Artificial intelligence is changing a lot about the way we work, but unfortunately, it is also changing the way cyber criminals work.
OpenAI recently joined more than 100 organisations, including Microsoft, Google, Sophos, CrowdStrike, Cisco and others, in issuing a warning that AI-enabled cyber attacks are likely to become considerably more widespread and sophisticated.
That sounds fairly dramatic, but for most small businesses the response does not need to be.
You probably don’t need a new collection of expensive security products. You do need to make sure the fundamentals are actually being done properly.
AI isn’t creating an entirely new problem
Most cyber attacks still rely on familiar weaknesses.
Poor passwords. Accounts without multi-factor authentication. Old software that hasn’t been patched. Staff being tricked into opening something they shouldn’t. Users having more access than they actually need.
AI simply makes it easier for attackers to work faster and at a much larger scale.
One of the most obvious examples is phishing.
We are already moving away from the badly written scam emails that were relatively easy to recognise. AI can produce convincing emails in seconds, imitate the tone of a supplier or colleague and use information gathered online to make a message look considerably more believable.
That means relying on someone noticing bad spelling or an unusual-looking email isn’t much of a security strategy anymore.
What should a small business actually do?
The good news is that many of the most effective protections are not particularly exotic.
Use multi-factor authentication everywhere you reasonably can
A stolen password shouldn’t be enough to access your email, Microsoft 365 account or other important business systems.
MFA remains one of the simplest ways to make a compromised password considerably less useful to an attacker.
Keep computers and software patched
Updates aren’t just about new features.
Windows, browsers, Microsoft 365 applications, firewalls and other software regularly receive fixes for security vulnerabilities. Once those vulnerabilities become publicly known, attackers can start actively looking for systems that haven’t been updated.
Ignoring updates indefinitely is becoming increasingly difficult to justify.
Protect email properly
For most small businesses, email is still one of the most likely ways an attacker will get through the front door.
Spam filtering, anti-phishing protection, MFA and sensible email security policies all matter.
But there is also a human component.
If an email suddenly asks you to change a supplier’s bank account details, purchase gift cards or send sensitive information, verify it another way before acting on it.
A quick phone call can prevent a very expensive mistake.
Don’t give everyone access to everything
If somebody only needs access to one folder, application or mailbox, they probably don’t need access to the entire business.
Limiting permissions reduces the amount of damage that can be done if an account is compromised.
This is one of those security measures that isn’t particularly exciting, but it works.
Have proper backups
Cybersecurity isn’t only about stopping an attack.
You also need to be able to recover from one.
Important business data should be backed up somewhere separate from the system it protects, and those backups should actually be monitored and tested.
Finding out your backup hasn’t worked for six months after something goes wrong is not a recovery plan.
AI can also help the defenders
There is another side to this.
The same technology that allows attackers to identify vulnerabilities, automate attacks and create convincing scams is also being incorporated into cybersecurity products.
Security vendors are using AI to analyse suspicious behaviour, identify threats faster and help security teams investigate incidents.
OpenAI’s warning isn’t really that AI automatically makes the internet unsafe. Their argument is that both attackers and defenders are rapidly becoming more capable, and businesses should use the opportunity to strengthen their security now rather than waiting until something happens.
For small businesses, this mostly comes back to good IT
Cybersecurity can sometimes sound like something only large enterprises need to worry about.
In reality, most small businesses don’t need a security operations centre or a huge cybersecurity budget.
They need their Microsoft 365 environment configured properly. They need MFA. They need supported and patched computers. They need endpoint security. They need sensible permissions, reliable backups and someone keeping an eye on things.
None of that is especially glamorous.
But as AI makes attacks faster, cheaper and more convincing, businesses that haven’t dealt with those basics are going to become increasingly easy targets.
The technology is changing quickly.
The fundamentals of protecting a small business haven’t changed nearly as much.