ExponenLabsExponenLabs
AI-era security · For companies without a security team

Hackers got AI. You do not have a security team. Close the gap in six weeks.

AI now finds software flaws in hours and writes the exploit for them. It also writes the phishing email in your supplier's voice and clones your CEO on a call. Big companies answer with a red team. You do not have one, and you do not need one. You need six things done in the right order, by someone senior who owns them until they are done.

Book a 30-min AI security callCheck what one rogue AI agent could do (3 min)

Month to month · Stop any month, keep everything

You speak to the senior lead who would do the work. If we are not the right fit, we will say so.

Free · no sign-up · instant result

Five things changed. Each one hits small companies hardest.

Large firms have people whose whole job is to absorb this. You have an owner who is also the IT department.

  1. Change 1

    Speed

    Finding a flaw and writing the attack used to take skilled people weeks. AI cuts that to hours. Your window to patch is no longer “next quarter.”

  2. Change 2

    A flood of patches

    The same models find flaws for defenders, so software vendors now ship more fixes, more often. If updating is something your team “gets round to,” it just became your main defence.

  3. Change 3

    Fakes that pass

    AI writes the phishing email in your supplier’s voice. It clones your CEO’s voice from a podcast clip. Voice phishing is now the second most common way in, at 11% (M-Trends 2026). Arup lost $25.6 million to a video call full of deepfaked colleagues.

  4. Change 4

    Small stopped being safe

    Attackers used to skip small targets because each one cost too much time. A machine that makes thousands of requests a second does not skip. This one is our read of the evidence, not a measured fact. But small firms already make up most ransomware victims.

  5. Change 5

    Your own AI is a new door

    Staff paste customer data into personal AI accounts. Agents that read email can be tricked by the email. Apps built with AI coding tools ship without basic access controls. A Symbiotic Security scan of 1,072 such apps found flaws in 98%. A vendor’s sample, but the pattern is real.

The numbers behind it

Every figure links to where we read it. Last reviewed 25 October 2026.

−7 days

Average time between a flaw going public and attackers using it, in 2025. Negative means the average flaw was used before a patch existed. It was 63 days in 2018.

Google Threat Intelligence Group, M-Trends 2026 (via Help Net Security) · March 2026

An estimate. We read it in a news write-up of the report, not the report.

Months → hours

What frontier AI models can do to the time it takes to find a flaw and build a working exploit, according to Singapore’s national cyber agency.

Cyber Security Agency of Singapore, advisory AD-2026-004 · April 2026, updated October 2026

A government assessment of what the models can do, not a count of attacks.

26 CVEs

Palo Alto Networks’ May 2026 advisory. It normally lists fewer than five a month. It was the first month most findings came from frontier AI scanning its own code.

Palo Alto Networks · May 2026

A vendor describing its own products. None of the flaws were known to be exploited.

31%

Breaches that began with someone exploiting a vulnerability. That is now the top way in, ahead of stolen credentials at 13%.

Verizon DBIR 2026 (via TechRepublic) · 2026

Secondhand: we could not open Verizon’s report. Check the original before you quote it.

~96%

Share of ransomware victims that were small or mid-sized businesses, where the victim’s size was known.

Verizon DBIR 2026 (via eSecurity Planet) · 2026

Secondhand, and one summary words it the opposite way round. We use the reading in the article body.

80–90%

Share of the work an AI did in the first reported AI-run espionage campaign. Humans made four to six decisions per target. At peak it made thousands of requests, often several a second.

Anthropic · November 2025

A state-backed group aimed at large targets, and the AI sometimes invented credentials.

45%

Employees who now use AI regularly on company systems, up from 15% a year earlier. About two in three of those reach AI through a personal account.

Verizon DBIR 2026 (via eSecurity Planet) · 2026

Secondhand, and it measures all sizes of company, not only small ones.

$893M

Losses in 22,364 complaints the FBI’s internet crime centre logged as AI-related in 2025, its first year of counting. The FBI says it is likely too low, because victims often do not know AI was used.

FBI IC3 2025 report (via SecureWorld) · 2026

Secondhand. We did not open the FBI report.

One real case

In July 2026, Sysdig reported what it calls the first ransomware attack run from start to finish by an AI agent, named JADEPUFFER. It got in through a flaw in Langflow, a tool for building AI apps, that the vendor had fixed in April 2025. The agent found credentials, moved to a production server and encrypted data, fixing its own errors as it went (The Hacker News). The lesson is not a new trick. It is an old gap, an unpatched AI tool and loose credentials, used at machine speed. Sysdig sells detection products, and we found no independent confirmation yet.

