whatever responds.

What are the most common security vulnerabilities in business?

The most common security vulnerabilities in business are phishing susceptibility, weak or reused passwords, missing multi-factor authentication, unpatched software and network equipment, excessive user permissions, and unmonitored supplier access. Almost all are fixable without specialist tools.

Why are weak passwords such a serious security risk?

Weak passwords are a serious security risk because reuse turns any unrelated breach into a working login for your systems. Attackers test leaked credentials against business email and cloud platforms automatically. Long unique passphrases, a password manager and multi-factor authentication remove most of that exposure.

What happens if you ignore unpatched systems?

Ignoring an unpatched systems vulnerability leaves a publicly documented flaw open to automated exploitation, often within days of disclosure. Internet-facing devices such as firewalls, VPN appliances and remote access gateways carry the highest risk, because compromising one exposes everything behind it.

What should a small business do first to improve access control?

A small business should start by removing administrator rights from everyday accounts, disabling logins for departed staff and contractors, and reviewing who can reach financial and customer data. Least privilege costs nothing and limits how far a compromised account travels.

When should a business seek professional IT support for security?

A business should seek professional support when it holds customer or payment data, relies on systems it cannot afford to lose, has staff working remotely, or has never had its environment formally assessed. Assessment before an incident is far cheaper than investigation afterwards.

Final thoughts

The weaknesses attackers rely on are not exotic. They are the everyday gaps that accumulate in any organisation with real work to do: a password reused, an update deferred, an account left active, a device nobody claimed.

That is genuinely encouraging, because it means the fix is within reach. Multi-factor authentication, consistent patching, least privilege access and staff who know how to verify a payment request will stop the large majority of attacks aimed at businesses of your size. What separates organisations that recover quickly from those that struggle is rarely budget — it is knowing where their weak points are before someone else does. If you are unsure where yours sit, a short conversation with ICTechnology is a sensible place to start.

Interested in a quote and consultation? Reach out to: [email protected]

Need managed cyber security support? Please reach out! [email protected]

Any other enquiries? Fill out our contact form here.