At a recent meeting of The Presidents Forum, we talked broadly about cybersecurity. A 2025 Pew Research Center study found that 73% of U.S. adults had experienced an online scam or attack, such as credit card fraud, ransomware, or an online shopping scam.

Two weeks ago, I became one of those statistics.

I experienced a serious hack. The business consequences of the unauthorized access included fraudulent emails sent in my name, hours spent changing passwords and strengthening protections, concern about what information may have been seen, and the lingering uncertainty about consequences that may not become apparent immediately. It caused days of angst.

This past week, we read that even the FBI was dealing with a cyberattack. The FBI publicly acknowledged that it was investigating a compromise of its jobs portal and the possible exposure of employee PII (Personally Identifiable Information.)

A small-business consultant and one of the world’s most sophisticated law-enforcement organizations obviously operate on completely different scales. Yet both experiences illustrate the same point: no organization can assume it is too small, too careful, or too sophisticated to be targeted.

But the larger message is more nuanced: cybersecurity isn’t simply an IT problem; it’s a business risk.

In our meeting, we talked about what would happen tomorrow if someone gained access to our systems or email. Could they impersonate us with customers, employees, vendors, or our bank? What confidential information could they see? How quickly could we shut them out? Who would we call? Are MFA and unique passwords in place? Do we know all the third-party systems that hold sensitive company or employee information?

The FBI incident also raises another important point for small businesses: our cybersecurity exposure extends beyond our own computer systems. The FBI said it was investigating whether the breach occurred within its own enterprise or through a third-party provider supporting the jobs portal. That’s directly relevant to small businesses increasingly dependent on cloud software, payroll processors, banks, accountants, CRMs, and other outside providers.

Cybersecurity is one of those business risks that is easy to put off because everything worked yesterday. My experience taught me that the cost of prevention should not be compared with zero. It should be compared with the time, expense, disruption, and uncertainty that follow when something goes wrong.

This discussion certainly left the members thinking differently about their own risks, and what they should be doing today to prepare for something they hope never happens.