Quick Summary

AI cyberattacks hurt small businesses by making phishing, payment fraud, vulnerability scanning and ransomware faster, cheaper and more convincing. IBM’s 2026 study found AI-driven attacks increased 56% year over year, although that figure covers organisations generally not small businesses alone. The practical response remains clear: MFA, rapid patching, restricted access, tested offline backups and an incident plan. newsroom.ibm

Highlight

• AI helps criminals create convincing phishing emails, fake invoices and impersonation scams at scale.
• Small businesses often face greater exposure because they have fewer security staff and limited recovery budgets.
• The 56% increase reported by IBM does not mean small-business attacks alone rose by 56%.
• Multi-factor authentication, fast patching and least-privilege access block many common attack paths.
• Offline, encrypted and tested backups can reduce the damage caused by ransomware.
• Employees need a clear process for checking payment requests and reporting suspicious messages.
• A simple 30/60/90-day security plan is more useful than buying expensive tools without fixing the basics.

Small Business Cybersecurity Snapshot

AI-enabled threat	How it affects a small business	Immediate protection
AI-generated phishing	Tricks employees into sharing passwords or opening malicious links	MFA, email filtering and staff training
Deepfake voice or video	Impersonates an owner, supplier or finance manager	Verify unusual requests through a second channel
Automated vulnerability scanning	Finds outdated websites, apps and exposed remote-access systems	Patch quickly and remove unsupported software
AI-assisted ransomware	Encrypts files and disrupts operations	Offline backups and tested recovery procedures
Shadow AI and fake AI tools	Exposes company data or installs malicious software	Approved-tool policy, access controls and software reviews

How AI Cyberattacks Are Hurting Small Businesses

A small business owner does not need another reason to worry about cash flow, customer trust or downtime. Yet a new type of cyber risk is making familiar attacks quicker and more persuasive.

AI cyberattacks are cyberattacks in which criminals use artificial intelligence to improve the speed, scale, personalisation or effectiveness of an attack. In many cases, AI does not replace the entire attack. Instead, it strengthens old methods such as phishing, business email compromise, ransomware and credential theft.

That distinction matters. You do not need to imagine a fully autonomous hacker controlling every computer on the internet. A criminal who uses AI to create a convincing payment request in minutes can already cause serious damage.

What the 56% figure really means

IBM’s 2026 Cost of a Data Breach research reported that AI-driven attacks increased by 56% year over year in its study. It also found that approximately one in four malicious breaches involved AI and that AI-enabled breaches carried a higher average cost. However, IBM’s figure describes the organisations included in its research; it does not prove that attacks against small businesses alone rose by 56%. newsroom.ibm

Therefore, use the statistic carefully in your headline and article. A credible explanation is stronger than a dramatic claim that a source does not support.

A safe wording would be:

IBM reported a 56% year-over-year increase in AI-driven attacks across the organisations studied. For small businesses, the lesson is simple: attackers can now automate more of the work involved in finding and deceiving victims.

Why small businesses are in the blast radius

Many owners assume criminals only target banks, hospitals or large technology companies. In reality, attackers often look for weak access controls, outdated software and employees who have not received practical security training.

A five-person firm may hold valuable information, including:

• Customer names, addresses and payment details.
• Payroll and tax records.
• Supplier bank details.
• Legal or healthcare information.
• Email accounts that control password resets.
• Access to cloud storage, accounting systems and payment platforms.

Small businesses also tend to rely on a small number of critical systems. If one email account, laptop or cloud application becomes unavailable, the whole operation can slow down.

CISA’s small-business guidance focuses on the same core issue: businesses need to understand their exposure and establish basic protections before an incident happens. Its recommendations include MFA, software updates, backups, access controls and employee training. cisa

How Criminals Use AI

1. More convincing phishing emails

Traditional phishing emails often contained obvious spelling mistakes, awkward wording or strange formatting. That warning sign has become less reliable.

Generative AI can help attackers write natural messages, imitate a company’s tone, translate text and personalise a request using information gathered from public websites. An email may appear to come from a business owner, accountant, solicitor, supplier or major customer.

For example, an employee might receive:

“Hi James, I’m in a meeting and need you to process the attached supplier payment before 3 p.m. Please use the new bank details below.”

The message may contain the correct supplier name and a believable explanation. Nevertheless, the bank details could belong to the attacker.

A useful fact for employees: perfect grammar does not prove that an email is safe. Always check the sender address, inspect the link destination and verify unusual payment requests independently.

2. Deepfake voice and video scams

Voice cloning and synthetic video can make impersonation more persuasive. A finance employee may receive a phone call that sounds like a director asking for an urgent transfer. A supplier may appear on a video call requesting a change to payment details.

