AI Cyber Attacks: What Small Business Owners Need to Know

November 15th, 2026

Most of what gets described as an AI cyber attack is not a new kind of attack. It is an old one that used to cost more than it was worth. Writing a phishing email specific enough to fool a bookkeeper took research and a fluent writer. Cloning a voice took a studio and hours of sample audio. Neither does now, and the part of an attack that was labor is the part that just became free.

That distinction is worth holding onto, because it tells you where the pressure actually is. AI did not add a new door into your network. It removed the reasons an attacker used to skip your company and look for an easier one. What follows is what changed at each stage of an attack, and which of the controls you already have stop being enough because of it.

What AI Changed, and What It Didn't

The entry points are the same list they have been for a decade: a stolen credential, an unpatched device, an email somebody believes. The 2026 Verizon Data Breach Investigations Report found that exploited software vulnerabilities now lead as the way in, at 31 percent of breaches - a statement about patching discipline across the economy, not about AI.

What AI did was collapse the cost of the convincing parts. In April 2026 the FBI's Internet Crime Report included an AI section for the first time and recorded 22,364 complaints with losses near $893 million, while noting that the figure is a floor rather than a total, since AI involvement is only counted when someone notices it. Verizon's data put generative AI behind roughly 15 percent of attack techniques. Both numbers describe the same shift from different angles: the expensive part of an attack is no longer expensive.

Inside an AI-Written Phishing Email

The old advice about phishing - check the grammar, check the greeting, hover over the sender address - was advice about cost. Sloppy writing and generic greetings were artifacts of someone working through a list. A language model has no such limitation. It can produce a message that names your actual vendor, references the actual project, matches the tone of the person it claims to be from, and does it once per recipient, at volume, in whatever language your staff reads.

The landing pages improved too. Current phishing kits place a real-time proxy between the employee and the real login page, so the site genuinely is Microsoft's, the certificate is valid, and when the employee approves the prompt on their phone, the proxy relays it into the attacker's session before it expires. That is the reason "we have MFA" stopped being a complete sentence. Text-message codes and push approvals both fall to this; a hardware key bound to a domain does not, because it will not authenticate against a proxy.

What is left for the reader to judge is no longer the quality of the writing, but the plausibility of the request. And a request can be entirely plausible and still be the attack. Verizon's data shows the same movement in where people click: the shift has gone toward texts and scam calls, where a phone screen hides the sender entirely and leaves nothing to inspect.

Why Voice and Face Stopped Counting as Verification

Voice cloning needs only a few seconds of source audio, and business owners produce hours of it in public: earnings calls, webinars, conference talks, videos on the company site, an outgoing voicemail greeting. Real-time video is the same problem with more computing behind it.

The reporting caught up in 2026. A joint FBI advisory in February reported more than 400 complaints of deepfake-enabled business email compromise since October 2025, with combined losses above $145 million - including a case where a finance employee authorized a $25.6 million transfer after a video call that was synthetic from beginning to end.

The important finding is not that the fakes are convincing. It is that they do not have to be, because verifying someone by ear or by eye is not a control - it is a guess with a good historical track record that has stopped being reliable. What replaces it is procedural rather than perceptual. Any request to change bank details, or to move money above a threshold, gets confirmed on a channel the requester did not choose, using a number from your own records rather than one supplied in the message, with a second person authorizing above a larger threshold. No exceptions, including for the owner. An exception is the attack.

The Other Call: Your Help Desk

The second place a cloned voice gets used is not the finance department. It is whoever resets passwords. The pattern is consistent: an attacker who has already gathered enough detail about an employee calls the help desk, or the IT provider's service line, imitates that person, and asks for a password reset or a re-enrollment of their MFA method. The voice is the credential being presented, and if the verification comes down to "does this sound like them," the procedure has already failed.

What survives is a reset process that does not depend on recognizing anybody: a callback to the number already on file, confirmation through the person's manager, identity proof that is neither knowledge nor voice, and a re-enrollment that requires a device already trusted or a visit in person. A hardware key changes this calculation on its own, because there is nothing left to reset that a convincing caller can talk their way into.

