Attackers Aren't Picking on Small Businesses. They're Walking Through Your IT Provider's Front Door.

Verizon's 2026 Data Breach Investigations Report is the annual study of thousands of real breaches that security people argue about for a month and then quietly rely on anyway. This year it contains a sentence every small business owner should read twice. Where the victim's size was known, about 96% of ransomware victims were small and mid-sized organizations. Verizon's own read on why: the attackers aren't choosing by industry or revenue. They take whoever has a leaked login or an old, unpatched firewall.

"We're too small to bother" was never a strategy. In 2026 it is also just wrong.

The front door is a flaw nobody fixed

For years, owners were told the threat was a careless employee clicking a bad email. The data has moved on, and so should the advice. Across all breaches, exploiting an unpatched flaw is now the number one way in: 31%, up from 20% a year ago. For small businesses specifically, 26% of breaches began with an exploited flaw, 13% with stolen credentials, and 9% with phishing. The weak spot is the gear at the edge of your network: the firewall, the VPN, the router. Verizon traced 29% of small-business ransomware cases to unpatched edge devices.

The slow part is the fixing. Only 26% of the most dangerous flaws, the ones the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed criminals are using right now, were fully fixed in 2025. The median time to fix was 43 days, up from 32. Attackers don't need anything clever. They need you to be slow, and most of us are.

The biggest key ring you own belongs to someone else

Here is the number that never makes it into a sales deck. In Verizon's data, 55% of small-business breaches involved a third party: a vendor, a software supplier, a service provider. Across all organizations the figure is 48%, up from 30% a year earlier.

Of all your third parties, one has more access than the rest: the company that manages your computers. To do the job, it runs a remote-management tool that can reach every machine it looks after, at every client it serves. That is a convenience for the technician and a jackpot for an attacker, because breaking one product opens a few hundred companies at once. This isn't theory.

• Kaseya, July 2021. Attackers got into Kaseya's VSA remote-management software and used the product's own management functions to push ransomware out to its customers' customers. By Kaseya's own count, as reported by the trade press, fewer than 60 direct customers were hit and fewer than 1,500 businesses downstream. CISA lists the flaw (CVE-2021-30116) as known to be used in ransomware campaigns.
• ConnectWise ScreenConnect, 2024. CISA added an authentication bypass in ScreenConnect (CVE-2024-1709) to its Known Exploited Vulnerabilities catalog on February 22, 2024. In plain English: someone with network access to the management screen could create their own administrator account. CISA flagged it as used by ransomware groups.
• ConnectWise ScreenConnect, again, 2026. On April 28, 2026, CISA added a second ScreenConnect flaw (CVE-2024-1708) to the same catalog, with the same ransomware flag.
• SimpleHelp, 2025. Sophos documented the DragonForce ransomware gang breaking into an IT provider's remote tool, collecting details on the provider's customers, and pushing ransomware through the tool. The one customer that had bought round-the-clock detection and response had the attack stopped. Everyone else got encrypted and extorted.

Be fair about it: every software maker ships flaws, and Kaseya and ConnectWise have patched theirs. Neither is the only vendor in this category either, and Kaseya has owned Datto since 2022, so a lot of the channel now sits under a few roofs. But read the list again. The problem is the design, not the logo. A tool built so one technician can touch every client is, by definition, a tool that lets one attacker touch every client. The more customers a provider stacks behind one console, the fatter the prize. That is the model that built the managed-services industry, and it is the one criminals have priced in.

So when your provider tells you not to worry because their platform comes from a big name, understand what you just heard. That isn't an answer. It's the description of the risk.

Three more things the pitch skips

The help desk will let a stranger in. Pretexting, which is the polite word for lying to someone on the phone, now starts 6% of breaches. In Verizon's simulations, phone and text attacks outperformed email: a median click rate near 2% against 1.4%. A caller who has done his homework phones the help desk as an employee with a lost phone and asks for a reset. A friendly help desk gives him a password and a brand-new sign-in device that he registered himself. Your multi-factor authentication just worked exactly as designed, for him.

Your passwords go on sale before the ransomware lands. Of the ransomware victims that had a leaked-credential or password-stealing-malware event on record, half had one in the 95 days before the attack. The warning arrives first. Somebody has to be watching for it.

Your staff already brought AI to work. Verizon counts 45% of employees as regular AI users on company devices, and 67% of those users reach AI services through personal accounts. That is company data leaving the building today, with no hacker required.

Five questions to put to your IT provider this week

1. How do you confirm who is on the phone before you reset a password or a sign-in device?
2. Is the remote-management tool you use on our systems protected with multi-factor authentication, patched within days of a critical fix, and watched by a human at 2 a.m.? Who, specifically?
3. Which of our firewalls and routers are past the date the maker stops fixing them?
4. Which outside apps and services hold standing access to our systems, and when did anyone last review them?
5. If one of your vendors is breached, how do we find out, and how fast?

Ask every provider you have. That includes us. We run remote-management tools too, because every provider does, and we expect the same questions.

Where we stand

The honest alternative to renting a stack of other companies' tools is to need fewer of them and to answer for what's left. That is why Intelligent Automation is building Argos OS: one platform we build and operate ourselves for ticketing, security monitoring, compliance evidence and asset tracking, designed around keeping each client's data separate, with published security standards you can check against what we tell you. It won't make any provider immune, and anyone who says their platform does is selling you the same brochure as everyone else. What it changes is who you hold accountable when something goes wrong: us, not a vendor's help-desk queue.

The attackers have already done the math on small businesses. Send the five questions. The answers, or the silence, will tell you what you needed to know. If you want a second opinion on the replies, talk to our team.