You Will Be Breached: Why Incident Response Isn't Optional

Every small business owner and nonprofit leader I talk to eventually says some version of the same thing: "We're too small for anyone to bother with us." It feels true. It is also the single most expensive assumption in small organization security.

Attackers do not sort targets by size. Most attacks against small organizations are automated: scanners looking for exposed logins, phishing kits sent to thousands of addresses at once, ransomware crews that buy stolen credentials in bulk and try them everywhere. Your organization does not need to be interesting to get hit. It only needs to be reachable, and almost everyone is reachable.

The data backs this up consistently. Small businesses and nonprofits are targeted at rates comparable to, and in some categories higher than, larger enterprises, precisely because attackers expect less resistance. A larger company has a security team. A twelve-person nonprofit usually has none.

This is not a reason for fatalism. It is a reason to stop asking "will this happen to us" and start asking "what happens when it does." That shift in framing is the entire point of this series.

The planning gap

Most organizations in this category have some security controls. Antivirus software. Maybe MFA on email. What almost none of them have is a plan for the moment something actually goes wrong.

That gap matters more than any single technical control. An organization with modest defenses and a clear response plan will recover faster and at lower cost than an organization with better tools and no plan at all. Incident response is not a technical discipline reserved for large IT departments. It is a decision-making discipline, and small organizations can build it just as well as large ones, often faster, because there is less bureaucracy in the way.

What this series covers

Over the next four weeks, this series will walk through incident response and resilience the same way the AI adoption series walked through safe adoption: in plain language, sized for organizations without dedicated security staff, with practical steps you can act on immediately.

Week 2 covers what actually happens during a real incident, hour by hour, so the experience is familiar before it happens rather than during it. Week 3 gives you a sequenced, practical plan you can build in an afternoon. Week 4 covers how to keep that plan alive: testing it, involving your board or leadership, and treating resilience as an ongoing practice rather than a document that gets written once and forgotten.

None of this requires a security budget you don't have. It requires the decision that the question is "when," not "if," and the willingness to spend a few hours preparing for that answer.