Do cybercriminals exist just to make excuses? Sometimes it seems that way…

There’s a logical explanation for why this excuse comes up so often: many organizations feel they are unique. Their cultures, business processes, and work processes are, of course, different. However, when you take a closer look at human behavior, organizations turn out to be surprisingly similar.

In practice, for example, we sometimes hear people in elementary schools say, “Awareness training doesn’t work for these colleagues because they just want to be in front of the class.” Or in the legal profession: “Our hourly rates are too high to take a training course.” Every industry has its own “we’re-different” excuse, but that shouldn’t be a reason for your organization to be shut down. Moreover, the average time commitment for a good information security awareness program is about 15 minutes per month per employee. Every organization should be able to manage that, especially if it significantly reduces the risk of successful attacks.

This statement, too, is based on real-world experience. These are companies that operate “behind the scenes”, often for larger organizations. That’s where they earn their money, and there’s no need for them to take take center stage the the forefrontthemselves. Unfortunately, this doesn’t work that way in practice. Criminals scan the entire internet for known vulnerabilities, regardless of the potential victim’s reputation, size, or industry. You could therefore be a target without even realizing it. 

This excuse could risky be, because compliance with laws and regulations – for example, holding an ISO 27001 certification in the field of information security – is merely a snapshot. You’ve demonstrated that the processes related to security are in place . However, that alone does not mean that you are well protected against cyberattacks. After all, what if yesterday an insecure application connected to your website was accidentally put into use?  

This excuse overlooks two important points. First of all, cybersecurity is not just a technological issue; most attacks stem from human behavior. Second, an increasing number of threats come from outside sources that have nothing to do with the corporate network—and thus the firewall. For example, this could involve an employee unknowingly using an insecure cloud application or app. Or threats could originate from trusted partners who, in turn, turn out to have been compromised. This is also why a security policy is so important. Do your colleagues know exactly what they are and aren’t allowed to do while working from home? Is your supply chain mapped out, and are supply chain partners monitored?

Unfortunately, the reality is different: One-third of Dutch small and medium-sized businesses were targeted by a cyberattack in 2025. This information comes from an article in Channel Connect*.

There is also a significant difference between large and small businesses: “In 2025, 86 percent of large businesses (with 250 or more employees) implemented ten or more of the twelvemeasures surveyed, compared to 13 percent of businesses with 2 to 10 employees,” we read in an article by the CBS**. So don’t underestimate the fact that, as a small(er) business, you can be an easy target. Criminals are opportunists; they don’t think in terms of big or small, but in terms of opportunities.

We could have come up with many more excuses, such as: “no time” or “we’ve never experienced anything like this before.” However, just because you don’t see or notice anything doesn’t mean that something isn’t already happening behind the scenes.

So it's not about which excuse you recognize, but rather the question: What are you going to do differently today?