The more a company’s infrastructure grows, the more weak spots it has. And that’s true for all companies — from large corporations with deep pockets that are able to invest more in their defenses, to small and medium-sized businesses. And despite their more modest capabilities, smaller companies are just as tempting a target for attackers.

New times, new risks

Cloud platforms, remote access, and AI help businesses scale up and get more done. But they also give attackers extra ways to get into corporate infrastructure. For example, remote employees’ personal devices have become a foothold that’s hard to control. And thanks to AI, phishing emails are almost impossible to tell from real ones: users can no longer spot a scammer by their spelling mistakes.

There’s another reason why new threats keep appearing: companies are slowly learning how to handle the old ones. Take backups. Just a few years ago they were sold as a cure-all against ransomware. Now they’re less effective, because at some point attackers started stealing data and demanding payment not for decryption, but for not making it public. What’s at stake here isn’t just business processes, but the organization’s reputation too. We wrote about this scheme in more detail in a separate blog post.

The scariest part is that an attacked company’s problems don’t end on the day of the incident. The next few days (or even weeks) are often much harder. This is when the team needs to quickly deal with the aftermath of an attack and to make sure another can’t happen again. Growing companies often have to throw their entire small IT force at the problem, so getting back to normal work can take a long time.

Three Achilles’ heels at once

According to the Global Kaspersky B2B Market Pulse survey, most SMBs only think about security when circumstances force them to; for example, after an incident, when expanding their infrastructure, or when a potential partner asks them to strengthen their perimeter before signing a contract. Yet only a handful treat continuous cybersecurity monitoring as a core part of running their business.

When a company finally decides to get serious about security, it runs into three constraints: people, processes, and technology. Let’s look at each one.

• People. In a company with up to 500 employees, the IT department is usually just a few people. They handle all technical issues and have little to do with cybersecurity. When things get tough, these specialists may simply lack the expertise to deal with things. Other employees can be a weak link too. Accountants, lawyers, and other staff with access to confidential information often aren’t familiar with security rules.
• Processes.A small IT department always has a backlog with a long queue of tasks; therefore, fresh updates and patches don’t get installed right away. As a result, attackers have plenty of time to take advantage of a vulnerability that isn’t fixed in time. Meanwhile, other employees may not know how to respond to suspicious emails, or how to store and share passwords safely. And there’s simply no one to keep an eye on them.
• Technology. Threats evolve alongside a business’s technology. For example, once a company has moved part of its infrastructure to the cloud, relying on a classic antivirus alone becomes pointless.

So small and medium-sized businesses become easy targets for attackers not so much due to their size, but because they don’t pay enough attention to the key building blocks of cybersecurity. As to what this can lead to, and how the tables can be turned in a company’s favor — read on for a real-world case that demonstrates this.

Case study: ERP system breach

Let’s look at a real-world attack on a company with 450 employees. When the incident happened, the company was migrating its ERP system to the cloud. The data had already been moved, but the protection hadn’t been set up yet. And that limbo state is exactly what let the attackers pull off their campaign.

The attackers used a fairly simple tactic. Posing as an external ERP integrator, they sent the finance department a file with an “adjusted invoice”. When an employee opened the attachment, the malicious code inside it exploited a vulnerability in a local application, and the attackers took control of the device. There they found saved credentials that let them log in to a support account and get administrator rights on the cloud ERP server. With that account, they got into the server and stole the company’s confidential data.

We analyzed the mistakes that made this incident possible, and came back to the same formula: people + processes + technology. The company did provide employee training, but it was mostly a formality and did nothing to help people learn to spot email phishing. Security updates weren’t installed right away either, which is why the computer had an unpatched vulnerability. On top of that, privileged credentials were stored right on the employee’s device, which gave the attackers a direct path to administrator access. Finally, the workstations had no EDR, and the cloud ERP server had no workload protection.

How SMBs can strengthen their defenses

The best way to start is with the three key areas we covered above. And this isn’t about simply throwing money at security. What’s needed is a clear, step-by-step plan that makes the most of the resources the company already has.

Hands-on training

Employees are a business’s first line of defense, so it’s especially important to help them form safe cyberhabits. Many companies understand this and duly run computer literacy training; however, often employees show up in droves, yet they keep on making the same old mistakes.

The problem is that most training isn’t relevant to the people taking it. People in the finance department know that attackers can send phishing emails, but what does that have to do with their job? To head off questions like that, we recommend combining cybersecurity theory with simulations of real cyberattacks. That way, employees can safely step into the shoes of an attacker’s target. Start by training employees who have privileged access to systems, and also those who handle confidential information.

To keep training from becoming a formality, track progress regularly. For example, send employees suspicious test emails from time to time, and measure how fast and how well they react: how many recipients click the link, and how many report the threat.

Structured processes

Set up clear priorities for installing updates and patches. This helps avoid two extremes: running for months with open gaps in the infrastructure, or rushing to fix every vulnerability without asking how critical it is for specific business processes. Setting up centralized vulnerability management also helps, which we explained how to do in a separate post. Don’t rush to expand the infrastructure or move it to the cloud until the company has proper protection and monitoring in place.

