AI is changing cybercrime. Is your business ready?
AI is making cyberattacks faster and easier to automate, meaning security gaps that once went unnoticed could now be discovered in minutes. We look at what this means for businesses and five practical ways to strengthen your defences.
AI is changing the way we work, but unfortunately, it’s also changing the way cybercriminals work.
Attackers are increasingly using AI-powered tools to automate some of the time-consuming parts of hacking. Instead of manually trawling through websites, systems and thousands of lines of code looking for a way in, they can now get AI to do much of the searching for them.
That means something as simple as an old password, forgotten application, exposed security token or unpatched system could potentially be discovered much faster than before.
For businesses, the important message isn’t “AI is coming to hack you.”
It’s much simpler:
The tools available to attackers are getting better, so the gaps we could previously get away with leaving open are becoming much easier to find.
So, what are attackers actually doing?
One example recently highlighted by Microsoft involved attackers using AI to search public code repositories, such as GitHub, for exposed credentials and security tokens.
Think of a security token a little like a digital key. Applications use them to talk to Microsoft 365 and other online services without somebody having to enter a username and password every time.
That's perfectly normal.
The problem starts when one of those keys accidentally ends up somewhere public.
If an attacker finds a valid token, they may be able to use it to access systems or data without going through the usual login process.
The worrying bit is that AI makes finding those mistakes much easier.
Rather than somebody manually searching thousands of potential targets, automated tools can do much of the legwork for them.
Why does this matter to smaller businesses?
It's tempting to think this type of cyberattack is only aimed at large corporations.
In reality, automation makes smaller businesses more attractive, not less.
An attacker doesn't necessarily need to specifically target your business. Their tools can scan thousands of potential targets looking for something useful.
That could be:
• An old account that's still active • An application with more permissions than it really needs • A password or security token accidentally stored somewhere public • A server that hasn't been patched • An old third-party application nobody uses anymore • An administrator account without adequate protection
Find one weak point and the attacker has somewhere to start.
It's a bit like a burglar walking down a street trying every door handle. Except now they've got a robot capable of trying thousands of doors for them.
Five things you can do now
The good news is that protecting yourself doesn't mean buying some magical new “AI cyber defence” product.
Most businesses will get far more value from getting the fundamentals right.
- Check what is connected to Microsoft 365
Over time, it's surprisingly easy to accumulate applications and services connected to Microsoft 365.
Review what's connected, what information those applications can access and whether anybody still needs them.
If nobody knows what something is or why it still has access, that's usually a good reason to investigate it.
- Keep passwords, API keys and security tokens out of code
If your business develops software, uses PowerShell scripts or connects different systems together, make sure passwords and security tokens aren't stored directly inside code or uploaded to public repositories.
Use proper secret-management tools and regularly review who and what has access to them.
- Don't give people or applications more access than they need
This is known as least privilege, but the principle is straightforward.
If somebody doesn't need administrator access, don't give it to them.
The same applies to applications.
If an account or application is compromised, restricting its permissions can dramatically limit what an attacker can actually do.
- Keep systems patched
AI might make cyberattacks sound futuristic, but attackers are still very happy to exploit a three-year-old vulnerability that hasn't been patched.
Keep Windows, Microsoft 365, network equipment, business applications and internet-facing systems updated.
The boring security jobs still matter.
- Use strong multi-factor authentication
Passwords alone are no longer enough.
Multi-factor authentication should be enabled across business accounts, particularly Microsoft 365 and administrator accounts.
Where appropriate, businesses should also consider stronger phishing-resistant authentication methods such as passkeys or FIDO2 security keys.
Don't panic. Just make yourself a harder target.
The rise of AI in cybercrime doesn't mean businesses should suddenly panic about autonomous AI hackers roaming the internet.
What it does mean is that attackers can increasingly automate jobs that used to take considerable time and effort.
And when finding vulnerable businesses becomes cheaper and faster, poor security hygiene becomes much more difficult to hide.
The best response isn't fear.
It's making sure the basics are done properly.
For most businesses, that means keeping systems patched, enforcing strong authentication, removing unnecessary access, checking what's connected to Microsoft 365 and regularly reviewing their overall security posture.
Cybersecurity has never really been about making yourself impossible to attack.
It's about making yourself a considerably harder target.
If you're unsure where the gaps might be in your current setup, or you'd like us to review your technology, please do get in contact.