Small isn't safe. Small is cheap.

The most dangerous sentence in small business security is one I hear all the time in Wyoming:

"I'm too small to matter."

I get why it feels true. Why would anyone bother with a fifteen-person shop in Laramie when Amazon exists? But that logic pictures a human attacker choosing one target, like a movie heist. That's not how any of this works anymore.

The actual math

Economists worked this out decades ago (look up the Gordon-Loeb model if you want the academic version). Your risk comes down to three things:

1. Attack surface: how many ways in. Every login, every inbox, every employee.
2. Incentive: how worth it you are. Not to a mastermind. To a script.
3. The pool that's even looking. And this is the one that just changed.

The first two are about you. The third is about the world, and AI multiplied it. Phishing used to take a human writing emails. Now one person runs tooling that probes thousands of businesses at once, around the clock, for pennies. You were never hiding because you were small. You were hiding because attacking you wasn't worth a human's time. It no longer requires a human's time.

The numbers back this up: 46% of small businesses were hit by AI-generated phishing in the last twelve months, per VikingCloud's 2026 report. Not big companies. Small ones.

Think unlocked cars, not bank vaults

Nobody plans a heist on a fifteen-person shop. But a thief walking a parking lot checking door handles doesn't care what kind of car it is. He cares which one is unlocked.

A big corporation is a bank vault: hard to crack, big payoff. You're a car in the lot. And the question that matters isn't "am I a fancy car?" It's "am I locked?"

The relief

Here's the part I always land on in class, because the point of this isn't fear.

You don't need to be un-robbable. You just need to not be worth the trouble. When the attack is automated and cheap, the attacker's whole business model is volume. They don't pick locks. They try handles. Two-factor authentication on your important accounts, a team that knows to pause on urgent money requests, basic password hygiene: that's a locked door. The script moves to the next car.

Next Thursday: what those automated attacks actually look like when they arrive, including one that happened just up the road in Gillette.

-Thayne