Key Takeaways
- Government and vendor-neutral industry data shows SMBs are routinely targeted.
- Most breaches start with stolen login credentials (phishing, password spraying, BEC).
- Identity-first controls offer the best protection: SSO, phishing-resistant MFA, and device trust.
- A security-first MSP with rigorous standards and vetted tools significantly strengthens your defenses.
Contents
- There’s no such thing as “too small to target”
- The data is unambiguous: SMBs are in the blast radius
- NENS chooses Okta IAM from ZeroTek to protect their customers
- What makes SMBs such great targets?
- NENS customer story: Cutting malicious login attempts for company leadership
- How credential-based attacks burn small businesses
- NENS customer story: when the attacker is already in the system
- How SMBs can protect themselves, and what to look for in an MSP
- NENS tech vendor selection process
- NENS essentials for securing new customers with Okta
- Bottom line for SMBs
Contents
- There’s no such thing as “too small to target”
- The data is unambiguous: SMBs are in the blast radius
- NENS chooses Okta IAM from ZeroTek to protect their customers
- What makes SMBs such great targets?
- NENS customer story: Cutting malicious login attempts for company leadership
- How credential-based attacks burn small businesses
- NENS customer story: when the attacker is already in the system
- How SMBs can protect themselves, and what to look for in an MSP
- NENS tech vendor selection process
- NENS essentials for securing new customers with Okta
- Bottom line for SMBs
Key Takeaways
- Government and vendor-neutral industry data shows SMBs are routinely targeted.
- Most breaches start with stolen login credentials (phishing, password spraying, BEC).
- Identity-first controls offer the best protection: SSO, phishing-resistant MFA, and device trust.
- A security-first MSP with rigorous standards and vetted tools significantly strengthens your defenses.
There’s no such thing as “too small to target”
If you’re running a small or mid-sized business (SMB) and think you’re “too small to target”, read on. The truth is that threat actors don’t check company size before they launch a phishing attack or start stuffing passwords; they pick the easiest path. For many small and midsize businesses, that path is wide open through weak identity and access controls, orphaned accounts, and flat networks where a single set of login credentials can mean company-wide access.
This article debunks the myth of “too small to target” with hard data and concrete examples. We’ll also explore what you need to think about when choosing an IT service provider, and what you can do to protect yourself. Along the way, you’ll get on-the-ground examples and insights from our co-author, Boston-area managed services provider (MSP), New England Network Solutions (NENS), who will help bring the numbers to life.
This is the first of a weekly six-part series co-authored by ZeroTek and NENS for Cybersecurity Awareness Month (October). Some articles, like this one, are written for SMBs; others will address the concerns of MSPs.
The data is unambiguous: SMBs are in the blast radius
- Business email compromise (BEC) keeps hammering organizations of all sizes—including small local businesses, per an FBI 2024 PSA. The Bureau calls BEC “one of the most financially damaging online crimes” and “the $55 Billion Scam”.
- Credential abuse is the dominant way in. Verizon’s 2024 Data Breach Investigations Report (DBIR) shows that “use of stolen credentials” is the #1 type of web app attack (77%) and a recurring factor across breach patterns.
- Stolen logins are for sale within hours. Verizon’s DBIR team sampled credential markets and found 1,000+ credentials posted per day at about $10 each, with 65% listed less than a day after theft—fuel for rapid waves of credential-stuffing attacks.
- Breaches that start with compromised credentials take the longest to clean up—292 days on average to identify and contain, per IBM’s 2024 Cost of a Data Breach Report. 70% of organizations report significant or very significant business disruption post-breach.
- SMBs are common targets. According to Microsoft’s 2024 SMB research, found that one in three surveyed SMBs had experienced an attack, with an average cost of $254,445 per incident.
There’s a common theme here: These unrelenting attacks increasingly hinge on compromised digital identities to gain access. That’s why robust identity and access management (IAM) is essential to secure your organization.
“It doesn’t matter what size the business is. The threats are the same. We believe everyone deserves the best technology available to protect their work.”
– Jason Bricault, CTO
New England Network Solutions
NENS chooses Okta IAM from ZeroTek to protect their customers
“It doesn’t matter what size the business is. The threats are the same. We believe everyone deserves the best technology available to protect their work,” says Jason Bricault, CTO at NENS.
“That’s 100% why we chose Okta—it’s a very strong solution. But we get it to our customers using the ZeroTek platform, because it makes this incredible enterprise tech uniquely accessible and affordable for them. ZeroTek also makes it easy and highly secure for our team to manage Okta for multiple customers at once. It’s been a great fit.”
What makes SMBs such great targets?
