Invisible by Default: The Five Vulnerability Classes SMBs Don't Realize They Have

Small and mid-sized businesses (SMBs) are routinely described as careless about cybersecurity — under-resourced, inattentive, unwilling to invest. This paper argues that the dominant risks SMBs carry are not ignored but unseeable: rendered invisible by the ordinary structure of how a small business operates, not by any failure of will. We distinguish risks that are visible-but-hard from risks that are invisible-by-structure, and show that the latter persist even in a maximally diligent SMB, because seeing them requires a vantage point the organization’s own structure does not contain. We name two families of structural invisibility — accumulation and expansion — and, within them, five vulnerability classes: configuration drift, identity sprawl, shadow automation, AI-assistant exposure, and vendor surface. We argue that because these risks are invisible by default, the first necessary intervention is not a control or a policy but visibility itself — an external instrument that makes the invisible legible. The paper closes with the practical consequence (why a diagnostic must precede remediation) and situates the argument within the substrate-governance view that the most consequential risk lives at the layer beneath the tools an organization can see.