Forgot a couple things...
In my experience, many small businesses have no clue about their computers. They can't tell you when they bought them, whether they're still under warranty or not, or anything about them. Somebody set them up for them long ago and now all they know is they just turn them on, click on a couple well-worn icons and that's about it. They don't think about them until they break and then they're in a panic, call everybody in the phone book until they can find the first person to come in the quickest.
From an IT perspective, by "small business" I mean a half-dozen or fewer computers, may or may not be networked on the same workgroup, may or may not have a server, and if they do, it's only one... probably old and low-cap, and may even be a workstation functioning in a file-sharing role they call their "server".
You will also find computers on the floor, surrounded by boxes, supplies and other debris... and I guarantee if you pop the side panels you'll have enough dust and lint to fill a couple hobo pillows. Cat5 cable labeling or a network diagram? What's that? Original disks? "Oh, I dunno, they're around here someplace... maybe." UPS that don't hold charge anymore, or things like fans, radios, lamps, etc. plugged into the battery side. Surge protectors that came from ACE hardware and have already taken more than their share of hits... or worse, no surge protectors at all... just a five-dollar power strip. Backups? Hah! PC's bought at Best Buy, Circuit City, Wal-Mart, with XP Home or Vista Basic with all the OEM crapware still installed (and probably missing service packs and MS updates besides) and expired OEM trial antivirus, or AVG Free (old versions). Non-business related software (Limewire, Yahoo! Messenger, Facebook, MySpace, AOL Messenger, BitTorrent clients, cutesy icons and mouse pointers, hijacked search engines, multiple toolbars... the list of bad actors, characters and desperados is endless).
For these businesses, there's obviously lots of potential opportunity. It all comes down to whether your risk assessment sinks in, how serious they take it and how much they're willing to spend to get legal, clean and safe.
Larger businesses... especially professional firms (law, accounting, architects, medical, dental, etc.) usually already have someone who is their "goto" guy or company. That doesn't mean they're well-serviced, though, and that's an opportunity for you. If you have businesses like this already and they're not on a maintenance contract (highly recommended), it becomes really important that you stop by and show your colors at least a couple times a year. "Out of sight, out of mind" can be a killer if it's you, and a business opportunity if it's the other guy.
One thing that I've found that works well for me is when I do a cold call on a business is to offer them a free site analysis and risk/vulnerability assessment. Do not include pricing on your initial report... just point out the deficiencies and the potential impact & importance to them. Save the pricing discussion for your next (hopefully, paid) visit.
