Attackers don't do bespoke work at SMB scale
It is tempting to assume attackers won't bother with a small company. The uncomfortable truth is the opposite: at SMB scale, attackers don't bother with you specifically — they scan everyone, continuously, with automation. New cloud IPs get probed within minutes of going live. The question isn't whether your environment gets looked at; it's whether the automated look finds anything. Four categories of findings account for the overwhelming majority of what it finds.
The four findings
Public storage. An S3 bucket, Azure blob container, or GCS bucket left readable by the internet — usually created "temporarily" for a data hand-off or a static site, then forgotten. Scanners enumerate names and pull whatever answers. The fix is boring and total: block public access at the account level, allow exceptions deliberately, and treat every public bucket as a finding until proven intentional.
Over-permissive IAM. Wildcard policies, admin roles handed out to unblock a sprint, service accounts with far more reach than their job requires. Over-permission is invisible until a credential leaks — and then it converts a small incident into a full compromise, because the stolen identity can touch everything. Least privilege isn't a virtue here; it's blast-radius control.
Exposed management ports. SSH, RDP, and database ports open to 0.0.0.0/0. Internet-exposed RDP in particular remains one of the most reliable ransomware entry points in existence, absorbing constant credential-stuffing. Management access belongs behind a VPN, a bastion, or your cloud's session tooling — not on the public internet with a password as the only gate.
Stale credentials. Access keys created years ago and never rotated, accounts belonging to departed employees, tokens embedded in code and shipped to a repo. Credentials age into liabilities silently, which is why offboarding rigor and key rotation show up in every serious framework — and why the account nobody remembers is the one that gets used against you.
Why these four persist
None of these are exotic, and none are hard to fix individually. They persist because they are invisible in aggregate: each one lives in a different console, was created by a different person, and looks reasonable in isolation. Without a single inventory and continuous checking, "do we have any public buckets or open management ports?" is a question nobody can answer confidently — and unanswerable questions don't get fixed.
That's the actual job of posture management: keep one picture of everything you run — clouds, devices, identities — check it continuously against exactly these patterns, and hand you the fix. Cybermatic surfaces all four categories with plain-English explanations of how an attacker would use each finding, plus remediation code written against your real resources.
Related on the platform