How Cybercriminals Use AI Against Small Businesses, and How to Defend

Artificial intelligence helps attackers as well as defenders. Tools that write fluent text and imitate voices make scams more convincing and easier to produce in volume. The defensive answer is mostly the same set of fundamentals, applied with a bit more discipline.

What has changed

• Better phishing: messages no longer have the spelling mistakes people were taught to look for.
• Voice and video impersonation: a caller who sounds like your owner or a vendor may not be who they claim.
• Faster research: public information about your company is easy to gather and use to make a request seem believable.

Defenses that still work

• MFA on every account that supports it.
• Email filtering and link protection.
• A rule that payment or banking changes are confirmed by calling a known number, never a number in the message.
• Regular training that includes examples of AI-written and voice-cloned scams.
• Tested backups and endpoint protection for the case where something gets through.

Use AI safely inside your own business

Staff will use AI tools whether or not you have a policy. Decide which tools are approved, what must never be pasted into a public chatbot, and how output is reviewed. We cover this in our guides to writing an AI acceptable use policy and preparing Microsoft 365 for Copilot.

Related reading

• AI and cybersecurity for small business in 2026
• managed cybersecurity for Portland businesses
• AI acceptable use policy for small business

Talk to a local team

PDX Information Technology Services provides managed IT, cybersecurity and compliance support for small businesses in Portland, Lake Oswego, Beaverton, Hillsboro and Vancouver, WA. Plans start at $100 per user per month (Gold) and $180 per user per month (Platinum). Call 971-331-4871 or book a free assessment.