The Cyber Brief, Issue 2, October 2026.
Does North Korea care about your small business? No, but small business cyber risk doesn’t depend on anyone caring about you specifically. The tools built to break into big targets eventually get sold to whoever wants in, including the person who would empty your bank account on a slow Tuesday. Nobody gets asked whether they’re hackable. Everyone already is. The questions that actually land are how long you’re down, what you owe your clients while you are, and whether you can show you did the reasonable thing once it’s over.
Does small business cyber risk come from nation-state hackers?
Sometimes, yes, indirectly. The FBI just raided laptop farms in Texas tied to North Korean IT operatives, seizing 187 laptops. These weren’t remote workers quietly skimming a paycheck. The setup fed money and access back to a state cyber program. For a firm your size, the lesson isn’t watch out for spies. It’s that the infrastructure criminals rent cheap was often built by people with real budgets and a lot of patience, then handed down the chain until it lands in an ordinary inbox. What it means for a firm this size: the attacker on the other end of your next phishing email might be using a tool that started life in a government lab, and your defenses need to hold regardless of who built the weapon.
How are ransomware gangs quietly prepping your network before they strike?
By the time something looks wrong, they’ve often been inside a while. Attackers are using ClickFix and Python tunnels to soften up networks before ransomware lands, laying groundwork quietly instead of smashing the door down. At the same time, a single Chinese phishing network tied to roughly one billion messages has targeted 75,000 organizations. One network, a billion emails. The odds one lands in your inbox this month aren’t small. What it means for a firm this size: the warning signs you’re trained to watch for, a locked screen, a ransom note, show up after the real damage is already done. Catching the quiet setup stage matters more than catching the loud finale.
Can a web ad or a fake support call really infect your systems?
Yes, and no click is required. Researchers found that just loading an online ad can be enough to infect a device with spyware, which makes patched browsers and ad blockers part of the job now, not an optional extra. Separately, more than 20,000 fake support sites are live right now, part of a traffic-direction network linked to tech support scams across thousands of Cloudflare Pages domains. There’s also a newer wrinkle worth naming: the AI agents your team adopted on their own can leak API keys and cloud secrets without anyone noticing, because most firms have no one watching for it. What it means for a firm this size: the call claiming to be Microsoft or your printer vendor, and the AI tool someone signed up for last week, are both worth a second look before anyone trusts them with access.
What’s the one thing that actually matters for small business cyber risk?
A control that shortens the outage and leaves a record beats one that only promises to keep people out. Nobody can promise perfect prevention, not against tools with a nation-state’s budget behind them. What a firm can control is how fast it recovers and whether it can show, afterward, that it did the reasonable thing. The incidents that hit firms your size are rarely exotic. It’s the backup nobody ever restored from and the admin login three people still share. That’s the gap worth closing before the exotic stuff even matters.
What should you do about it this month?
Three things, on your own, before anything else. Check who still has access to systems they haven’t touched in six months. Confirm your last backup actually restores, not just that it ran. Ask whoever holds your admin passwords if more than one person knows them. If three people know the admin password, you don’t have a password, you have a group chat.
Most of this month’s incidents start with a person: a pasted command, a phishing email, a fake support call, a tool somebody signed up for on their own. That’s why training is worth funding directly. The 2027 Cybersecurity Training Grant covers one security awareness training course per employee, up to 50 people per organization, for any US organization, nonprofits included, with applications open through August 31, 2027, or until 750 funded seats are taken. You can apply for the free 2027 training grant directly.
TC³ can’t stop a nation-state from building tools. What TC³ can do is shorten the outage, leave a record when something goes wrong, and help you find the shared password and the untested backup before either becomes a 2am phone call. For more on where small business cyber risk actually comes from, see the cybersecurity and data breach risk page, browse the cybersecurity news hub, or catch up on past issues in the Cyber Brief archive. If this landed in your inbox from somewhere other than a direct subscription, you can manage your subscription here to keep getting it monthly.
Researched and drafted with AI, then reviewed and approved by Ron Trotto before publishing.