The Breach With No Attacker in It

The largest AI-related exposure in most small businesses involves nobody attacking anything. The 2026 DBIR found that 45 percent of professionals now use AI tools at work regularly, and that 67 percent of them reach those tools through personal accounts their IT department neither controls nor sees. It recorded a fourfold increase in non-malicious insider actions, and in 28 percent of data loss prevention violations the data leaving was source code. In another 3.2 percent it was proprietary research and technical documentation.

An employee pasting a contract, a pricing sheet, or a client list into a public chatbot to get a summary is not sabotaging you. They are trying to finish their afternoon. The problem is where that data ends up: a system you have no contract with, no retention control over, no deletion path through, and nothing you can include in an incident response if something goes wrong on that side of it. The same applies to AI features that arrive switched on by default inside software you already pay for, and to browser extensions nobody approved - a quiet, always-on channel out of the building.

The fix is unglamorous. Give people a sanctioned tool that is actually good enough to use - an enterprise account with data controls and terms that keep your inputs out of the vendor's model - then make everything else harder to reach: blocked at the network and identity layer, browser extensions centrally controlled, and outbound data movement visible in your logs. Whatever remains, at least shows up somewhere you can see.

Less Time Between the Fix and the Attack

Exploited software vulnerabilities passed stolen passwords as the leading way into an organization, at 31 percent of breaches in the 2026 DBIR. AI does not create those flaws. It shortens the distance between a flaw becoming public and somebody having working tooling for it. A vulnerability that sat unpatched for three months in 2020 is a different risk when exploitation can be assembled in the same week the patch ships, which is why patching on a calendar rather than on a feeling stopped being a matter of preference.

What AI Does After It Gets In

The same tools reduce the work on the far side of the breach. Reading through hundreds of gigabytes of file shares to find the payroll records, the client contracts, and the finance exports is exactly the kind of pattern-matching task a model is good at, and so is writing scripts against a system the attacker has never seen before. That half of an intrusion is the least visible part of it: nothing breaks, nothing alerts, and the value of what you hold is being assessed while the business carries on with its day.

The controls that matter there are the unglamorous ones: access that stops at the data a person actually needs, logging that records where data moved, and detection that notices a large read or upload arriving outside normal patterns. None of that is new. What is new is how quickly an intruder can now tell the difference between a network worth ransoming and one worth leaving alone.

What This Means for the Controls You Already Have

The list of controls did not change much. What changed is the margin for doing them informally. Our companion article on why small businesses get hacked covers the six in detail, and none of them became wrong. Two of them narrowed:

• Authentication has to be phishing-resistant, not merely present. Text codes and push approvals fall to a relay proxy; hardware keys and passkeys do not. Administrators, finance staff, and anyone who can approve a payment should be carrying a key.
• Verification for payments has to be procedural. Once voice and video can be synthesized, the control that survives is a callback to a number you already had, plus a second approver above a threshold - written down, not improvised.

Everything else on that list still works for the reasons it always did, and the reason to keep it current is that the attacks arriving through those doors are now better written than they used to be. If you want to know what a baseline of your own environment looks like, our piece on security assessments covers how one gets built.

Where This Leaves a Small Business

The technology inside the attack improved. The fundamentals of the defense did not change, and the businesses that come through this intact are not the ones with the largest budget - they are the ones whose controls are mechanical rather than instinctive, because instinct is precisely what the synthetic audio and the fluent email are built to defeat.

Forward TS provides managed IT services to Milwaukee-area businesses, covering what this article describes: phishing-resistant authentication, filtered email with domain authentication, endpoint monitoring that watches behavior rather than signatures, controls over the AI tools in use and the data leaving your network, and the documentation your insurer asks for when the questionnaire arrives.

Start with a free audit to see where AI-assisted attacks would find their opening in your environment, or contact us to talk through what your business needs.