No one is too small to be scanned

“We’re too small to be interesting. Who would come after us?” It’s a common thought in smaller councils, utilities and network operators. It’s understandable. It’s also one of the most dangerous assumptions you can make.

Most attacks don’t choose a victim

The picture of an attacker carefully targeting you is rarely how it works. Most intrusions, and almost all ransomware, are opportunistic. The attacker isn’t looking for a particular organisation; they’re looking for a weakness that happens to be open. Who it belongs to matters less.

How it happens makes size irrelevant:

Scanning is automatic. Tools sweep the whole internet around the clock looking for known weaknesses. A newly connected, insecure service is found quickly, whether it belongs to a large enterprise or a small water utility.
Smaller organisations are often softer targets. Fewer resources, older kit and fewer people keeping watch make you easier to get into, not harder.
Sometimes disruption is the point. For essential services, some actors want the ability to disrupt power, water or connectivity. There, you’re interesting because you’re important, not because you’re large.

So being small, or staying out of the headlines, is not protection. Relying on no one having found you yet is hoping, not defending.

What actually helps

What protects you isn’t size, it’s keeping order on the basics:

Know what you expose — a complete picture of what’s visible from outside, including forgotten systems.
Close the known, exposed weaknesses first; those are exactly what the automated scanning is looking for.
Require more than a password where it matters, and stop sending credentials in clear text inside the network.
Segment, so one foothold doesn’t take down the whole operation.
Watch it over time. What was closed in spring can be open today.

None of that requires you to be large. It just requires someone to keep order.

Size doesn’t decide whether you get scanned. It decides how hard an intrusion hits when it happens.

Source: Ransomware is more opportunistic than targeted (SC Media).