Cyber criminals seek the easiest path to a pay day, often targeting small and medium-sized organizations with high-value assets—but with limited security defenses.