Why Small Businesses Are Targets for Ransomware

Ransomware is a business model, not a targeted campaign

Most ransomware today is delivered through a ransomware-as-a-service model, where a core group develops the encryption software and negotiation infrastructure, then rents it out to affiliates who carry out the actual attacks in exchange for a cut of any ransom paid. This turns ransomware into a volume business, where affiliates are incentivised to compromise as many organisations as possible, not to carefully select a handful of prestigious victims.

The Canadian Centre for Cyber Security has described ransomware as one of the most disruptive threats facing Canadian organisations of all sizes, precisely because of this scalable, affiliate-driven model.

Initial access brokers do the scouting

A separate criminal specialty has emerged around simply finding and selling access. Initial access brokers scan the internet for exposed remote desktop protocol, unpatched VPN appliances, and other easy entry points, then sell that access on criminal marketplaces to whoever is willing to pay, often ransomware affiliates.

This means the business that gets compromised is frequently chosen by an automated scan that found a vulnerability, not by a person who researched the company and decided it was worth attacking. Being small, low-profile, or non-newsworthy provides no protection against a scanner.

Exposed RDP and VPN are still common entry points

Remote desktop protocol left open directly to the internet, often set up years ago for a legitimate remote work need and never revisited, remains one of the most consistently abused entry points. The same applies to VPN appliances running outdated firmware with known vulnerabilities.

Small businesses are statistically more likely than large enterprises to have this kind of legacy exposure, simply because they are less likely to have a dedicated security team reviewing what is internet-facing.

Unpatched edge devices widen the door

Firewalls, VPN gateways, and other internet-facing appliances occasionally have serious vulnerabilities disclosed, and attackers move quickly once a vulnerability becomes public, sometimes within days. An unpatched edge device does not need a human attacker to notice it, it needs an automated scanner running the same exploit against thousands of IP addresses.

This is why patch management is not just an IT hygiene issue but a direct ransomware prevention control, covered in more depth in how to protect your business from ransomware.

Why 'we are too small' does not hold up

The reasoning behind "we're too small" usually assumes a human attacker deciding whether a target is worth the effort. Ransomware-as-a-service affiliates and initial access brokers do not work that way. Their tools do not know or care how many employees a business has; they care whether a system is reachable and vulnerable.

Small businesses can also be attractive precisely because they often have fewer defensive layers than a large enterprise, and because a smaller ransom demand is still more likely to be paid quickly to avoid extended downtime, which keeps the model profitable at scale.

What actually reduces the odds

Since most of this activity is automated scanning rather than targeted selection, the goal is to not be the easy result the scan finds. Closing exposed remote access, keeping edge devices patched, enforcing MFA, and maintaining tested offline backups all address the specific mechanics described above rather than a vague notion of "being more secure." Our cybersecurity checklist for small businesses and most common cybersecurity threats articles go further into prioritisation.

Sources and further reading

• Canadian Centre for Cyber Security: Ransomware
• Canadian Centre for Cyber Security: National Cyber Threat Assessment

Frequently asked questions