Artificial intelligence is changing who can become a serious cyber threat.
Until recently, carrying out a successful business network intrusion required substantial technical knowledge. An attacker needed to understand network reconnaissance, software vulnerabilities, exploit development, credential theft, remote access, data extraction, and methods for hiding their activity.
AI agents are beginning to perform many of those tasks for them.
An inexperienced attacker can now give an AI tool a vague objective and receive technical guidance, computer commands, vulnerability research, custom code, troubleshooting assistance, and recommendations for what to do next. The attacker may still need to make decisions and provide access to tools, but the AI can supply much of the technical structure they previously lacked.
This does not mean every person with an AI account can instantly compromise a business. It does mean that the minimum level of knowledge required to cause significant damage is falling.
For small and midsize businesses in Michigan, that creates an important shift in cybersecurity risk. Organizations are no longer defending themselves only against skilled criminal groups. They must also prepare for opportunistic, inexperienced, and poorly disciplined attackers who can use AI to operate beyond their natural abilities.
A Real-World Case Shows How Quickly the Threat Is Changing
The records reportedly showed an attacker using AI coding agents to assist with reconnaissance, vulnerability research, exploit development, access validation, credential collection, data exfiltration, and reporting. Evidence from the recovered files documented compromises involving at least 14 companies.
What made the case especially concerning was the apparent skill level of the attacker.
The attacker frequently issued vague instructions and depended on the AI agent to determine the technical steps. Instead of personally researching every exposed service, reviewing vulnerability information, building tools, and troubleshooting failed commands, the attacker allowed the AI to perform much of that work.
Researchers concluded that this was not a fully autonomous cyberattack. The human remained involved. However, it was also far more than simple code completion or general advice.
The AI agent functioned as a technical force multiplier.
It helped an inexperienced operator complete tasks normally associated with a much more capable cybercriminal. In some instances, the attacker framed the activity as authorized penetration testing or security research, allowing the malicious requests to resemble legitimate cybersecurity work.
The incident also involved model versions that were not the newest available frontier systems. That distinction matters because AI cyber capabilities continue to develop.
The lesson for business owners is clear: AI-assisted cybercrime is no longer a theoretical future problem. It is already affecting real organizations.
What Are AI-Powered Cyberattacks?
AI-powered cyberattacks are attacks in which criminals use artificial intelligence to improve, automate, accelerate, or scale one or more parts of the attack process.
- Identify businesses with exposed internet-facing systems
- Research known vulnerabilities
- Generate or modify exploit code
- Troubleshoot commands that fail
- Create convincing phishing emails
- Personalize social-engineering messages
- Analyze stolen files
- Search for passwords, financial records, or sensitive information
- Automate repetitive attack tasks
- Translate messages into natural-sounding English
- Produce documentation about compromised systems
- Recommend additional targets or attack paths
AI does not need to invent a completely new form of cyberattack to create a serious problem. Making existing attacks faster, cheaper, more convincing, and easier to execute is enough to increase risk substantially.
The Threat Is Not Limited to Large Companies
Many small-business owners assume sophisticated technology will be used primarily against banks, national corporations, or government agencies.
That assumption is dangerous.
AI makes broad, opportunistic targeting more practical. A local business may be selected simply because it has an outdated system, exposed port, reused password, compromised email account, or employee who responds to a convincing message.
Michigan law firms, healthcare practices, financial professionals, manufacturers, property-management companies, construction businesses, and accounting firms hold information criminals can monetize.
That information may include client records, Social Security numbers, medical data, financial details, legal documents, payment instructions, employee information, and access to larger customers or vendors.
Small businesses may also have fewer security controls, making them easier to compromise and slower to detect an intrusion.
The Threat Is Not Limited to Large Companies
Local risk is still global risk
A business in Warren, Sterling Heights, Macomb County, Oakland County, or Wayne County can be scanned and attacked from anywhere. Geographic size and local market focus do not make internet-facing systems invisible.
How Businesses Can Defend Against AI-Assisted Attackers
The answer is not to purchase a product labeled “AI security” and assume the problem has been solved.
Businesses need layered controls that reduce the opportunities available to both skilled and unskilled attackers.
1. Identify Everything Exposed to the Internet
web applications, remote-access tools, cloud services, email systems, and file-sharing platforms.
Unknown systems cannot be protected effectively.
