What Attackers See When They Scan a Business They Decide Not to Attack
Attackers don't choose their targets the way you might imagine — a person researching your business, deciding you're worth their time. Most SMB targeting is fully automated. A scanner runs. It finds gaps or it doesn't. What it doesn't find is what keeps you off the list.
Somewhere right now, an automated tool is scanning your domain. It's not a person — it's a script running across thousands of businesses simultaneously, looking for the same handful of gaps it always looks for. Open RDP port. Missing DMARC enforcement. Credentials in a breach database. Admin panel exposed to the public internet. Known unpatched CVE on an internet-facing service.
If it finds any of those, your domain goes into a queue. If it doesn't, it moves on. The decision takes milliseconds and involves no human judgment whatsoever.
This is the most important and least understood fact about how SMBs get attacked in 2026: targeting is automated, not curated. Attackers aren't choosing you because they know who you are. They're choosing you because your scan results looked like an easy entry. The businesses that don't get attacked aren't necessarily running enterprise security programs. They're the ones whose scan results gave the automated tool nothing to work with.
What the automated scan actually looks for
Here is what a standard automated reconnaissance scan checks when it hits your domain. These are the specific signals that appear in documented SMB breach investigations, the items cyber insurers verify before issuing policies, and the checks in the 30-minute audit earlier in this series. The scan takes minutes. The gaps take minutes to find.
That scan ran against thousands of businesses in the time it took you to read this far. Most of them failed it. The ones that didn't fail it didn't get added to the queue. Now here's what the same scan looks like on a business that passes it.
The six checks — what clean looks like on each one
1. Credential exposure
✓ CleanHow to get there: haveibeenpwned.com domain search → set up free notifications → change exposed passwords → deploy a password manager so reuse can't recur.
2. Email authentication
✓ CleanHow to get there: Check current policy at mxtoolbox.com/DMARC.aspx → work with your DNS provider to set p=reject → verify with mxtoolbox.
3. Perimeter ports
✓ CleanHow to get there: Search your domain at shodan.io → identify open high-risk ports → route remote access through VPN → close or restrict public-facing ports.
4. Patching discipline
✓ CleanHow to get there: Enable automatic updates on internet-facing systems → prioritize Critical CVEs within 48 hours → minimize the number of services with public internet presence.
5. MFA coverage
✓ CleanHow to get there: Audit every system for MFA enforcement → enable number matching in your identity provider → block legacy authentication protocols → include all admin accounts.
6. Access hygiene
✓ CleanHow to get there: Pull active user list → compare against current roster → disable unnecessary accounts → check email forwarding rules in your admin console.
What your CyberScore actually measures
This is the positive version of every post in this series. The password policy post, the MFA bypass post, the credentials for sale post, the 60-minute attacker timeline — all of them described what happens when one of these six checks fails. This post describes what it looks like when they all pass.
What a clean scan result looks like
No credentials in breach databases. DMARC at p=reject. No high-risk open ports. No unpatched critical CVEs. MFA fully enforced with number matching. No stale accounts or excess access. The automated scanner finds nothing to work with. Your domain gets skipped. The attacker moves on to the next target — which is almost certainly one of the 43% of SMBs that failed one of these checks today.
The question that changes how you think about security
Most SMB owners think about cybersecurity as a question of spending. How much do we invest? What tools do we buy? How does our budget compare to the threat?
The automated scanner doesn't care about your budget. It cares about your scan results. A business spending $500/month on a password manager, DMARC enforcement, MFA with number matching, and continuous credential monitoring can pass all six checks. A business spending $5,000/month on endpoint detection and response but leaving RDP open and DMARC at p=none will fail two of them before the scan gets to anything sophisticated.
The question isn't "how much are we spending on security?" It's "what does our scan result look like right now, today, to the automated tool that just ran against our domain?"
If you don't know the answer — and most SMB owners don't — you don't know whether the next automated scan adds you to the queue or moves on.
📚 Credential Security Series — Read the full series
See your scan results before the attacker does. Veriti Spottr's beta is free.
Join the free beta →
Comments
Post a Comment