Read these with care

  • Several figures are secondhand. We link the article we read, and say so on the card. Check the original before you quote one.
  • AI is not yet behind most breaches. Mandiant called attackers' use of AI “incremental” in 2025 and found most intrusions came from human and systemic failures. The story is old gaps found faster and fakes made cheaper.
  • Palo Alto's estimate of a three-to-five-month window before AI-built exploits become common is a forecast, not a measurement. It also says frontier models so far find new attacks, not new techniques.
  • Almost none of this data is split out for small firms. Where a figure covers all company sizes, the card says so.

You cannot afford their defences. You can afford their results.

What a large company has, and what a company without a security team does instead.

  • A red team that attacks itAI-assisted scans of your own systems, on a scheduleProbe
  • A security operations centreMFA everywhere, five alerts that matter, and a managed detection partnerLock
  • A CISO who owns the riskOne named owner and a monthly 30-minute reviewRehearse
  • An awareness programmeOne rule: no money moves on a call or email aloneVerify
  • An AI governance committeeA one-page AI policy and a register of every agentFence

Six steps. Six weeks. In this order.

The order matters. Early steps stop the most damage for the least effort. Each step ends with something you can check.

  1. 1

    Map

    Week 1NIST CSF: Identify

    Find everything you have, including what you forgot.

    • List every domain, cloud account, SaaS login, device and admin account, and who holds each.
    • Find the AI you did not approve: personal chatbot accounts, browser plug-ins, automations, apps built with AI coding tools.
    • List every agent and what it can touch: email, files, payments, customer data.
    You get
    A one-page exposure map, ranked by how much damage each item could do.
    Done when
    Every system and every agent has a named owner.
  2. 2

    Lock

    Weeks 1–2NIST CSF: Protect

    Fix the doors AI tries first.

    • Turn on multi-factor authentication for email, admin, cloud and finance.
    • Patch anything facing the internet. Close or hide exposed admin panels and test environments.
    • Delete dormant accounts and default passwords. Move secrets out of code.
    • Make backups you cannot delete from your own network, then restore one to prove it works.
    You get
    The top ten fixes, done, not listed.
    Done when
    No critical flaw is open on anything facing the internet, and one restore has worked.
  3. 3

    Probe

    Weeks 2–3NIST CSF: Identify · Detect

    Attack yourself before someone else does.

    • Run AI-assisted scans on systems and code you own: configuration, dependencies, exposed services.
    • Test your own people with a fake invoice and a fake voice message, with the owner’s consent.
    • Rank what we find by what an attacker would reach first.
    You get
    A ranked findings list, each with a fix and an owner. This is not a full penetration test, and we say so in the report.
    Done when
    Every critical finding is fixed or fenced off.
  4. 4

    Fence

    Weeks 3–4NIST CSF: Govern · Protect

    Put limits around the AI you use.

    • Write a one-page AI policy: approved tools, data that never goes in, who decides.
    • Build the agent register: each agent’s owner, permissions, spend cap and off switch.
    • Give agents the least access that works. A human approves anything you cannot undo: payments, deletions, outgoing mail.
    • Treat every email, web page and file an agent reads as untrusted input.
    You get
    The AI policy and the agent register, in your accounts.
    Done when
    Every agent has an owner and an off switch that someone has tested.
  5. 5

    Verify

    Weeks 4–5NIST CSF: Protect

    Make fake voices and emails useless.

    • Set the money rule: new bank details or an urgent transfer gets checked on a second channel, using a number you already hold.
    • Add a two-person rule above a limit you choose, and a code word for the executives who are easy to clone.
    • Run a 30-minute drill with real examples of AI fakes.
    You get
    A one-page payment and identity protocol everyone has seen.
    Done when
    Nobody can move money, or reset a password, on a call alone.
  6. 6

    Rehearse

    Week 6NIST CSF: Respond · Recover

    Run the bad day before it happens.

    • Write the incident page: who calls whom, who can shut what off, who tells customers, the insurer and any regulator.
    • Run a 60-minute tabletop: a vendor is breached, or the CEO is cloned.
    • Check your cyber insurance: what it requires and what it excludes.
    • Name the owner, then set the monthly 30-minute loop and a re-probe every quarter.
    You get
    An incident runbook, a tested restore, and a loop that runs without us.
    Done when
    Your team ran the drill and found the gaps themselves.

Steps map to the six functions of the NIST Cybersecurity Framework 2.0 small business guide, so the work stands up when a customer, insurer or auditor asks.

Going deeper on step 4? Prompt injection and agent permissions, and a 30-minute test.

What you keep

Embed. Equip. Hand over. It only counts if it still works when we leave.

Start with our one-page AI guidelines template
  • The exposure map of every system, account and agent
  • The fixes, already applied in your accounts
  • A one-page AI policy and the agent register
  • The payment and identity protocol
  • The incident runbook and a restore that has been tested
  • A team that has run the drill, and a monthly loop to keep it current

What this is not

We would rather lose the work than sell you the wrong thing.