- Unexpected open ports
- Forgotten web applications
- Exposed administrative interfaces
- Expired certificates
- Misconfigured services
- Vulnerable network devices
- Systems using outdated software
- Publicly accessible storage
- New services appearing without approval
Cybercriminals continuously search for these weaknesses. Businesses should discover them first.
2. Patch Internet-Facing Systems Quickly
Create a formal process for evaluating and installing security updates.
Critical vulnerabilities affecting internet-facing systems may require action within 24 to 72 hours, depending on the severity, availability of exploits, and risk to the business.
- Firewalls
- VPN appliances
- Remote-access software
- Email servers
- Web applications
- File-transfer systems
- Network-attached storage devices
- Cloud management tools
- Public-facing servers
- Business applications with remote portals
Routine monthly patching may not be fast enough for actively exploited vulnerabilities.
3. Require Multifactor Authentication
Multifactor authentication can prevent many account-compromise attempts even when an attacker has obtained a password.
- Microsoft 365 and Google Workspace
- Remote-access tools
- VPN connections
- Administrative accounts
- Accounting platforms
- Cloud management portals
- Password managers
- Backup systems
- Line-of-business applications
- Vendor-access accounts
Whenever possible, use phishing-resistant methods such as security keys, passkeys, or certificate-based authentication. Traditional push notifications should include number matching and protections against repeated approval requests.
4. Remove Unnecessary Administrative Access
Employees should not use administrator accounts for routine work.
Attackers who compromise an account inherit the permissions assigned to that user. Reducing those permissions limits what malware, stolen credentials, and remote intruders can do.
- Separate standard and administrative accounts
- Remove unused local administrators
- Review Microsoft 365 administrator roles
- Restrict vendor access
- Disable dormant accounts
- Use time-limited privileged access where possible
- Monitor administrative logins
- Protect emergency accounts separately
Least privilege remains effective regardless of whether the attacker is human or AI-assisted.
5. Strengthen Email and Payment Verification
Businesses need procedures that assume some fraudulent messages will look legitimate.
- Wire transfers
- Bank-account changes
- Payroll changes
- Gift-card purchases
- Sensitive documents
- Password resets
- New vendor payment instructions
- Unusual login requests
Verification should occur through a known phone number or another trusted communication channel, not by replying to the message.
Email security should also include impersonation protection, malicious-link scanning, attachment analysis, domain-authentication controls, and monitoring for suspicious mailbox rules.
6. Use Endpoint Detection and Application Control
Traditional antivirus alone may not stop an attacker who uses legitimate tools, customized scripts, or newly generated code.
- Credential theft
- Suspicious scripting
- Unauthorized remote-access tools
- Malicious PowerShell activity
- Unexpected encryption
- Security-tool tampering
- Unusual child processes
- Data-staging activity
- Lateral movement
- Persistence mechanisms
Application allowlisting can provide another important layer by restricting programs and scripts that have not been approved.
7. Monitor Systems Continuously
AI-assisted attacks may move faster than a business’s traditional support process.
Waiting until Monday morning to review an alert generated Friday night may be too late.
- Endpoints
- Servers
- Firewalls
- Cloud identities
- Microsoft 365 or Google Workspace
- Email activity
- Backups
- Administrative accounts
- Remote-access systems
- Security logs
A managed security operations capability can investigate alerts, identify related activity, and begin containment when suspicious behavior occurs.
8. Protect Backups From Attackers
Backups should not be continuously accessible through the same accounts and network paths as production systems.
- Encrypted backups
- Offsite or cloud copies
- Immutable storage
- Separate backup credentials
- Multifactor authentication
- Restricted administrative access
- Automated backup monitoring
- Regular restoration testing
A backup is not reliable until the business has successfully restored data from it.
9. Create and Test an Incident-Response Plan
Every business needs a written plan explaining what to do when a cyberattack occurs.
- Who has authority to make decisions
- How to contact IT and cybersecurity support
- How to isolate affected devices
- When to contact cyber insurance
- How to preserve evidence
- How to communicate with employees
- Which legal and regulatory obligations may apply
- How to continue critical operations
- How backups will be restored
- How vendors and clients will be notified
Conduct a tabletop exercise at least annually. Organizations with higher risk, regulatory obligations, or frequent staff changes may benefit from testing every six months.
10. Secure the Business’s Own AI Tools
The reported incident also highlights a separate concern: AI coding agents and their saved sessions can become valuable targets.
- Source code
- Server credentials
- API keys
- Cloud environments
- Deployment systems
- Internal documentation
- Customer information
- Saved command histories
- Business files
Companies that use AI agents should treat them like other privileged business systems.
