Topic starter
12/07/2026 12:19 pm
TL;DR: Scattered Spider’s shift from retail to insurance and aviation, alongside Microsoft’s finding that 80% to 90% of ransomware targets are SMBs, shows how smaller organisations are being selected for weaker resilience and faster pay decisions, according to GlobalSign and Microsoft. The control gap is not size but preparedness: access, recovery, and incident response discipline now matter more than brand scale.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Por qué los ciberdelincuentes siguen derrotando a las PyMEs”.
By the numbers:
- Microsoft cited in the article says SMBs now represent 90% of all ransomware attacks.
Key questions
Q: What fails first when SMBs are hit by modern ransomware and social engineering?
A: The first failure is usually trust, not technology.
Q: Why do slow recovery processes increase ransomware impact?
A: Slow recovery extends the attacker’s leverage window.
Q: What are the warning signs that a small business is underprepared for an access-led attack?
A: Common signs include broad help desk authority, inconsistent identity checks for resets, undocumented emergency access, and backups that have not been restored in a live exercise.
Practitioner guidance
- Harden account recovery workflows Require stronger identity verification for password resets, MFA re-enrolment and privileged support requests, especially where a service desk can override controls.
- Reduce standing administrative trust Limit persistent admin access, separate support roles from privileged recovery rights and review which accounts can approve emergency changes.
- Test restoration under pressure Run recovery exercises that verify backups, rebuild steps and business-critical dependencies, not just that backups exist.
Bottom line: SMB resilience fails when attackers can turn support and recovery workflows into access paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:33 pm
SMB resilience is now an identity and recovery problem, not a size problem. The article’s core lesson is that attackers do not need a large enterprise target if the smaller one has weaker access assurance and thinner recovery depth. That shifts the security conversation from scale to control quality, especially around privileged access, help desk workflows and restore capability. Practitioners should treat these controls as core business resilience mechanisms, not optional hardening.
A question worth separating out:
Q: Should SMBs prioritise access hardening or backup investment first?
A: They should do both, but access hardening often comes first because it reduces the chance of compromise in the first place. Backup investment matters when prevention fails, yet weak identity controls leave the business repeatedly exposed. The best sequence is to close the easiest access paths while proving that recovery actually works.
👉 Read our full editorial: SMB cyber resilience is now an access and recovery problem