You’d think nation-state cyber attackers would be too busy targeting military secrets, critical infrastructure, or global financial systems to bother with your local optometrist, small engineering firm, or boutique consultancy.

But you’d be wrong.

As Rob Lemos in his recent Dark Reading article “Nation-State Threats Put SMBs in Their Sights” noted, small and medium businesses (SMBs) are increasingly being caught in the crosshairs of nation-state actors. And while that sounds dramatic, it’s not exactly news to those of us who’ve been waving this red flag for a while now.

If you’ve heard me talk about data privacy, sovereignty, or security-by-design, you’ll know this has been a consistent message: Small doesn’t mean safe.
And simple doesn’t mean insignificant.

🐘 The Elephant in the Server Room

Let’s get this out of the way: Most small business owners aren’t waking up thinking about advanced persistent threats. They’re thinking about invoices, customers, staff shortages, or what fresh compliance headache might land in their inbox next.

But that’s precisely what makes them attractive to cyber operatives. Nation-state actors — whether working directly for governments or as aligned proxies — know that many SMBs:

• Don’t have dedicated security teams
• Rely on unpatched or outdated systems
• Lack visibility into who accesses their data
• Are deeply embedded in complex supply chains

And it’s that last point that’s so often overlooked. Because when a hostile actor wants to breach a major government department or multinational contractor, the front door is usually locked. So they look for a side door.

🕵 The Stepping Stones in the Spy Game

Small businesses aren’t usually attacked because of the data they hold. They’re attacked despite it — or more accurately, because of who they’re connected to.

Think of SMBs as stepping stones across a river. Alone, they may seem easy to overlook. But in the hands of a strategic adversary, they form a precise, quiet path — one that leads straight to critical infrastructure, sensitive government systems, or global defence suppliers.

Nation-state actors know this. They’ll compromise a regional software vendor with government clients. Or a boutique logistics firm that supports infrastructure projects. And then they wait.

This isn’t smash-and-grab ransomware. It’s quiet infiltration. Long-game strategy. And it works.

🧩 But Here’s the Hard Truth (and the Good News)

Small businesses can’t keep outsourcing this risk to someone else. Governments and tech giants have critical roles to play, of course. But SMBs themselves need access to practical, affordable ways to take control of their data.

I know it’s a lot. Many small business owners are already overwhelmed — especially with security solutions that feel designed for enterprises with full SOC teams and million-dollar budgets.

That’s why we designed 3 Steps Data with three very specific principles in mind:

• Simple to use — because you shouldn’t need a cybersecurity degree to protect your business.
• Cryptographically secure — so even if someone breaks in, they can’t read your data.
• Zero-knowledge architecture — meaning we can’t see your data. And neither can anyone else.

We believe compliance and governance shouldn’t be a scary afterthought — they should come baked in. No back doors. No silent surveillance. No compromises.

🛡 Stop Treating SMBs as Collateral Damage

For too long, small businesses have been treated as unfortunate casualties of cyber warfare — overlooked in policy and underserved by tools.

But the truth is, SMBs are the economy. They’re the innovators, the service providers, the specialists keeping everything running in the background. And they deserve security solutions that match their importance — not just their size.

SMBs need:

• Education that speaks business, not jargon
• Tools built for real-world constraints
• Transparent, auditable systems that don’t require trust, because they’re designed not to know
• Public policy and industry support that acknowledges the role SMBs play in national resilience

🧭 A Final Thought

I’ve said it before, and I’ll keep saying it: Cybersecurity isn’t just a tech issue — it’s a business continuity issue. A trust issue. A sovereignty issue.

So next time someone suggests that nation-state hackers only go after “big targets,” remind them: the path often runs straight through the smallest players.

Let’s stop leaving our smallest businesses to fight off the world’s most resourced attackers with nothing but duct tape and good intentions.

Because when the stepping stones are this exposed,
it’s only a matter of time before someone crosses them.

About the Author:

Kim Chandler McDonald is the Co-Founder and CEO of 3 Steps Data, driving data/digital governance solutions.
She is the Global VP of CyAN, an award-winning author, storyteller, and advocate for cybersecurity, digital sovereignty, compliance, governance, and end-user empowerment.