Answer extracted from the Young and Profiting with Hala Taha (Entrepreneurship, Sales, Marketing) podcast — listen to the full episode below.
Why do entrepreneurs commonly hold misconceptions about cybersecurity threats and attackers?
Most entrepreneurs operate from one of two false extremes: they either picture hackers as hobbyists in basements, or they believe attackers are exclusively sophisticated spy agencies and foreign governments. This polarized thinking blinds business owners to the reality that they hold valuable assets—customer databases and personally identifiable information—that make them attractive targets, and that small businesses often serve as entry points for attackers aiming at larger enterprises through supply chain compromise.
The damage from these misconceptions runs deep. When entrepreneurs dismiss their vulnerability by assuming attackers are either too unsophisticated or too focused on Fortune 500 companies to bother with them, they leave their most sensitive assets—customer data, payment information, intellectual property—completely exposed.
As Abed Hamdan explains in the episode, small business owners often fail to recognize that attackers have a deliberate strategy: target companies with fewer defenses to gain leverage against larger organizations. A compromised small business becomes a backdoor into an entire supply chain, multiplying the attacker's return on investment.
Why small businesses are high-value targets
The misconception that "we're too small to be worth hacking" is perhaps the most dangerous assumption an entrepreneur can make. In reality, attackers prioritize businesses with weak defenses over those with advanced security infrastructure, regardless of company size. Your customer database, employee credentials, and access to partner systems are all tradeable goods in the cybercriminal economy.
When a startup announces rapid growth—"We went live last week and expected 200 clients but now have 2,000"—it signals to attackers that the team is overextended and security protocols are likely improvised or non-existent. This red flag is discussed in detail in the podcast episode, where Hamdan identifies visible signs that a company is vulnerable: rapid scaling, public announcements of hiring freezes or understaffing, or admissions that teams are "barely keeping up."
Supply chain attacks represent the true business risk that most entrepreneurs overlook. Your company's security weakness becomes a liability for your partners and clients. If a hacker breaches you to access a larger customer's systems, both your reputation and your business relationships collapse—often irreversibly.
From assumption to action
The path forward requires rejecting both extremes and adopting a realistic threat model. You don't need to believe every hacker is a state-sponsored operative, and you shouldn't assume attackers are incompetent. Instead, acknowledge that cybersecurity professionals assess threats based on asset value and exploitability, not company size. This shift in perspective changes everything about how you prioritize security investments.
"They always target the vulnerable. They always target the young. It is a problem and we need some kind of a strict regulation."
Abed Hamdan — Founder, GRC Mastery. With more than two decades of cybersecurity and risk management experience, Hamdan is known online as "the Unix guy." He built his expertise starting in the late 1990s and early 2000s through IRC chat rooms and self-directed learning, and his personal website unixsky.com predates Google by several months. He now consults for organizations across multiple sectors, including beverage companies in Australia, conducting cybersecurity assessments and developing risk strategies.
If you're curious about the specific technical tactics attackers use—including how a convincing phishing email can be deployed in minutes, or what warning signs to watch for in your own systems—the full episode provides concrete, actionable methods for building a practical defense posture, regardless of your budget or IT maturity.
Key takeaways
- Entrepreneurs typically fall into one of two false extremes: either underestimating attackers as basement hobbyists, or overestimating them as exclusively state-sponsored operatives.
- Small businesses are high-value targets because they hold valuable customer data and personally identifiable information while maintaining weaker security defenses.
- Small business compromises frequently serve as supply chain entry points for larger attacks, making your security a shared responsibility with your partners and clients.
- Visible signals of vulnerability—rapid growth announcements, understaffing admissions, or operational chaos—attract attackers more reliably than company size or industry sector.
See also
What strategic shift did Lewis Howes make regarding YouTube monetization and content strategy?
For five years, Lewis Howes invested in a videographer and editor to film and post podcasts on YouTube without monetizing them, avoiding running ads or seeking revenue from that channel while focusing on building audience reach instead.
How did early adoption of LinkedIn and podcasting provide competitive advantage in building a personal brand?
Lewis Howes started on LinkedIn in late 2007 when only 12 million people were on the platform and wrote one of the first books about LinkedIn in 2009, capturing first-mover advantage when these channels were still undercrowded.
What is a 'sweet spot' and how can entrepreneurs discover theirs to find meaningful work?
A sweet spot is the intersection between your unique talents and skill sets and the available tools and mechanisms you can monetize through them, allowing entrepreneurs to align their abilities with market opportunity.