A live cyber attack map is a screensaver with a marketing budget. Every few weeks one lands in a Charlotte business owner’s feed: a dark globe, glowing arcs from Russia to Virginia, a counter ticking past 100,000 attacks today. It looks like a war room. It tells you almost nothing about whether your own business is in danger, and the two things it never shows are the two things that actually matter to a company with 20 or 50 people.
What the arcs actually are
Most public attack maps are built by a security vendor to demonstrate its product, or by an ad-supported site to hold your attention. The data behind them is real in the same way a weather map is real: it is a sample of what one company’s sensors happened to see, drawn to look continuous. The better-known maps come from large network operators and firewall vendors and show blocked scans, denial-of-service traffic and malware call-backs across their own customer base. One popular independent map states on its own page that it mixes network data with “supplemental threat telemetry for visual enrichment,” which is a polite way of saying some of the arcs are there to look good.
Three things are true of every one of them:
- The “source” country is where a compromised machine sits, not where the attacker is. Arcs from Brazil or India are usually rented servers and infected home computers, not people.
- The counts are scans, not break-ins. Automated scanning hits every public address on the internet all day. A firewall logging a blocked scan is the system working, not an attack in progress.
- Your business is not on the map. The map shows the vendor’s sensors. Unless you are a customer feeding it data, your network is not represented, and even then you would not be able to find it.
The two things no map shows you
1. Whether someone already has a login
The attacks that cost small businesses money in 2026 do not look like arcs. They look like a correct password typed into Microsoft 365 from a browser in another state, followed by a new inbox rule that forwards every message containing the word “invoice.” Business email compromise is the costliest category in the FBI’s Internet Crime Complaint Center reports year after year, and it generates no traffic a global map would ever draw. It is detected by watching your own sign-ins, your own mailbox rules, and your own devices, which is what 24/7 monitoring means when it is done properly.
2. Which of your systems has a hole that is being used right now
Attackers do not spread their effort evenly across the globe. They go where a known, unpatched flaw is. The list of flaws being exploited in the wild is public and free: the CISA Known Exploited Vulnerabilities catalog, updated as new entries are confirmed. An IT provider who is doing the job checks that catalog against your inventory, patches routine updates on a weekly cycle, and patches anything critical immediately rather than waiting for the cycle. A map cannot do that because it does not know what you run.
If you like the data, use the real sources
- Cloudflare Radar: the traffic and attack data most independent maps borrow from, with a methodology page and country filters.
- CISA Known Exploited Vulnerabilities: what is actually being attacked, by product and date.
- FBI IC3 annual report: what it cost, by crime type and by state, including North Carolina.
- The Verizon Data Breach Investigations Report: how small businesses actually get in trouble, with the human element in most cases.
Those are the sources an insurer, an auditor or a client’s security questionnaire will accept. A screenshot of a glowing globe is not.
Two things to check this week instead
- Pull the list of everyone who can sign in to your Microsoft 365 or Google Workspace without multi-factor authentication. If your IT provider cannot produce it in a day, that is the finding. MFA and least-privilege access stop the attack the map never shows.
- Ask when your last successful backup restore test was, and get the date. Not “backups are running.” The date a restore was tested and worked. If nobody knows, you have no backup, you have a hope.
If both answers come back clean, you are ahead of most Charlotte businesses your size. If either one does not, a cyber risk assessment takes about two hours and tells you the rest.
Where Network Essentials stands
We do not run an attack map, and we do not sell fear. Network Essentials has been independently owned in Charlotte since 2002 and is CISSP-led. Our clients get 24/7 monitoring of their own sign-ins, devices and mailboxes by a managed security operations center, routine patching every week and critical patches applied immediately, tested backups, and after-hours emergency support when something real happens. Engagements are a flat monthly fee with a minimum of $2,000 per month and no long-term lock-in. Call (704) 206-8900 or request a free IT audit.
Frequently asked questions
Are live cyber attack maps real?
The data is real but partial. Each map shows what one vendor’s sensors saw, drawn to look continuous, and some maps add decorative traffic. None of them shows your network.
Does an attack map show attacks on my business?
No. Attacks on a specific small business are only visible in that business’s own logs: sign-ins, mailbox rules, endpoint alerts and firewall events. That is what a monitoring service watches.
What should a Charlotte small business watch instead?
Three things: who can sign in without MFA, whether the CISA exploited-vulnerability list matches anything you run, and the date of your last tested backup restore.
Where can I get trustworthy cyber threat data?
Cloudflare Radar for live traffic data with methodology, CISA’s Known Exploited Vulnerabilities catalog, the FBI IC3 annual report for losses by state, and the Verizon Data Breach Investigations Report for how breaches happen.
