Topic starter
12/07/2026 12:19 pm
TL;DR: Attacks on SMBs increasingly turn support and recovery workflows into access paths, GlobalSign argues, as modern ransomware pressure exploits weak identity assurance and manual processes. Recovery and identity controls need to withstand impersonation and restore services under real incident conditions.
Editorial analysis by NHI Mgmt Group, based on content published by GlobalSign: “Por qué los ciberdelincuentes siguen derrotando a las PyMEs”.
By the numbers:
- Microsoft cited in the article says SMBs now represent 90% of all ransomware attacks.
Key questions
Q: Why do slow recovery processes increase ransomware impact?
A: Slow recovery extends the attacker’s leverage window.
Q: What are the warning signs that a small business is underprepared for an access-led attack?
A: Common signs include broad help desk authority, inconsistent identity checks for resets, undocumented emergency access, and backups that have not been restored in a live exercise.
Q: What fails first when SMBs are hit by modern ransomware and social engineering?
A: The first failure is usually trust, not technology.
Practitioner guidance
- Harden account recovery workflows Require stronger identity verification for password resets, MFA re-enrolment and privileged support requests, especially where a service desk can override controls.
- Reduce standing administrative trust Limit persistent admin access, separate support roles from privileged recovery rights and review which accounts can approve emergency changes.
- Test restoration under pressure Run recovery exercises that verify backups, rebuild steps and business-critical dependencies, not just that backups exist.
Bottom line: SMB resilience fails when attackers can turn support and recovery workflows into access paths.
Glossary terms: Recovery Workflow, Standing administrative trust, Resilience Debt, Identity-Led Ransomware
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 54 minutes ago by NHI Mgmt Group
12/07/2026 12:33 pm
SMB resilience is now an identity and recovery problem, not a size problem. The article’s core lesson is that attackers do not need a large enterprise target if the smaller one has weaker access assurance and thinner recovery depth. That shifts the security conversation from scale to control quality, especially around privileged access, help desk workflows and restore capability. Practitioners should treat these controls as core business resilience mechanisms, not optional hardening.
A question worth separating out:
Q: Should SMBs prioritise access hardening or backup investment first?
A: They should do both, but access hardening often comes first because it reduces the chance of compromise in the first place. Backup investment matters when prevention fails, yet weak identity controls leave the business repeatedly exposed. The best sequence is to close the easiest access paths while proving that recovery actually works.
👉 Read our full editorial: SMB cyber resilience is now an access and recovery problem