  • Not a security operations centre. We do not watch your network around the clock. For that, we help you choose a managed detection provider.
  • Not a full penetration test or a compliance certificate. If a customer or regulator needs one, we scope it and point you to an accredited tester.
  • Not a promise you will never be breached. Nobody can give you that. We shrink the odds and the damage, and make sure you notice.
  • Not a pile of tools. We start with what you already pay for. Most of this is settings, rules and habits.

This is for you if

  • You have 5 to 200 people and no one whose full job is security.
  • Your team uses AI tools, or you are about to give agents access to real data.
  • You hold customer data, take payments, or move money by bank transfer.
  • You sell to larger companies that now ask for security answers.

Skip it if

  • You already run a security team and a 24/7 operations centre.
  • You want a certificate this quarter. We can prepare you, but we do not issue it.
  • You want a tool to buy and forget. This is a habit, not a product.

Who runs it

A senior lead from our team, inside yours. The person on the first call does the work.

Fractional CAIO

Owns the AI policy, the agent register, the vendor checks and the monthly loop. Right if the main risk is how your people use AI.

Forward Deployed CTO

Owns the platform, the code review and the secure build process. Right if you ship software, or ship it with AI coding tools.

Not sure which? Book the call. We will tell you, and tell you if neither fits.

Questions about AI and cybersecurity

What is changing, what to do first, and what we do and do not do.

How is AI changing cyberattacks on small businesses?
In four ways. It shortens the time between a flaw going public and an attack using it: Google’s threat group estimated the average in 2025 at minus seven days, meaning exploitation often starts before a patch exists. It makes phishing, voice calls and video fakes believable. It automates the work, so attackers no longer need to skip small targets. And it adds a new door: the AI tools and agents your own team uses. Mandiant also reported that attackers’ use of AI was still incremental in 2025, and that most intrusions came from old, human failures such as unpatched systems and weak access. So the fix is mostly the basics, done fast.
Are small businesses really being targeted?
Yes. Verizon’s 2026 data breach report, as reported by eSecurity Planet and TechRepublic, puts small and mid-sized businesses at about 96% of ransomware victims where the victim’s size was known. Most attacks are not aimed at you by name. They are automated, and they hit whoever has the open door.
What should a small business do first about AI cyber threats?
Three things, in this order. Turn on multi-factor authentication for email, admin, cloud and finance accounts. Patch everything facing the internet and remove what you do not use. Set one rule: no money moves, and no password resets, on a call or email alone. That covers most of what attackers try first. After that, write a one-page policy for the AI tools your people use.
Do we need a red team?
No. A red team is a group of people paid to attack a large company. You can get most of the value for a fraction of the cost: AI-assisted scans of the systems and code you own, a fake invoice sent to your own finance team, and a quarterly re-test. A full penetration test is worth buying when a customer, insurer or regulator asks for one.
Is using ChatGPT, Claude or other AI tools at work a security risk?
It can be. The risk is not the tools. It is staff using personal accounts with no rules about what goes in. Verizon’s 2026 report, as reported by eSecurity Planet, found regular AI use on corporate systems rose from 15% to 45% in a year, and that about two in three of those users reached AI through non-corporate accounts. Approve the tools, say what data never goes in, and use business accounts so you can see and switch off access.
What is prompt injection, and does it affect a small business?
Prompt injection is hiding instructions inside content that an AI reads, such as an email, a web page or a document, so the AI obeys the attacker instead of you. A chatbot that is tricked gives a bad answer. An agent that is tricked can send files, change records or pay an invoice. It matters the moment an agent can read outside content and also act. The fix is limits: give agents the least access that works, treat everything they read as untrusted, and require a human to approve anything you cannot undo.
How do we stop deepfake CEO and invoice fraud?
Do not try to spot the fake. Change the process so a fake cannot win. Any new bank detail or urgent transfer is confirmed on a second channel, using a number you already hold, never one given in the request. Add a two-person rule above a set amount. Executives agree a code word. In the Arup case, an employee approved $25.6 million after a video call that looked real, so judging by eye is not a control.
Do you replace our IT provider or a managed security service?
No. We sit above them. We decide what needs protecting, close the gaps, set the rules for AI, and check your providers are doing their part. We do not run a 24/7 operations centre. If you need one, we help you pick a provider and make sure it covers the right things.
How long does it take, and what does it cost?
The six steps run over about six weeks, with the fixes that matter most landing in the first two. We scope and price it on a free 30-minute call, once we know your systems. If you want one person to own it afterwards, a fractional CAIO starts from $3,000 a month, month to month. Stop any month and keep everything.

Close the gaps before someone's AI finds them.

You speak to the senior lead who would do the work. If we are not the right fit, we will say so. In 30 minutes you will know which of the six steps is your biggest gap.

Book a 30-min AI security callOr start with the free agent check