Walk into almost any contractor's office and you will hear some version of the same sentence: "We're too small for hackers to care about us." It is understandable. Headlines focus on large corporations, and a contractor with fifty employees and a stack of active jobs has plenty of other worries. But the assumption does not match how modern attacks work, and it leaves companies exposed. Here are five common myths and the realities behind them.
Myth 1: Attackers choose targets by name
Reality: Much of the criminal activity aimed at businesses is automated. Scanners look for exposed remote access, weak passwords and unpatched systems across the whole internet. Phishing campaigns go to huge lists of addresses. Your company does not have to be selected. It only has to be reachable and vulnerable.
Myth 2: We have nothing worth stealing
Reality: A contractor holds more valuable information than most owners realize.
- Bank and payroll information, including employee Social Security numbers.
- Bid pricing and margin data that competitors would love to see.
- Contracts, owner information and project schedules.
- Drawings and specifications that may be sensitive for certain facilities.
- Relationships with customers and vendors that can be used to commit fraud against them.
And even if your data had little value to a thief, your ability to operate does. Ransomware attackers do not need to sell your files. They only need you to want them back.
Myth 3: Our IT person or provider handles all of this
Reality: IT support and cybersecurity overlap but are not the same. Keeping computers running does not automatically mean someone is watching for intruders, enforcing multi-factor authentication, testing backups, or training staff. Ask directly: who is responsible for each of those, and how would we know if it was not being done? Security also depends on decisions only leadership can make, such as payment approval policies and acceptable use rules.
Myth 4: Antivirus is enough
Reality: Traditional antivirus is one layer, and a useful one, but modern attacks often rely on stolen passwords, legitimate tools and human deception. Defenses that matter include:
- Multi-factor authentication on email and remote access.
- Managed detection and response, so alerts get acted on at 2 a.m.
- Email filtering and impersonation protection.
- Prompt patching.
- Backups that are tested and cannot be deleted by an intruder.
- Training that reflects real scenarios.
No single tool covers all of them.
Myth 5: Cyber insurance will cover whatever happens
Reality: Cyber insurance can be valuable, but policies have conditions. Insurers often require specific controls, such as multi-factor authentication and backups, and may limit or deny coverage if they were not in place. Policies also contain exclusions and sublimits, and social engineering or wire fraud coverage is often treated separately. Read your policy and ask your broker what is covered and what controls are required.
What is actually true about smaller companies
Smaller firms often have fewer defenses, less documentation and fewer people watching for trouble. Attackers know that. At the same time, a smaller company has an advantage: it can change quickly. A few decisions made in a single leadership meeting can raise protection significantly.
A practical starting list
If you are starting from scratch, consider these steps in order:
- Turn on multi-factor authentication for email, banking and remote access.
- Write and enforce a payment verification procedure for changes to banking details.
- Confirm backups exist, include offsite or immutable copies, and have been tested.
- Keep systems patched and remove old accounts.
- Train employees with short, realistic sessions.
- Write a one-page incident response plan with phone numbers.
- Review insurance requirements and confirm you meet them.
None of this requires a large budget. It requires attention and follow-through.
A balanced view
It is not helpful to treat every contractor as an inevitable victim. Many attacks can be prevented or limited by basic practices, and companies that prepare often recover quickly. The goal is not perfect security. It is making your company a harder, less rewarding target than the next one.
Ironfield Cyber works with contractors of all sizes. If you would like an honest assessment of where you stand against this list, we can walk through it with you in a short review.