Is a small business really a target for hackers?

Most attacks are automated and indiscriminate. Nobody chose your business. Scanners find an exposed service or a password that appeared in a breach, and the attack proceeds without a human deciding you were worth the effort.

Small businesses are attractive precisely because they are usually less defended and they have real money moving through them. The most common expensive event we see is not dramatic ransomware, it is a compromised email account used to redirect a payment.