SMBs are often easier, faster, and cheaper to breach because they have vulnerabilities and points of exposure that larger companies don’t, including:
- Lower control maturity.
- Many SMBs lack enforced multi-factor authentication (MFA) across all digital user identities. MFA requires users to prove who they are in more than one way before they can access resources.
- Verizon emphasizes that MFA “goes a long way” against credential abuse. But MFA works best when configured properly and where it disallows weak factors like email, voice calls, or SMS.
- SMBs often keep legacy protocols open or allow password reuse.
- More social-engineering exposure. Employees at very small companies face far more phishing and pretexting per person; Barracuda’s analysis found 350% more social-engineering attempts per employee at organizations with <100 staff.
- High disruption sensitivity. The same outage that a large enterprise can contain quickly and absorb will damage a small shop extensively and idle revenue entirely. IBM reports 70% of breached orgs suffer significant disruption; for SMBs, that often translates directly to missed payroll, lost customers, or worse.
Markets awash in fresh creds. With stolen credentials appearing for sale within hours, attackers can iterate quickly until something works.
For one client, setting up clear geofencing rules in Okta cut malicious login attempts on the CEO’s account by thousands per week.
NENS customer story: Cutting malicious login attempts for company leadership
Executives have long been prime targets for global phishing and credential attacks. Following guidance from its SIEM/SOC partner, NENS implements a global country block list for all customers on Okta to filter traffic from known malicious regions.
For one client, that single control cut malicious login attempts on the CEO’s account by thousands per week; NENS sees similar results across customers. Because NENS uses Okta, which blocks at the identity provider (IdP) layer, the applications attackers try to breach are never impacted.
How credential-based attacks burn small businesses
- BEC (Business Email Compromise). Attackers phish or password-stuff their way into a real mailbox (or convincingly spoof it), then hijack vendor payments, payroll, or escrow transfers. The FBI’s 2024 PSA explicitly notes BEC targets small local businesses as well as large firms.
- Credential stuffing against cloud apps. With thousands of fresh logins posted daily for a few dollars each, criminals rapidly test email/password pairs against Microsoft 365, Google Workspace, and SaaS apps. Once in, they create inbox rules to hide fraud, mint OAuth tokens, or register their own MFA device during quiet hours. Verizon documents the tight coupling of web apps and stolen credentials in today’s breaches.
- Password stealer malware on unmanaged devices. Even if an SMB uses “long, complex passwords,” a compromised personal laptop used for work can leak cookies and creds, which are then sold almost immediately. The DBIR warns that this class of stealer malware often sits where defenders have “limited visibility.”
- The compounding cost of “slow to see, slow to stop.” IBM’s 2024 analysis shows credential-led breaches are slowest to detect (292 days), which extends attacker dwell time and ratchets up cost. That lag often converts a preventable incident into operational disruption, legal exposure, and reputational loss.
The business liked NENS’ security and service approach but wondered if they really needed it.
Little did they know, bad actors had already infiltrated critical systems.
NENS customer story: when the attacker is already in the system
In 2022, NENS was in discussion with the leadership of a <50-person business unsure about upgrading their IT security.
“What they had in place was by-the-book, top security—for the late 2000s,” explains Kristian Sanchez, Senior Security Consultant at NENS.
The business liked NENS’ security and service approach but wondered if they really needed it. NENS was going to cost a little more each month, and they didn’t see themselves as a likely target.
Little did they know, bad actors had already exploited vulnerabilities and infiltrated critical systems. They’d been lurking for months—and when they attacked, the crisis resulted in significant downtime and financial loss. They called NENS, who stopped the attack and secured their email and essential systems in a single day by deploying Okta. Learn more about how NENS did it.
How SMBs can protect themselves, and what to look for in an MSP
As an SMB facing significant risk of attack, your choice of outsourced IT consultant or managed services provider (MSP) is one of the most consequential security and business decisions you’ll make.
You’re not just buying “helpdesk hours”; you’re granting an external team privileged access to your systems, data, and the digital identities of your staff. If your IT services provider cuts corners, you inherit their risk.
Keep in mind that MSPs themselves are also a prime attack target, because compromising their toolset could yield one-to-many access to dozens of organizations, highly privileged accounts, software distribution channels, and help desk workflows vulnerable to social engineering. It’s essential to scrutinize not just what an MSP or IT consultant says they’ll offer your business—but to also learn how they are protecting themselves.
1 – Proven experience with businesses like yours
- Do they have references in your industry and size band?
- Can they articulate common attack paths for SMBs (BEC, credential stuffing, OAuth abuse) and how they block them in practice?
- Will they share playbooks for onboarding, incident response, and recovery?