Protect AI tools with strong authentication, limited permissions, secure credential storage, logging, session controls, data-retention policies, and endpoint protection. Do not paste passwords, private keys, regulated information, or confidential client data into unapproved AI systems.
What Michigan Business Owners Should Do Next
Business owners do not need to become experts in artificial intelligence or offensive cybersecurity.
They do need to confirm that their defenses can withstand faster, more frequent, and more convincing attacks.
Start by answering these questions:
- Do we know which systems are publicly exposed?
- Are our firewalls and remote-access systems fully updated?
- Is multifactor authentication required everywhere it should be?
- Are employees using standard accounts for daily work?
- Can we detect suspicious activity outside normal business hours?
- Are our backups isolated, monitored, and regularly tested?
- Do employees verify financial requests using a second communication method?
- Do we have a documented cyber incident-response plan?
- Has an independent professional tested our security controls?
- Would we know what to do during the first hour of a ransomware attack?
An unanswered question represents a potential business risk.
AI Has Changed the Threat, but Strong Security Still Works
Artificial intelligence gives attackers speed, technical guidance, and scale. It does not make proven cybersecurity controls obsolete.
Updated systems, multifactor authentication, restricted privileges, secure email, application control, endpoint monitoring, protected backups, employee education, and incident-response planning still reduce risk.
The difference is urgency.
Businesses that leave known weaknesses unresolved may now face more attackers capable of finding and exploiting them. Organizations that maintain strong, monitored, and layered defenses will be much harder targets.
Protect Your Business Before an AI-Assisted Attacker Finds the Weakness
Cyber Protect LLC helps small and midsize businesses identify security gaps, strengthen their defenses, monitor for threats, and prepare for cyber incidents.
We provide cybersecurity and managed IT services for organizations throughout Warren, Sterling Heights, Macomb County, Oakland County, Wayne County, and Southeast Michigan. Our experience includes protecting law firms, healthcare practices, financial-services organizations, manufacturers, construction companies, accounting firms, and other growing businesses.
Do not wait for an attacker to show you where your security is weak.
Schedule a cybersecurity and IT risk assessment with Cyber Protect LLC. We will help you identify exposed systems, evaluate your current protections, prioritize practical improvements, and create a plan based on your actual business risk
Frequently Asked Questions
Can unskilled hackers really use AI to attack a business?
Yes. AI can help inexperienced attackers research exposed systems, identify known vulnerabilities, generate commands, troubleshoot failed attempts, create phishing messages, and analyze stolen information. The attacker still needs access, intent, and some ability to direct the process, but AI can substantially increase what that person is capable of doing.
Are AI-powered cyberattacks fully autonomous?
Most current attacks still require human involvement. Attackers typically select targets, provide tools or access, approve actions, and make decisions. However, AI agents can automate long sequences of research, coding, testing, analysis, and technical execution.
Why are small businesses at risk from AI cybercrime?
Small businesses often have valuable information but fewer security resources than large enterprises. Attackers may target them because of outdated systems, exposed remote access, weak passwords, missing MFA, limited monitoring, or untested backups.
Can antivirus stop an AI-generated cyberattack?
Antivirus is one layer of protection, but it is not enough by itself. Businesses also need endpoint detection, multifactor authentication, application control, patch management, secure email, network monitoring, protected backups, employee training, and an incident-response plan.
How quickly should a business install security updates?
Critical updates for internet-facing systems may need to be installed within 24 to 72 hours, particularly when active exploitation has been reported. Other updates should follow a documented, risk-based patch-management schedule.
How can a business prevent AI-generated phishing attacks?
Use advanced email security, multifactor authentication, domain protections, employee training, and mandatory verification procedures for payments, password resets, account changes, and sensitive-data requests. Employees should verify unusual requests using a known phone number or separate trusted channel.
What is the best first step for a small business?
Begin with a professional cybersecurity risk assessment. The assessment should review internet-facing systems, identities, MFA, endpoint protection, email security, backups, patching, administrative access, monitoring, and incident-response readiness.
Does Cyber Protect provide AI cyber-threat protection in Michigan?
Cyber Protect LLC provides managed cybersecurity and IT services to small and midsize businesses throughout Southeast Michigan. Services can include risk assessments, security monitoring, endpoint protection, firewall security, email protection, backup and disaster recovery, vulnerability management, employee education, and incident-response planning.
About the Author
Cheyenne Harden
CEO