Signals · Threat intelligence

You're not the target. You're the way in.

A small firm cannot out-defend a nation state. It rarely has to. What state-backed attackers usually want from an SME is a way in to someone else, and that is something you can close.

By Gouresh Kamble, Amon Dîn · · 5 min read

A heavy stone gate standing open with warm amber light spilling out, set in a fortress wall above misty mountains, with a citadel and waterfalls in the distance under a blue-grey sky

When people hear "state-backed hackers", they tend to reach one of two conclusions: "that's not about us", or "there's nothing we could do anyway". Both are understandable. Both miss how these operations usually work.

The activity is real and it is growing. On 15 October Paul Chichester, Director of Operations at the UK's National Cyber Security Centre, told New Scientist that Russia, China, North Korea and Iran are all using AI to increase their attacks, and that "it feels more relentless now than it did 10 years ago". He described cyber operations as "an absolutely critical part of covert statecraft".

Why a small firm is useful to a state

Let's be honest about one thing: if a well-resourced intelligence service decides your company specifically is the target, a ten-person firm will not out-defend it. Nor will most large ones. But that is rarely the situation SMEs are in. Far more often, you are not the target. You are the way in.

Look at what the official warnings of the past few weeks actually describe:

Edge devices. On 7 October the Dutch intelligence services AIVD and MIVD warned that Chinese attacks through firewalls, VPN gateways and portals are "set to grow strongly in the coming years", that Dutch organisations have already been compromised this way, and that AI is helping attackers find and exploit flaws faster than before.

Borrowed infrastructure. On 8 October the NCSC and partners in six other countries exposed Integrity Technology Group, a China-linked company, for enabling attackers who combine AI-assisted scanning, large botnets of compromised internet-connected devices and hands-on hacking to steal data worldwide. Those botnets are built from ordinary equipment: routers, cameras and storage boxes owned by people and businesses who never knew they were part of it.

Cameras. In July the AIVD and MIVD reported that a Russian service is systematically compromising internet-connected IP cameras in the Netherlands and other EU and NATO countries to watch military transport routes. Not because the camera owners mattered, but because of what their cameras could see.

Suppliers. If you provide IT, software, logistics or professional services to larger organisations, your access to them is the prize. That is exactly why regulators are now looking down the supply chain.

You cannot stop a nation state choosing you. You can stop being the easiest route to someone else.

Regulation is moving down the supply chain

Lawmakers on both sides of the North Sea have drawn the same conclusion. In the Netherlands, the Cyberbeveiligingswet (NIS2) has applied since 15 August to around 8,000 organisations, and it expects them to manage the security risks in their supply chains. If one of them is your customer, expect more security questions in contracts and supplier questionnaires.

Across the EU, the Cyber Resilience Act reporting duties started on 11 September. Manufacturers of products with digital elements, from firewalls to cameras, must now report actively exploited vulnerabilities and severe incidents within 24 hours. For buyers, that should mean faster and clearer security notices from vendors, which only help if somebody reads and acts on them.

In the UK, the Cyber Security and Resilience Bill returns to the House of Lords for Report stage on 26 October. According to Hill Dickinson, it would bring managed service providers and data centres into scope and give government powers to designate "critical suppliers". Royal Assent is expected between late 2026 and spring 2027, so none of this starts on 26 October, but the direction is clear.

Six practical steps

  • Know what faces the internet. List every firewall, VPN, remote access portal, camera and storage device reachable from outside, and who is responsible for each.
  • Patch or replace edge devices. Apply security updates to firewalls and VPNs quickly, and retire devices the vendor no longer supports. Subscribe to your vendors' security notices.
  • Take cameras and storage off the open internet. Follow the AIVD's advice: no direct internet access, current firmware, changed default passwords and limited users.
  • Turn on multi-factor authentication everywhere, starting with remote access, email and admin accounts, and close services and ports you do not use, as the NCSC advisory recommends.
  • Ask your IT provider three questions: how do you protect the access you have to our systems, how fast do you patch our edge devices, and how would you tell us about an incident?
  • Know who you would call. Agree an incident contact and a short plan now, including how you would warn the customers whose access runs through you.

None of these steps needs a security team. Together they remove most of what makes a small firm a convenient stepping stone.

Sources

← All Signals