Small businesses are attractive targets because they have information that cybercriminals want, and they typically lack the security infrastructure of larger businesses. Sometimes the gains to be had from attacking a small business are smaller than what the results could be if a larger enterprise were the focus of a cyber-attack. But, because of the corresponding lack of security controls, bad actors can see small businesses as “easy pickings”. Other times, however, a small business is viewed as a critical component of the attack vector into a large enterprise. Large firms of every type use small business vendors. The SBA incentivizes large companies to use small business suppliers. Cybercriminals have found that attacking a large firm through their small business partners can be a successful strategy.