The safest response is procedural rather than technical:

1. Stop the payment.
2. Contact the person using a known phone number.
3. Confirm the request with a second authorised employee.
4. Keep the original message, email headers and payment details.
5. Report the incident internally.

Never rely on a single voice call or video meeting for a high-value financial decision.

3. Automated vulnerability discovery

Attackers can use automation to search for exposed websites, remote-access systems, outdated plugins and weak credentials. This reduces the amount of manual effort required to find vulnerable businesses.

An old server or forgotten user account may not look important to the owner. However, an internet-facing weakness can give an attacker an entry point into email, file storage or internal systems.

Start with a basic inventory:

• List every website, application, device and cloud service.
• Remove accounts belonging to former employees.
• Disable unused remote-access tools.
• Replace software that no longer receives security updates.
• Review which systems have administrator privileges.
• Check whether any business service is accessible from the public internet without a clear reason.

4. AI-assisted malware and ransomware

AI can help criminals modify malicious code, test variations and automate parts of an attack campaign. Once ransomware reaches a network, it can prevent access to files, disrupt billing and delay customer service.

The FTC’s ransomware guidance explains how a malicious attachment or link can lock an entire network and hold business data hostage. The guidance also emphasises backups, employee awareness and a clear response process. ftc

Ransomware creates two separate problems:

• The business may lose access to its systems.
• Sensitive data may be copied before criminals encrypt the files.

That is why recovery planning must include both restoration and data-protection decisions.

5. Shadow AI and fake AI tools

Employees may paste confidential information into an unapproved chatbot to summarise a contract, analyse a spreadsheet or write a customer response. This practice, often called shadow AI, can expose data outside the company’s control.

Criminals also use the popularity of AI services as a disguise. Kaspersky reported more than 33,300 attacks against small and medium-sized businesses from January through April 2026 in which malicious or unwanted software was disguised as AI-related tools. kaspersky

Create a short acceptable-use policy that answers three questions:

• Which AI tools may employees use?
• What company or customer data must never be uploaded?
• Who approves new AI software, browser extensions and integrations?

UK businesses may also benefit from reviewing the wider relationship between data protection, technology choice and business independence in this guide to AI sovereignty for UK businesses.

The Practical Protection Plan

Turn on MFA first

Multi-factor authentication adds another verification step after the password. It can stop an attacker who has stolen or guessed a password from accessing an account.

Begin with the accounts that control everything else:

• Business email.
• Banking and accounting systems.
• Cloud file storage.
• Remote-access tools.
• Website administration.
• Payroll and customer-management platforms.

Where possible, choose phishing-resistant MFA such as passkeys or FIDO security keys. CISA specifically recommends enterprise-wide MFA as a significant improvement to account security. cisa

Patch quickly

A patch closes a known security weakness. However, installing a patch weeks after its release may leave an exposed system available to attackers.

Set a simple internal rule:

• Critical internet-facing flaws: fix immediately.
• High-risk business software: review within a few days.
• Routine updates: install on a defined weekly or monthly schedule.
• Unsupported systems: replace, isolate or remove them.

Automatic updates help, but someone should still confirm that updates completed successfully.

Reduce the attack surface

Your attack surface includes every account, device, application, connection and service that an attacker could reach.

Reduce it by:

• Deleting unused accounts.
• Removing old software.
• Limiting administrator privileges.
• Disabling unnecessary services.
• Separating guest Wi-Fi from business systems.
• Restricting access to sensitive files.
• Reviewing supplier and contractor access.
• Using network segmentation where practical.

If an employee only needs to view invoices, that person should not receive administrator access to the entire accounting system.

Protect and test backups

A backup only helps if it remains separate from the attack and can actually restore your files.

Use the 3-2-1 approach where practical:

• Keep three copies of important data.
• Store them on at least two different types of media or systems.
• Keep one copy offline or isolated from the main network.

Encrypt sensitive backups and test restoration regularly. A backup that no one has restored is a hopeful assumption, not a recovery plan.

Verify financial requests

AI-powered fraud often aims at money rather than technical control. Build verification into normal business procedures.

For example:

• Never approve a bank-detail change from email alone.
• Use a known phone number, not the number in the message.
• Require a second person to approve unusual payments.
• Set a threshold for extra verification.
• Ask suppliers to confirm changes through an established portal.
• Keep payment approvals separate from payment execution.

If your business uses online income services or bank-transfer platforms, review the full payment path and account security. This practical guide to passive income apps and UK bank transfers can also help readers who manage side-income or digital payment activity.

Train people with realistic examples

Annual security training often fails because it feels abstract. Instead, show employees the types of messages they may actually see.

Run short exercises involving:

• A fake invoice.
• A password-reset message.
• A deepfake voice request.
• A supplier bank-detail change.
• A shared document containing a malicious link.
• A fake AI software download.

