Defenders got affordable triage and instant response. Attackers got flawless phishing at volume, a voice that sounds like your director, and a new target: your own assistant. What changed, and the two habits worth more than any product.
Security ran on machine learning long before the current wave, because flagging the access pattern that behaves strangely is a decade-old product category. What changed is the other side of the table. Phishing now arrives without typos, written to match a real person's style, in volume no human scammer could type. A voice on the phone matches a director they have never met. And a surface appeared that nobody had to patch because nobody built it: the AI assistant itself, which will cheerfully follow instructions if it reads them in a place it trusts.
Where the guard side genuinely earns its keep
Triage is the unglamorous win. Alert noise drops from a thousand a night to a dozen worth reading, and that is the difference between a team that performs and a team that rubber-stamps. Behavioural drift catches the account that is technically allowed and practically wrong, the credentials being used on a schedule no human on that staff works. And response: isolating a machine in seconds while the incident ticket is still being typed. None of this is AI replacing the analyst. It is the analyst not drowning.
The burglar's short list
Read the year's incidents and the list is short and specific. Impersonation calls asking for urgent wires, with voice clones that pass a familiar ear. Prompt injection, where hostile text hidden inside a document or a webpage waits for your assistant to summarise it and obey it. Reconnaissance through chatbots, because an assistant with tools will happily enumerate your support process all night without anyone being suspicious of it. And slower, quieter, upstream: poisoning what a retrieval system believes next quarter by editing what it reads today.
The thread running through all of them: these attack people and process, not software. The wire transfer was a person's decision on a trusted phone. The poisoned instruction got in because the assistant was trusted to read the outside world and had hands on the inside. No product on any vendor's page closes a process hole.
What an eleven-person business can actually do
Two habits still outperform every product above. Money and account-change requests get verified through a channel you already had before the request arrived, because the attacker who can ring from your CEO's number can also answer when you ring back. And a leash: anything that reads the outside world, email, documents, web pages, gets no hands on anything internal until a person looks. The first habit costs nothing. The second is architecture. Both are on the wall in every one of our labs, because builders who learn them late pay for them in public.
Kit for this lesson
A sandbox you can open suspicious documents inside, with a PCIe slot for whatever isolation you want. Small, cheap, and it belongs on any desk that reads the internet on the business's behalf.
View on Amazon
Backups the AI cannot be tricked into deleting: snapshots on a box your assistant has no credentials for. The oldest defence on the list and still the one that survives everything.
View on AmazonAs an Amazon Associate, AI Universe City earns from qualifying purchases. Prices link to Amazon and may change; the picks above are what we actually use in the Labs.