You're not too small to be a Cybersecurity attack target

If you run a growing business or a nonprofit, you've probably told yourself some version of the same thing: we're too small, too local, or too mission-driven for a hacker to bother with. It's an understandable assumption. It's also the exact assumption attackers are counting on.

If you're growing faster than your IT budget

 

Small and mid-size businesses experienced roughly four times more confirmed data breaches than large organizations last year, according to Verizon's 2025 Data Breach Investigations Report. And when a small or mid-size business is breached, ransomware is involved 88% of the time, more than double the rate at large companies. The pattern is the same whether you're a 15-person nonprofit or a 60-person company: fewer defenses, faster growth, and IT that's stretched thin make you the easier door to open.

If you think your mission protects you

It doesn't. Nonprofits are quietly one of the most targeted sectors online. Okta's 2025 research found nonprofits were the second most-targeted sector that year, and Microsoft's Digital Defense Report lists nonprofits as the fourth most-targeted sector by nation-state actors. Donor databases, grant records and volunteer lists are valuable precisely because they're often left lightly defended.

A mission statement has never once stopped a phishing email.

If you assume your general policy has you covered

This is the myth that costs people the most. Many general liability and property policies simply weren't built to respond to a data breach, a ransomware demand, or the cost of notifying every donor or customer affected. Whether cyber coverage sits inside a broader policy or stands alone as its own endorsement depends entirely on how your current policy is written, which is exactly the kind of thing worth a second look rather than an assumption.

If a breach actually happens

 

Costs vary more than the scariest headline numbers suggest. Some industry estimates put the average breach cost for organizations under 500 employees north of $3 million, but a more realistic range for most incidents is $120,000 to $1.24 million, depending on how quickly it's caught and contained. Either end of that range is a hard conversation to have without a plan already in place. That's why we're walking through real, anonymized claims stories in a new series called "The Day Before."

Cybersecurity isn't one-size-fits-all

 

A 12-person nonprofit and a 60-person logistics company don't carry the same cyber exposure, and they shouldn't carry the same policy. What they share is the same blind spot: assuming size is a form of protection. It isn't.