Tell staff exactly what to do. “Report anything suspicious” is less useful than providing a reporting address, phone number or button.

What to Do After a Suspicious Click

Speed matters, but panic creates more mistakes. If someone clicks a suspicious link or opens an unexpected attachment:

1. Disconnect the affected device from Wi-Fi or the network if malware may have installed.
2. Do not delete the email, attachment or browser history.
3. Tell the manager, IT provider or security contact immediately.
4. Change passwords from a clean device if credentials may have been entered.
5. Revoke active sessions and review recent account activity.
6. Contact the bank quickly if payment information was involved.
7. Preserve evidence for law enforcement, insurers and technical investigators.
8. Tell affected customers or regulators when professional advice requires it.

Your written incident plan should name the people responsible for technical response, customer communication, legal advice, insurance and business continuity.

An infographic a designer can create

Create a horizontal infographic called “From AI-Assisted Attack to Business Impact.”

Use five stages:

1. Find: automated scanning discovers an exposed account or outdated system.
2. Personalise: AI creates a believable email, invoice or voice message.
3. Trigger: an employee clicks, pays, shares a password or installs fake software.
4. Spread: the attacker reaches email, cloud storage, payment systems or files.
5. Recover: MFA, patching, access controls, offline backups and incident response limit the damage.

Add a small 56% badge with this footnote: “IBM reported a 56% year-over-year increase in AI-driven attacks in its 2026 study; the figure is not limited to small businesses.” newsroom.ibm

Time frame	Priority actions	Evidence of progress
Today	Enable MFA on email, banking and administrator accounts; verify unusual payments through a second channel	Sensitive accounts show MFA enabled
First 30 days	Inventory devices and accounts, remove unused access, confirm backups and begin staff phishing training	Current asset list and tested backup
Days 31–60	Patch internet-facing systems, replace unsupported software, review suppliers and reduce admin privileges	Documented patch routine and access review
Days 61–90	Write an incident plan, run a phishing exercise, test restoration and review AI-tool usage	Completed tabletop exercise and recovery notes

You do not need to purchase an expensive AI security platform before completing these steps. Strong identity controls, timely patching, restricted access and reliable backups usually deserve priority.

If you outsource content, marketing or technical work, review the tools and data-handling practices involved. A useful guide to choosing an AI SEO content writer should be paired with a clear rule about which customer, employee or financial information contractors may access.

FAQ:

What are AI cyberattacks?

AI cyberattacks are attacks in which criminals use artificial intelligence to improve tasks such as phishing, impersonation, vulnerability discovery, credential theft or malware development. AI may help an attacker work faster or personalise messages, but many attacks still rely on familiar methods such as stolen passwords, malicious links and ransomware.

Are small businesses really targeted by AI cyberattacks?

Yes. Attackers do not always choose the largest company; they often choose the easiest account or system to compromise. Small businesses may have valuable customer data but fewer security staff and less monitoring. MFA, timely updates, restricted access and tested backups can make a small company a much harder target.

Did AI cyberattacks against small businesses rise by 56%?

Not exactly. IBM reported a 56% year-over-year increase in AI-driven attacks across the organisations included in its 2026 research. That statistic does not establish a 56% increase for small businesses alone. Use it as evidence of a wider trend, then explain the specific risks facing smaller organisations. newsroom.ibm

How can a small business detect an AI-generated phishing email?

Look for unusual urgency, payment changes, unfamiliar links, unexpected attachments and requests that bypass normal approval procedures. Check the sender address carefully, but do not rely on grammar mistakes as a warning sign. Verify important requests through a known phone number or a separate trusted communication channel.

Is MFA enough to stop AI cyberattacks?

MFA is one of the most valuable first steps, but it is not a complete security programme. Criminals may still target employees, devices, software vulnerabilities or suppliers. Combine MFA with fast patching, least-privilege access, email protection, staff training, offline backups and an incident-response plan.

Does a small business need an AI-powered cybersecurity tool?

Not necessarily. First, fix the fundamentals: MFA, updates, account reviews, backups and employee reporting. After that, a managed security service, endpoint protection or automated monitoring may help a business with limited internal expertise. Choose tools based on a documented risk rather than buying software simply because it includes AI.

What should a business do after an employee clicks a suspicious link?

Ask the employee to report it immediately and preserve the message. Disconnect the device if malware may have installed, then contact your IT or security provider. Change exposed passwords from a clean device, review account activity and contact the bank quickly if payment information may have been compromised.

Author Bio

This article was prepared by a cybersecurity content specialist focused on small-business risk, phishing, ransomware, data protection and practical security controls. The guidance was reviewed against public recommendations from CISA, the FTC, IBM Security and the Australian Cyber Security Centre. Organisations should adapt the steps to their systems, industry and legal obligations.