A study published by Zscaler’s ThreatLabz team analysed 351 victims across 334 organisations compromised during a single month-long ransomware campaign. For large enterprises, the established assumption is that hackers primarily target system administrators or hunt for credentials to privileged accounts.
The data paints a very different picture.
The Target Profile
Of the compromised accounts analysed:
- 62% held manager-level titles or higher.
- 75% sat within five non-technical business units: finance and accounting, sales, operations, human resources, and marketing.
- 50% of targeted organisations were in industrials or IT services.
- The average victim was 46 years old, with Generation X representing the largest single demographic.
This skew reflects organisational placement rather than digital literacy. Mid-to-senior professionals routinely hold direct authority over payments, client databases, supply chains, and payroll. Attackers recognise that compromising individuals with this level of authority often yields faster monetary gain with fewer technical safeguards to get in the way.
An accounts payable manager, for example, rarely possesses system administration rights. However, their inbox and enterprise SaaS sessions contain active invoice threads, supplier payment portals, and direct banking delegation. An attacker who controls that inbox could potentially initiate fraudulent transfers, manipulate payment routing, or extract customer databases with minimal scrutiny. Usually, an organisation isn’t aware it’s been compromised until something bad happens.
Relevance To Smaller Organisations
In large organisations with dedicated Security Operations Centres (SOCs) and granular administrative roles, identity compromise is obviously disruptive, but technical controls can limit the damage.
Small and medium-sized enterprises operate under different constraints. Role consolidation means the person managing supplier relationships or handling payroll frequently holds global administration or co-ownership privileges over cloud tenancies. This is true for all of my clients; I am a ‘one man band’ after all, and given the ‘under the bus’ scenario, my client needs to hold at least one global admin account. This shouldn’t be an account they use day to day if you’re adhering to good practice, or indeed the Cyber Essentials framework.
When a manager’s Microsoft 365 or Google Workspace account is breached in a business employing, say, 10 people, the attacker frequently gains unhindered access to the company’s entire collaboration suite, document repositories, and financial workflows.
Pragmatic Mitigations
Enterprise remediation often demands continuous SOC retainers, automated micro-segmentation, and standalone XDR suites. For small teams operating standard SaaS environments, the following steps can significantly improve security posture:
1. Enforce Strict Device and Identity Boundaries
Standard licences (such as Microsoft 365 Business Premium) include tools that frequently sit unconfigured. Good best-practice should involve:
- Enforcing Conditional Access to block sign-ins from unmanaged, non-compliant devices.
- Require phishing-resistant multi-factor authentication (FIDO2 passkeys or hardware tokens where feasible) for all users with financial or data export authority at least, but preferably every account.
- Disable legacy authentication protocols to prevent basic credential stuffing.
2. Identify and Secure High-Authority Roles
Formal access reviews are mostly neglected because small teams lack the time, true, but mostly the inclination. However, an afternoon spent identifying the individuals who hold signing authority, payroll access, or customer CRM export rights is sufficient. These accounts should have strict session lifetime policies, restricted forwarding rules, and separate credentials for administrative portals.
3. Perform Out-of-Band Financial Verification
The research showed repeated instances of attackers posing as internal IT staff or executive leadership over Teams, Slack, and email. Technical controls must be paired with clear operational policy: any request to alter supplier bank details, execute one-off payments, or export sensitive registers must require mandatory voice or in-person verification via a pre-established contact number, never the contact details provided in the incoming message.
4. Isolate Backups
Modern ransomware actors deliberately seek out cloud-connected backups before encrypting production environments, so backup infrastructure must never share credentials with daily operational accounts. It is important to ensure cloud backups are both immutable (where backup copies are written once and locked so they cannot be modified, encrypted, overwritten, or deleted by any user, process, or administrator for a predefined retention period) and protected by multi-party approval or delayed deletion windows for any purge requests.
The Zscaler study is distilled from enterprise level data, but that does not diminish its relevance to the SMB sector. If anything, the targets of the latter organisations are always the business owners and managers, and it is the responsibility of us, as their technical consultants, to safeguard these infrastructures through a good understanding (and implementation) of technical controls and user awareness training.