Nobody picked your firm. A scanner found it in hours.

Microsoft's latest Digital Defense Report put a number on something I've been saying to clients for years: exposed cloud workloads were attacked within 5.3 hours, on average.

Not 5.3 days. Hours.

Here's what that means for a 15-person firm in Palm Beach or Stuart. Nobody sat down and picked you. No attacker looked at your website, saw a small practice, and decided you were worth the effort. The scanning is automated and constant. It finds whatever is exposed, and it doesn't check your headcount first.

That's why "we're too small to be a target" is the most expensive sentence I hear. It isn't a bad guess about attackers. It's a misunderstanding of how any of this actually works.

The same report found 63% of intrusions involved data theft, and that the overwhelming majority of phishing attachments were after one thing: a working set of credentials. One login. That's the whole play.

The good news is the defense hasn't gotten exotic. Phishing-resistant sign-in, tight admin accounts, and actually knowing what you've exposed to the internet still do most of the work. Most of it is sitting in Microsoft licensing you already pay for.

Worth an honest look before your next cyber renewal.