IDENETY AI Intelligence Suite
Written by the engineers who built our real-check scanning tools
San Antonio is one of the fastest-growing business markets in the country. That growth has made it a prime target for cybercriminals who specifically hunt small and mid-sized businesses — organizations with real data and real money, but without enterprise-grade defenses.
Our AI Zone Intelligence Scanner has run checks on thousands of San Antonio business domains over the past 12 months. What we've found is alarming: over 68% of local SMBs have at least one critical or high-severity vulnerability exposed to the public internet — and most have no idea.
Here are the seven threats we're seeing most frequently, what they mean for your business, and what you can do right now.
1. Missing or Broken Email Authentication (DMARC/SPF/DKIM)
This is the single most common finding in our scans. Email authentication records — DMARC, SPF, and DKIM — are DNS records that tell the world which servers are allowed to send email on your behalf.
When these are missing or misconfigured, attackers can send emails that appear to come from your domain. Your customers, vendors, and employees receive what looks like a legitimate message from you — asking them to wire money, click a link, or share credentials.
What we see: 71% of San Antonio SMB domains have no DMARC record. Of those that do, 40% are set to `p=none` — which monitors but does not block spoofed email.
What to do: Implement SPF, DKIM, and DMARC with at minimum `p=quarantine`. Work with your IT provider to move to `p=reject` once you've confirmed legitimate mail flows are covered.
2. Ransomware via Unpatched Remote Access
Remote Desktop Protocol (RDP) and VPN endpoints that haven't been patched are the #1 entry point for ransomware in 2026. Attackers scan the entire internet for exposed RDP ports and known-vulnerable VPN appliances — it takes them minutes to find yours.
Once inside, they move laterally across your network, encrypt your files, and demand payment. The average ransom demand for a San Antonio SMB is now $185,000. Recovery without paying — if you have backups — still costs an average of $65,000 in downtime and labor.
What we see: Our scans regularly find businesses running RDP exposed directly to the internet with no network-level authentication, and VPN appliances running firmware that's 18+ months out of date.
What to do: Move RDP behind a VPN or Zero Trust Network Access (ZTNA) solution. Implement a patch management program that covers network appliances, not just workstations.
3. No Multi-Factor Authentication on Critical Systems
Passwords get stolen. They're sold on dark web marketplaces for as little as $4. Without MFA, a stolen password is all an attacker needs to access your email, your accounting software, your cloud storage, or your line-of-business applications.
What we see: Most SMBs have MFA enabled on Microsoft 365 — but not on their VPN, their backup systems, their DNS registrar, or their domain registrar. Those gaps are exactly what attackers exploit.
What to do: Audit every system that has internet-facing login. Enable MFA everywhere — not just email. Prioritize financial systems, DNS/domain registrar, and backup portals.
4. Exposed Admin Panels
Web-based admin panels — for routers, firewalls, NAS devices, and web applications — that are accessible from the public internet are a constant target. Our scanner probes for common admin paths (`/admin`, `/wp-admin`, `/phpmyadmin`, etc.) and finds them exposed on a significant percentage of business domains.
What we see: 23% of scanned domains have at least one admin interface reachable from the public internet without IP restriction.
What to do: Restrict admin panel access by IP address or move it behind a VPN. If you're running WordPress, use a security plugin that blocks admin access from unknown IPs.
5. Weak or Missing Security Headers
HTTP security headers are instructions your web server sends to browsers that tell them how to handle your site's content. Missing headers like Content-Security-Policy, X-Frame-Options, and HSTS leave your site and your visitors vulnerable to clickjacking, cross-site scripting, and man-in-the-middle attacks.
What we see: 84% of San Antonio SMB websites are missing at least three critical security headers. This is one of the easiest fixes in security — and one of the most commonly ignored.
What to do: Configure your web server or CDN to send the recommended security headers. This is a 30-minute fix for a competent IT provider.
6. No Wildcard DNS Protection
Wildcard DNS records (`*.yourdomain.com`) resolve any subdomain to your server. If an attacker can create a subdomain on your domain — through a misconfigured DNS record or a compromised registrar account — they can host phishing pages that appear to be part of your legitimate domain.
What we see: Wildcard DNS is present on 31% of scanned domains, often as a leftover from a previous hosting configuration that was never cleaned up.
What to do: Audit your DNS records. Remove wildcard entries unless you have a specific, documented need for them. Enable registrar lock and MFA on your domain registrar account.
7. Missing CAA Records
Certification Authority Authorization (CAA) DNS records specify which certificate authorities are allowed to issue SSL certificates for your domain. Without them, any CA can issue a certificate for your domain — which means an attacker who can trick a CA (through social engineering or a CA compromise) can get a valid certificate for your domain and use it to run convincing phishing attacks.
What we see: 91% of scanned domains have no CAA records.
What to do: Add CAA records to your DNS that restrict certificate issuance to the CA(s) you actually use (typically Let's Encrypt, DigiCert, or Sectigo).
What to Do Right Now
The fastest way to see which of these issues affect your domain is to run our free AI Zone Intelligence Scan. It checks all six of these categories in real time — no signup required, results in under 60 seconds.
If you want a human engineer to walk through the findings with you and build a remediation plan, book a free IT assessment. Our team has fixed every one of these issues for hundreds of San Antonio businesses — we know exactly what it takes.
Download this article as a PDF
Includes IDENETY Zone Intelligence branding · Shareable with your team
See how your network actually scores
Our AI Zone Intelligence Scanner checks your domain for the exact vulnerabilities covered in this article — in under 60 seconds. Free, no signup required.
Contact Us
Services
