Artificial intelligence is changing cybersecurity on both sides of the fight. Defenders use it to spot attacks in seconds that would once have taken days to find. Criminals use it to write flawless phishing emails, clone voices and fake video calls.

So is AI friend or foe? Honestly, it’s both. What matters is making sure it’s working harder for you than against you. Here’s what that looks like in practice.

How AI Strengthens Your Defences

Faster threat detection

Modern security tools learn what “normal” looks like on your computers and network: which programs run, who signs in from where, how much data moves and when. When something breaks the pattern, like a staff laptop suddenly encrypting hundreds of files, or a sign-in from another country at 3 a.m., the tool flags it, and can often stop it on its own.

This is how today’s business security software works, from endpoint protection like Bitdefender GravityZone and Microsoft Defender to network monitoring tools like Darktrace. It catches threats that have never been seen before, which older signature-based antivirus can’t.

Less busywork, faster response

AI also takes on the repetitive work: filtering spam and phishing, blocking malicious websites, sorting thousands of alerts down to the few that matter, and isolating an infected device automatically.

The difference shows up in the numbers. IBM’s 2025 Cost of a Data Breach Report found that organisations using security AI and automation extensively saved an average of US$1.9 million per breach, and found and contained breaches much faster than those that didn’t.

Spotting trouble earlier

By analysing patterns across millions of attacks, security vendors can spot new campaigns early and push protection to every customer, often before the attack reaches you. Your tools get smarter from what happens to everyone else.

How Criminals Use AI Against You

Better phishing and scams

The old tell-tale signs of a scam, like bad spelling, awkward grammar and generic greetings, are disappearing. AI writes convincing, personalised messages in any language, at scale, often using details scraped from your website and social media.

Deepfake voices and video

AI can clone a voice from a few seconds of audio, and fake a face on a video call. In early 2024, an employee at the engineering firm Arup in Hong Kong was tricked into transferring about US$25 million after a video call with what looked and sounded like the company’s CFO and colleagues. Every other person on the call was a deepfake.

The same trick works on a smaller scale: a “voice note” from your boss asking for an urgent payment, or a call from a “family member” in trouble.

Smarter malware and automated attacks

Attackers use AI to probe for weaknesses faster and to build malware that changes itself to slip past detection. AI agents can now carry out multi-step attacks with little human help. We cover this in more depth in Agentic AI Attacks: The Next Evolution in Cyber Warfare.

Attacks on AI itself

As businesses adopt AI tools, those tools become targets. Attackers hide instructions in emails, documents or web pages to trick AI assistants into leaking data or taking actions they shouldn’t (known as prompt injection). And staff pasting customer data into unapproved AI apps creates leaks nobody is tracking. IBM found that this “shadow AI” added around US$670,000 to the average cost of a breach. See Shadow AI in the Enterprise for how to get it under control.

AI’s Limits as a Defender

AI is powerful, but it isn’t magic.

  • It makes mistakes in both directions. It can flag harmless activity as a threat (false alarms that waste time and cause alert fatigue), and it can miss real attacks, especially new ones designed to look normal.
  • It’s only as good as its data. Tools trained on limited or outdated data can misjudge situations, and attackers deliberately try to feed AI systems misleading data.
  • It raises privacy questions. Security AI analyses a lot of activity data, so you need to know what’s collected, where it’s stored and who can see it.
  • Someone still has to decide. If an AI tool locks out a user or shuts down a system by mistake, a person needs to be able to understand why and reverse it.

What a Small Business Should Do Now

You don’t need an in-house security team to put AI on your side. Focus on these steps:

  1. Upgrade to behaviour-based protection. Replace basic antivirus with endpoint protection that uses AI to detect suspicious behaviour, ideally with ransomware rollback. See why in Why “Free” Antivirus Fails Against Agentic AI Threats.
  2. Make phishing harder to win. Turn on multi-factor authentication everywhere, and move to passkeys where you can. A perfect phishing email is useless if there’s no password to steal.
  3. Verify every payment request by a second channel. Any request to pay, change bank details or share sensitive data gets confirmed by calling a known number, never the number in the message. Consider a family or team “code word” for emergencies.
  4. Train your team on AI-powered scams. Show staff what deepfake calls and polished phishing look like. Urgency, secrecy and unusual payment requests are still the giveaways.
  5. Set a simple AI use policy. Decide which AI tools staff may use, and what data must never be pasted into them.
  6. Keep humans in the loop. Let AI tools detect and contain threats automatically, but make sure someone reviews the alerts and the decisions.
  7. Keep immutable backups. If something does get through, backups that can’t be altered or deleted mean you can recover without paying a ransom.

Looking Ahead

AI will become part of almost every security tool over the next few years, and attackers will keep finding new ways to use it. Another change is coming too: future quantum computers could break some of the encryption used today. The answer there isn’t AI but post-quantum cryptography, new encryption standards that the US National Institute of Standards and Technology (NIST) published in 2024 and that vendors are now building into their products. Keeping your software and devices up to date is how most businesses will get that protection.

Conclusion

AI is a double-edged sword. It gives defenders speed and scale that were impossible a few years ago, and it gives criminals the same. The businesses that come out ahead will combine AI-powered tools with good habits: strong sign-ins, payment verification, trained staff and backups that can’t be destroyed.

If you’re not sure whether your current security is keeping up, get in touch. We’ll review what you have and recommend practical, affordable upgrades, with no overselling.