of SMB workers already use AI tools at work
- 78%of AI users bring their own tools to work, so company data goes into apps IT has never seen.
- 97%+of identity attacks are password spray or brute force. Stolen sign-ins, not clever malware, are the way in.
- 62%of security alerts in one survey were never investigated: too many alerts, too few people.
Short answer: AI is changing cyber security in four ways that matter to small businesses: staff using AI tools you do not control, attackers targeting identities, security alert overload, and human error. The fixes are practical: secure identities, manage devices, protect sensitive data and set a clear AI policy.
Worried about shadow AI in your business?
Free, no-obligation review with our Burgess Hill team.
Book a free IT review Call 01444 871200Frequently asked questions
How is AI changing cyber security?
AI helps attackers write convincing phishing and scale attacks, while staff using unapproved AI tools can leak company data. It also helps defenders detect and respond faster, so tools such as Microsoft Defender use AI to spot and contain threats.
What is shadow AI?
Shadow AI is staff using AI tools such as personal chatbots or note-taker bots that the business has not approved or secured, often putting sensitive data into them.
Should we ban AI at work?
Banning usually pushes use out of sight. A safer approach is to provide an approved tool, set a clear policy and put data protection controls in place.
What is the biggest cyber risk for a small business?
Compromised identities are the leading route in, so multi-factor authentication, Conditional Access and staff awareness are the highest-value first steps.
Do small businesses really get targeted?
Yes. A 2025 Mastercard study reported around one in five small and medium businesses had to close after a cyber attack, because they are often less well defended.
How can ABCOM help?
We review your identity, device, email and data security, help you get Cyber Essentials, and can run an AI Readiness Sprint. Book a free review or call 01444 871200.
The four shifts
1. Shadow AI is already in your business
Microsoft’s 2025 Work Trend Index found 86% of small business workers using AI tools, and its 2024 report found 78% of AI users bringing their own AI to work. Many leaders respond by banning AI, which tends to push use underground. The better answer is to provide a safe, approved option, set a policy and use controls that stop sensitive data being pasted into unapproved tools. Try our free Shadow AI check to see where you stand.
2. Identity is the new front door
Microsoft’s 2025 Digital Defense Report identifies identity as the leading attack vector, with the vast majority of identity attacks being password spray or brute force. Multi-factor authentication, Conditional Access and identity threat detection close most of that gap. These are also now automatic fail points under the stricter Cyber Essentials 2026 rules.
3. Too many tools, too many alerts
Small organisations often run many separate security products. A 2025 survey reported that around 62% of security operations alerts go uninvestigated. Consolidating onto a smaller integrated stack such as Microsoft Defender and Purview reduces cost and the chance of missing something important.
4. People still make the difference
Forrester research from 2024 shows internal incidents account for almost a quarter of breaches, with more than half intentional. Security is a whole-organisation effort: train staff, limit access to what each role needs, and protect data that should never leave the business.
A practical checklist
- Turn on MFA for everyone and block legacy sign-in.
- Manage every laptop and phone that touches company data.
- Label and protect sensitive information.
- Publish a simple AI acceptable-use policy and approve a safe tool.
- Get the basics certified with Cyber Essentials.
Our four-week AI Readiness Sprint does much of this for you before Copilot goes live.
Book a free AI and security review
Free, no-obligation review with our Burgess Hill team.
Book a free IT review Call 01444 871200Statistics are from Microsoft Work Trend Index 2024 and 2025, Microsoft Digital Defense Report 2025, Mastercard small business study 2025, Forrester 2024 and a 2025 SOC alert survey. Reviewed October 2026.
Do not just read it. Act on it.
Reading is the easy part. Book a free IT review and we will tell you, in plain English, where your business stands and what to fix first.
