Ask a contractor whether the company is a likely target for cybercriminals and the answer is often a shrug. We build things, we are not a bank. That instinct is understandable, and it is also the reason many firms leave basic gaps open. Here are the beliefs we hear most often and what is actually true.
Myth: We are too small to be a target
Reality: Attackers rarely pick victims by name. Much of the criminal activity is automated or opportunistic, scanning for exposed services, reused passwords, and unprotected email accounts. A smaller company with weak controls is easier to compromise than a large one with strong ones. Small firms also have fewer people to notice something odd and less time to recover.
Myth: We have nothing worth stealing
Reality: You have more than you think. Payroll and personnel records, bank account details, customer and subcontractor information, bids and pricing, and drawings for sensitive facilities all have value. Even if none of that mattered, the ability to disrupt your operations has value, since a contractor facing a missed deadline may be willing to pay to get systems back. Your email account can also be used to defraud your customers and vendors.
Myth: Our software vendor handles security
Reality: Vendors secure their platforms, but you control who has access, how they sign in, and what is shared. Most account takeovers happen because of a stolen password or a missing second factor, not a flaw in the vendor's software. Security is shared, and the customer's half includes user accounts and settings.
Myth: Antivirus is enough
Reality: Traditional antivirus catches known malware but struggles with newer techniques and with attacks that use legitimate tools or stolen credentials. Modern endpoint protection with monitoring looks at behavior and can contain a threat quickly. Antivirus alone also does nothing about phishing for credentials, payment fraud, or unpatched systems.
Myth: Our backups protect us
Reality: Backups are essential, but they only protect you if they are complete, recent, protected from attackers, and tested. Attackers deliberately seek out backups. A backup on a drive that sits connected to the server may be encrypted along with it. Untested backups fail more often than people expect.
Myth: Strong passwords are enough
Reality: A strong password can still be phished, reused on another breached site, or stolen by malware. Multi-factor authentication adds a layer that makes a stolen password much less useful. It is not perfect, since attackers sometimes try to trick people into approving prompts, but it blocks a great many attacks.
Myth: Cybersecurity is the IT person's job
Reality: IT implements controls, but most incidents involve decisions by ordinary employees: clicking a link, approving a payment, sharing a file. Leadership sets expectations about verification and priorities. Security works best when owners, finance, and operations treat it as a business risk, like safety.
Myth: If we are breached, we will know right away
Reality: Attackers often spend days or weeks inside a network before doing anything visible. In payment fraud, the first sign may be a vendor asking why they have not been paid. Monitoring and alerting help shorten the time between compromise and detection.
Myth: Compliance means we are secure
Reality: Meeting a standard shows you have a baseline in place, but it does not make you immune. The reverse also holds: good security without documentation may not satisfy a customer. Aim for both.
Myth: Security is too expensive for us
Reality: Some of the most effective measures are inexpensive or already included in tools you pay for: multi-factor authentication, call-back verification for banking changes, patching, and tested backups. The costly part is usually cleaning up after an incident. Start with the basics and add layers as the company grows.
Myth: Our field crews are not part of this
Reality: Field staff use phones, tablets, and email, and they receive phishing messages like everyone else. Their devices connect to project systems and often hold sensitive files. Include them in training and device management.
What to do with this
Pick one belief that sounds familiar and take one action this week. Turn on MFA for an unprotected system. Ask your IT provider when the last restore test happened. Write down your call-back rule for banking changes. Small steps taken consistently matter more than a grand plan that never starts.
A conversation with Ironfield Cyber
Ironfield Cyber offers straightforward security reviews for contractors and energy companies. We will tell you what is working, what is not, and what to fix first, without jargon or scare tactics.