Most attacks on small businesses aren't sophisticated. They work because the basics were skipped.
Nobody is picking on you specifically
Small businesses get hit constantly, and it's rarely personal. Automated scanners crawl the internet all day looking for unpatched WordPress sites, weak passwords on admin panels, and inboxes that will open a fake invoice. When one finds you, the outcome is usually ransomware, a phished mailbox, or someone sending fake payment instructions to your bookkeeper. The attack being automated is the good news. You don't need a security operations centre to stop it. You need the boring stuff done properly.
Four things stop most of it
Unique passwords, kept in a password manager instead of on a sticky note. Multi-factor authentication on your email before anything else, because whoever controls your email can reset every other password you own. Updates applied when they come out, not six months later. Backups you've restored from at least once, because an untested backup is a hope, not a plan. None of this is expensive. Most of it is free. It just has to be done and kept done.
If you'd rather not think about this
We run managed security for businesses that have better things to do than patch servers at midnight. We watch the infrastructure, apply the updates, and deal with incidents when they happen. If you'd rather handle it yourself, we'll still tell you what to fix first. No charge for that conversation.
Not sure your backups would survive a ransomware attack? That's the first thing to ask us. We'll give you a straight answer, even if the answer is that you don't need us.