Why does 'we are too small to be a target' misread how most intrusions select victims?

## The claim, and why it feels reasonable `We are too small to be a target` is not stupid. It is a claim about intent — that an adversary weighs a list of companies, judges yours not worth the trouble, and moves on. That claim is even roughly true for a crew that works one victim at a time. The error is assuming every intrusion begins that way. ## Two orders There are exactly two orders in which selection and access can happen, and the difference decides almost everything else about the intrusion. **Selection after access.** The crew begins with a capability, not a victim. It takes a flaw in something that thousands of organisations expose on the internet — an internet-facing managed file-transfer product is the canonical case — and builds the population of instances. Certificate-transparency records publish hostnames as certificates are issued; resolvable names and responses to a connection on the service port turn those hostnames into a list of live, fingerprinted instances. Exploitation is then run against the whole list. The marginal cost of one more instance is close to zero, so there is no reason to filter first. Only after access exists does anyone look at what was caught: which organisations, which sectors, what is on the other side of the foothold. Some are worked by hand. Many are never touched at all. **Selection before access.** The crew has the company name before it has anything else. It spends weeks looking for a path — a supplier relationship, an exposed remote-access path, a person — and substitutes paths when one closes, because the victim is the fixed point and the route is the variable. ## Where size actually enters In the first order, size enters exactly once: at the ranking step, after you are already compromised. And even there it is not an exclusion. Cheap-to-monetise access is worked regardless of size — a mailbox that can invoice a customer, a foothold resold to somebody else, a small firm that happens to hold a larger organisation's data. A 40-person company with a reachable, unpatched instance of a widely deployed product is in the catch on identical terms to a 40,000-person one. The honest version of the phrase is therefore narrow: *we are unlikely to be worth a crew spending weeks reaching us specifically*. That may well be true. It says nothing about whether the exploit lands. ## What ATT&CK's shape encourages you to get wrong MITRE ATT&CK's Enterprise tactics begin with Reconnaissance, then Resource Development, then Initial Access. Read as a story, that sequence suggests every intrusion opens with study of a chosen victim. It is a catalogue of what adversaries do, not a claim that all of it happens, in that order, against you. In mass exploitation the reconnaissance is against a *population* and never mentions your name; `Exploit Public-Facing Application` (T1190) is where you enter the story, and the study of who you are happens afterwards, if at all. ## The control consequence The two orders are removed by different things, and this is why the question is asked at all rather than being a debating point. Against selection-after-access, the crew cannot substitute. Its method *is* one flaw times every enumerable instance. If your instance is not reachable, or not running the flawed version when the exploit is fired, you are not in the catch — not ranked low, absent. So shrinking what an internet-wide sweep can enumerate and patching quickly the few things that must stay reachable remove that order almost entirely. Against selection-before-access, the same spend only redirects. Close one path and the crew tries another, because your name is the fixed point. ## The twin error The mirror mistake is just as common and more expensive: reading a mass-exploitation compromise as a campaign aimed at you, and responding as though a determined adversary has chosen your company. Both errors come from the same missing distinction — the assumption that being compromised implies having been selected.