When people think about a cyber incident, they often imagine something sudden and dramatic. Systems going down. Screens locking. Work grinding to a halt. For many firms, this is how a small business cyber incident actually begins.
This isn’t always, the case, but incidents in small firms often fall into one of two patterns — and both are worth understanding.
As we touched on in our previous article, modern attacks tend to focus on people rather than systems. What varies is how quickly that access is used.
Sometimes the impact is immediate — and very visible
In many cases, a compromised email account is used almost straight away.
A malicious message is sent to everyone in the firm’s contact list. Sometimes it’s obvious and poorly written. Sometimes it’s aggressive or alarming. Either way, it doesn’t take long for clients, lenders, or suppliers to notice something is wrong.
These incidents can usually be handled with a reset password and a clean up exercise. Systems still work. Files are still there. Business can usually continue after it’s cleaned up.
But the damage is reputational.
Firms find themselves explaining why a “nasty email” came from their address, reassuring contacts that nothing else was affected, and quietly worrying about what confidence has been lost in the process. It’s uncomfortable, public, and distracting — even if it’s contained quickly.
Other incidents unfold more slowly
In contrast, some attacks are quieter.
Access is gained, but nothing obvious happens at first. No emails are sent. No alarms go off. The attacker watches how the business operates — who talks to whom, how invoices are sent, when approvals usually happen.
When something eventually does happen, it often looks routine. A follow-up email. A payment request. A subtle change that fits the day’s work.
In these cases, the visible “incident” is just the end of a longer chain of events that began much earlier.
The common thread is still management, not luck
Whether an incident is noisy and immediate or quiet and delayed, the underlying gaps are usually similar.
- Monitoring that didn’t flag unusual behaviour.
- Access that wasn’t reviewed or restricted.
- Training that assumed threats would look obvious.
- Controls that existed in isolation rather than working together.
None of this requires enterprise-scale teams or complex infrastructure. What it requires is ownership — someone responsible for making sure protections are active, joined up, and reviewed over time.
The uncomfortable truth is that many firms only notice these gaps after something has gone wrong. The more useful truth is that understanding how incidents actually play out — fast or slow — makes them far easier to prevent, and far easier to contain.
Leave a Reply