2 – Security-first, not ticket-first
- Are identity controls—like single sign-on (SSO) and phishing-resistant multifactor authentication (MFA), plus device trust for the most sensitive access—the default for every user and admin, not just an upsell?
- Do they practice least privilege, just-in-time access, and change control for any support action they perform for your business?
- How do they measure success: fewer tickets because baseline controls work, or happier metrics that ignore risk?
3 – “Eat your own dogfood” (walk the walk)
The tools and policies they sell you should be the ones they run themselves. Ask them to prove it:
- Identity & access: Do their technicians authenticate to their systems and your tenants with SSO and phishing-resistant MFA (not SMS/email codes)
- Segregation & audit: Are their admin accounts separated per customer tenant, fully audited, and time-bound?
- Endpoint hygiene: Are all MSP laptops used to access your systems managed, encrypted, patched, and blocked if they fall out of compliance?
- Passwordless where possible: Are they reducing or eliminating passwords internally for critical consoles and replacing them with more secure passwordless authentication methods? Can they do the same for you?
4 – Transparency you can verify
- Will they show screenshots or short demos of their internal security posture (redacted as needed)?
- Do they maintain third-party attestations (for example, SOC 2)?
- Can they provide copies of their incident response runbooks and an outline of communication timelines?
5 – Resilience and response
- What’s their 24/7 coverage model and escalation path?
- How fast can they revoke a compromised user’s access across all systems? How fast can they revoke a technician’s access to all customer systems should need arise?
- Do run joint tabletop exercises with clients to run through emergency or crisis scenarios? Will they do a short one with you?
If your MSP’s internal security isn’t rock solid, your environment can’t be either. Choose an MSP that treats identity, access, and appropriate use of device trust as essential—and isn’t shy about showing you how they use these technologies in real life.
For NENS, tech vendors must operate under a recognized security framework (SOC 2, ISO, NIST), and must work with Okta.
How NENS chooses technology vendors
NENS follows a strict vendor selection policy for every tool they use to protect both themselves and their customers: if a few key criteria aren’t met, the vendor is immediately disqualified. Two checks matter most.
First, the vendor must already operate under a recognized security framework, such as SOC 2, ISO, or NIST. These independent sets of rules and audits keep your data safer and the vendor accountable.
Second, the product must work with their enterprise-grade identity provider (Okta) using SAML. In plain terms, this approach lets NENS customers use secure SSO and MFA across apps, and it lets NENS turn access on or off instantly when people join, change roles, or leave.
These two requirements—proven security practices and seamless sign-in with Okta—reduce risk, cut password headaches, and give your business stronger protection without adding complexity.
NENS essentials for securing new customers with Okta
Here’s how the Okta IAM part of NENS cybersecurity services gets rolled out to new customers :
- Block high-risk countries. NENS applies SIEM/SOC-recommended country block lists at the Okta sign-in layer, stopping most malicious login attempts at the gate.
- Set up standard strong security. NENS uses ZeroTek to push out a consistent Okta security baseline to every customer and configures email and app protection. Strong MFA through biometrics (like FaceID or fingerprint recognition) gives all legitimate users easy, secure access and blocks bad actors.
- Turn on device trust so only safe devices can sign in. NENS can configure device trust so that only known, security-compliant devices can access your company apps. Even if a password is stolen, an attacker on an untrusted device can’t get in—reducing the chance of account takeovers and protecting data if a laptop is lost or stolen.
- Leverage ZeroTek’s console for audits and troubleshooting. NENS engineers review Okta logs through the ZeroTek console instead of the native Okta view. ZeroTek makes searching and interpreting logs easier, which helps NENS spot suspicious activity sooner and keep ahead of attackers.
Bottom line for SMBs
“Too small to target” means nothing in a world where criminals relentlessly go after digital identities. It’s a numbers game accelerated by automation, booming criminal marketplaces, and payouts big and small. If your team has digital identities, you’re a target.
The fastest way to change the math is to seal off all avenues of entry to illegitimate users and preventing the reuse of stolen credentials. Your MSP or IT services provider can achieve this by setting up passwordless MFA and SSO, blocking access from unauthorized geographical regions or networks (geofencing) and by making sure only authorized, secure devices can access more sensitive resources (device trust). And if they say they can’t, it’s time start looking for someone who can.
NENS x ZeroTek
New England Network Solutions (NENS) brings deep frontline MSP expertise, while ZeroTek’s multi-tenant Okta control plane makes it easy to standardize and scale best-practice identity security for SMBs. With ZeroTek | Okta, NENS rolls out strong, consistent controls quickly, cuts risk without adding complexity and delivers enterprise-grade protection to all customers.
Are you ready?
Ready to explore how ZeroTek | Okta can help your MSP deliver next-level security services to your customers?
