The scale of these threats is already clear: in the past year alone, Comcast Business detected 4.7 billion phishing attempts and 9.7 billion web-based “drive-by compromise” attempts across all its security customers. And with more threat actors using AI in their attacks, these attempts are growing harder to spot.

For small business owners and employees already wearing multiple hats, the rise of AI-powered cyber threats can feel overwhelming. Small businesses may not have as many resources as larger organizations, but they can better defend themselves against AI-generated cyberattacks with a people-focused approach.

How cybercriminals use AI to trick people

Generative AI makes it much easier to create professional-looking phishing emails, malware, and fake websites in seconds, without any coding or design skills. Tasks that once demanded specialized expertise can be completed instantly, with convincing results.

For example, fake websites and business profiles can mimic trusted brands or vendors so closely that an employee may not think twice before entering login details or payment information. Deepfake videos and voice scams can impersonate a known colleague, adding urgency by requesting an “immediate” financial transfer or sensitive data. Even fraudulent documents, like invoices or credentials, can be produced with enough polish to slip past a busy employee who’s processing information quickly.

With threats rapidly evolving and blending seamlessly into normal business activity, even vigilant employees can be deceived.

Why small businesses are especially at risk

AI-powered attacks take advantage of the day-to-day routines of a busy workplace. Clicking a link, reusing passwords, using a personal device for work, or skipping a software update might seem harmless. But these everyday actions can turn into entry points for AI-driven attacks. Small businesses may be particularly vulnerable because they often have:

• A lack of dedicated IT staff to provide technical oversight and ongoing security training that can result in gaps that attackers can exploit.
• Resource limitations that may lead to underinvestment in security tools.
• Old infrastructure, use of personal devices, and inconsistent security policies: Not staying up to date with security protocols, best practices, and policies can open up businesses to vulnerabilities and risks.

What small businesses can do now

Defending against AI-enhanced attacks means combining good habits with the right technology. Even small improvements can make a meaningful difference:

• Keep systems and software up to date to manage potential vulnerabilities before attackers exploit them.
• Require strong password practices and multi-factor authentication (MFA) to help stop stolen credentials from being used.
• Set clear policies for generative AI use so employees don’t accidentally expose sensitive company data in public tools.
• Use automated security technology that continuously detects and blocks phishing, malware, and other threats.
• Choose security solutions designed for small businesses that provide enterprise-grade security while remaining easy to manage and monitor.

By pairing everyday security habits with advanced security, small businesses can stay ahead of evolving AI-powered threats.