Another key point: assign an owner to every process. Someone should be personally responsible for regular cybersecurity training, installing updates, and the timing and methods of incident response. That way, security tasks get done on time — even when the IT team has limited resources.

Gradual rollout of security solutions

It’s impossible to build reliable business protection without specialized products, but buying everything at once won’t help either. New solutions should match the needs of the infrastructure. A good approach is to add tools as the need to do so comes up; for example, to prioritize vulnerabilities more effectively or to strengthen the security of email or cloud environments. One way to tailor security to the company’s needs is to use our Security Modules , which work with Kaspersky Next Optimum — a solution for growing SMB and mid-market businesses.

Another option is to move to a more advanced solution as the infrastructure grows. The foundation of cybersecurity can be laid with Kaspersky Next EDR Foundations, which provides basic endpoint protection and control. Then, when needed, the company can move up to solutions with a broader range of capabilities, from Kaspersky Next EDR Optimum to Kaspersky Next XDR Optimum, or straight to Kaspersky Next MXDR Optimum. Our most comprehensive offering — Kaspersky MXDR Optimum — combines advanced detection and response that goes beyond endpoints and adapts to the needs of a growing business, 24/7 monitoring, and proactive threat hunting and investigation by Kaspersky experts.

Here's the deal: when adversaries compromise your environment, they don't float around in abstract network flows. They execute on actual systems. They touch files, spawn processes, and mess with registries.

The premise of endpoint threat hunting is simple: if an adversary wants to accomplish anything meaningful, they must eventually execute code on a host. That execution leaves traces.

The Endpoint Advantage: Depth and Context

Endpoint hunting gives you deep, contextual visibility into adversary behavior. You're not inferring what happened from network packets; you're seeing exactly what processes ran, which files were touched, and what registry keys got modified.

Consider credential theft. An adversary running Mimikatz operates entirely in host memory and local file systems. Network detection might catch the tool's delivery, but it won't see the actual credential extraction. Endpoint telemetry captures the process execution, memory access patterns, and specific API calls—providing detection plus meaningful context.

The endpoint also provides crucial user and process context that network data lacks. Suspicious PowerShell execution? Endpoint telemetry tells you which user ran it, what parent process spawned it, what command-line arguments were used, and what it created. This process tree visibility is fundamental to understanding adversary techniques and distinguishing malicious from legitimate activity.

Your Visibility Stack

Effective endpoint hunting requires comprehensive telemetry:

Sysmon is remarkably powerful. This free Microsoft utility generates detailed logs covering process creation, network connections, file changes, registry modifications, and more. When properly configured, it can provide serious, high-fidelity visibility without the EDR price tag.

PowerShell Script Block Logging captures actual commands executed in PowerShell sessions. Given how heavily adversaries rely on PowerShell, these logs are invaluable.

Windows Event Logs provide foundational telemetry. Universally available, they often contain the first indicators that something's off.

Velociraptor brings digital forensics and incident response to scale. This open-source tool lets you hunt across thousands of endpoints simultaneously, collecting artifacts and running detection queries in real-time.

Wazuh provides centralized collection and analysis of endpoint telemetry. While not as feature-rich as a commercial EDR, it aggregates logs from multiple sources, applies detection rules, and gives you a hunting interface across your environment.

EDR platforms have their place, but you don't need expensive tools to start hunting. OS-native telemetry and open-source tools get you remarkably far.

What Endpoint Hunting Misses

External C2 communications present major challenges for endpoint detections. While endpoint tools capture network connections made by processes, they don't deeply inspect connection content. An adversary using encrypted C2 channels generates connections that endpoint logs record, but the malicious nature is often only apparent through network traffic analysis.

Lateral movement patterns across your environment are tough from a purely endpoint perspective. Network monitoring provides this visibility more naturally.

Living Off the Land: The Real Challenge

Modern adversaries "live off the land," using legitimate system tools (PowerShell, WMI, certutil) for malicious purposes. These processes are inherently legitimate; that is, endpoint telemetry shows their execution, but distinguishing malicious from benign requires understanding normal patterns and identifying behavioral anomalies.

This is where endpoint hunting earns its keep. Automated signatures struggle with legitimate tools. But hunters who understand both legitimate uses and adversary abuse patterns can spot differences. Legitimate admins rarely use certutil to download files. PowerShell downloading from pastebin is unusual.

The endpoint's rich context (command-line parameters, parent processes, user context) provides the clues needed to distinguish malicious from benign.

The Endpoint Imperative

Despite limitations, endpoint threat hunting remains essential. Adversaries must execute code, access files, and modify systems. These actions occur on endpoints and generate endpoint artifacts.

The depth that endpoint data provides is unmatched. For detecting privilege escalation, credential theft, defense evasion, and persistence, endpoint hunting isn't just useful—it's necessary. These tactics involve no network activity that distinguishes them from legitimate behavior.

The question isn't whether to invest in endpoint threat hunting, but how comprehensively you can implement it. Because in the assumed breach world we inhabit, adversaries are executing on your systems right now. Endpoint hunting is how you find them.