We often think of small towns as better places to live. And in many ways, they are. Stronger, more supportive communities. Less crime, more social connection. And views of nature you wouldn’t swap for anything.

It’s a nice thought. But living in a small town doesn’t make you any more cyber-safe than your big city equivalents. Why? Because cybercriminals can target your business from anywhere. Your location – or theirs – makes no difference. 

All they need is an internet connection.

 

Don’t mistake remoteness for safety.

Unlike many other crimes, cybercrime doesn’t depend on population density, passing foot traffic to merge into, or physical proximity. 

In a connected world, the internet not only provides you with the ability to build markets anywhere and everywhere but also allows criminals to flag you as a potential victim. 

Email, cloud software, online banking, social media, websites and remote access all create pathways into your business, regardless of its postcode. Online, the distance between you and your attacker is effectively zero.

 

Out of town, but well within reach.

While your location may be of no interest to a cybercriminal used to targeting large numbers of organisations simultaneously, your value as a target certainly is.   

Even if you don’t pay a ransom, the financial impact of being attacked and rendered unable to operate, in part or in full, can be significant. According to the Australian Signals Directorate (ASD) 2024-25 reporting, the average cost per cybercrime for small businesses was $56,000, a 14% increase over the previous reporting period.  

In its 2025 survey, the Australian Institute of Criminology reported that one in four SMB owners and managers said cybercrime had negatively affected their business in the previous 12 months. 

 

The threats most likely to find you.

The ASD identifies scams and phishing attacks as a common way to target small businesses. Attempts may arrive through email, text messages, phone calls or social media and often impersonate someone the business or its employees trust (for example, the CFO) or a familiar organisation like a bank or primary supplier.

While these attempts, if spotted, may look innocent enough at a quick glance, they all spell out danger.

Examples include:

• A fake invoice for a new supplier sent to the accounts team
• A payment redirection request from a known contractor
• A Microsoft 365 login page which steals user credentials (login and password) 
• An ‘on sale’ or ‘closing down’ advert on Facebook that uses your good name to trigger impulse purchasing
• Ransomware delivered into your system through an email attachment 
• An unpatched remote access system – one that hasn’t had its security updates applied – discovered and exploited through automated tools that scan thousands of businesses simultaneously

None of these examples requires the attacker to know anything about your location. All that matters to them is that you may not have the systems that can identify and defend you from some of these attempts, or that you haven’t invested in the staff training needed to enable your employees to spot these scams. 

 

If not location, what makes you a target?

In short: Your digital exposure matters more than your location. 

Cybercriminals are interested in accessible accounts, valuable information like PII (personally identifiable information), and opportunities to redirect or extort money from you – to them. 

And it’s a group effort. 

Cybercrime groups share the latest tools, information, and techniques through dark-web forums and even sell ready-to-use scam tools and packages on marketplaces. Known as ‘cybercrime-as-a-service’, these marketplace offerings mean that targeting your business no longer requires any technical expertise. Anyone can buy and use the tools. Your size doesn’t protect you from that. 

 

Back to the original question: does your location matter?

Yes, it matters to the locals who depend on you for payments, payrolls, and goods and services. 

When you can’t operate normally, neither can those around you. Worse, it can often be their personal information as customers or employees that’s been held to ransom or stolen to resell or use fraudulently.   

And in a small town, a damaged reputation is a big thing. There’s nowhere to hide, and much to lose.

But does it matter to cybercriminals? No, it doesn’t. 

 

Where to start? 

Cybersecurity doesn’t need to start with a major project. The ASD’s small business cyber guide recommends these three starting measures:

1. Turn on multi-factor authentication – this adds another identity check, making it harder for someone who has stolen a password and is trying to access one of your users’ accounts
2. Keep your software updated – this makes sure that known security weaknesses can’t be identified and exploited
3. Back up your data and systems – so you can restore everything if you experience an incident

What else?

Say ‘no’ to shared accounts – instead, create separate accounts for each staff member so if a password is stolen, you can see whose account is affected, limit the damage, and remove their access if they leave. 

Create ‘no-go’ areas. No matter how small your team, everyone rarely needs to see everything. By restricting access to job requirements, a scammer who gains an individual’s credentials can only go so far in your system.

Educate your employees – don’t expect them to guess. Employees are your first line of defence – but only if they know what to look for. That knowledge doesn’t come naturally, so invest in non-negotiable and ongoing training.

Make a plan – and share it. If you are attacked, everyone needs to know what to do – and how to do it. So don’t just document who does what in an emergency, but like a fire drill, rehearse it.

Secure your software and systems. Either invest in the applications you need and appoint someone to monitor your cyber health (don’t forget nights, weekends, and public holidays), or ask your IT partner about round-the-clock managed services.

Adopt a cybersecurity framework to protect sensitive information and manage cyber risk effectively. SMB1001 is specially designed for small and medium businesses in Australia and provides a practical roadmap of achievable goals and actions. 

 

Wherever you are, we’ve got you covered. 

At A Corp, we place a high value on SMBs. We think Australia’s small and medium businesses are what make this country actually work. Without you, communities stop functioning, supply chains break down, and the people who depend on you every day are left in the lurch. 

So, we want you to be safe.

Like cybercriminals, we can engage with you wherever you are. But unlike them, our goal is to provide cybersecurity services and advice that give you, your employees, your customers, and your business the best possible protection.