Marc Haine explains why small businesses are increasingly targeted: over 75% of breaches now come from stolen credentials, not hacked systems. Attackers use phishing emails, texts, and AI-generated deepfake videos to trick people into giving up login details. Security training budgets are the difference between staying safe and becoming a target.
Small businesses, the percentage of compromises that they represent doubled last year. That's a significant jump for mom-and-pop shops, companies with 10 or 15 employees. Those people aren't used to getting attacked like this. Those emails you're talking about, those are phishing attacks where someone's pretending to be someone that they're not to convince you to do something you would never do if you knew who they were. And those come email, phone, texting, and video. Now, with AI, video is becoming more and more common where you'll have a live video where you and I'd be talking. But that's not really you. It's a problem for people if they're not trained. Small businesses don't train people as much. It's an expense.
What does it really mean these days to be the weakest link in an organization?
It used to be hardware. And there's still a percentage of the game where we as IT professionals, we have to install secure hardware and we have to patch it and we have to update it so that hackers don't get in. But today, over 75% of breaches are through people. People don't have to worry about hardware as much anymore because people aren't hacking. They're not compromising. They're not brute-forcing their way into a network. They're just logging in. They stole login credentials from someone.
