How AI changed hacking for small businesses

The UK’s National Cyber Security Centre puts it plainly. It judges that AI will “highly likely increase the volume and impact of cyber intrusions” through 2027, and that it will “almost certainly” shrink the time between a flaw being found and criminals using it.¹

“This is an AI arms race.” Adam Meyers, CrowdStrike, on its 2026 Global Threat Report²

Here’s what has actually changed, and what it means if you run a small business website.

1. The scam emails got good

Spelling mistakes used to give phishing away. Not any more. Hoxhunt found AI wrote under 5% of phishing emails for most of 2025, then 56% in December, and those emails got past filters.³

The FBI logged 22,364 AI-related complaints and US$893 million in losses in 2025, the first year it counted them separately.⁴ For a small business, that usually looks like a perfect copy of an email from your web host, your bank or a supplier asking you to “confirm” a login or update bank details.

2. Attacks move faster

CrowdStrike says criminals now move from a first foothold to the rest of a network in 29 minutes on average, 65% faster than a year before. The fastest it saw took 27 seconds. Attackers using AI increased their activity by 89%.²

3. Holes are found and used sooner

For the first time in the 19 years Verizon has published its breach report, exploiting software flaws overtook stolen passwords as the top way in, at 31% of breaches.⁵ Mandiant estimates attackers now use flaws, on average, about a week before a fix is even available.⁶

That matters for every site that runs software with a login: WordPress, Joomla, Drupal, and the add-ons on top of them. “Keep everything updated” is still right, but it’s no longer enough on its own.

4. Less skill is needed

Patchstack warns about “vibe coding”: add-ons built with AI by people who can’t check the code, adding new holes to the WordPress world.⁷ On the other side, criminals can now ask an AI to do work that used to need an expert.

Milestones from the last 18 months

• Mid 2025. XBOW, an automated AI system, became the first non-human to reach the top of HackerOne’s US ranking of bug hunters, filing over 1,000 reports in a few months.⁸ It was working for the good guys. The same kind of tool in the wrong hands finds holes just as fast.
• November 2025. Anthropic reported that a state-sponsored group used its Claude Code tool to attack about 30 organisations, with the AI doing an estimated 80 to 90% of the hands-on work. Anthropic called it what it believes is “the first documented case of a large-scale cyberattack executed without substantial human intervention.”⁹
• November 2025. Google found experimental malware, PROMPTFLUX, that asks an AI model to rewrite its own code every hour so antivirus can’t recognise it.¹⁰
• May 2026. Verizon worked with Anthropic to study how criminals used AI, the first time the best-known breach report has done so.⁵

What this means for a small site

When finding and using a hole took a skilled person days, attackers chose big targets worth the effort. Now a program can find the hole, write the attack and run it across millions of sites in an afternoon. The cost of including your site is close to zero.

“Nobody would bother with us” no longer holds.

What still works

The good news: the basics stop most of these attacks. AI makes attacks faster. It doesn’t make a door appear where there isn’t one.

• Two-step login on your email, domain and hosting, ideally with an authenticator app.
• Fewer moving parts. Delete plugins and themes you don’t use. Each one is a door.
• A rule for money. Any change to bank details gets confirmed by phone, on a number you already have.
• A backup you control, stored somewhere other than your hosting.
• Or take the doors away. A static site has no login page, no plugins and no database for automated tools to try.

Sources

1. UK National Cyber Security Centre, Impact of AI on cyber threat from now to 2027. ↩

2. CrowdStrike, 2026 Global Threat Report (February 2026). ↩ ↩²

3. Hoxhunt, Phishing Trends Report 2026, via Expert Insights. ↩

4. FBI Internet Crime Complaint Center, 2025 Internet Crime Report. ↩

5. Verizon, 2026 Data Breach Investigations Report, via Help Net Security and TechRepublic. ↩ ↩²

6. Mandiant, M-Trends 2026, via Security Boulevard. ↩

7. Patchstack, State of WordPress Security in 2026. ↩

8. XBOW, The road to Top 1; TechRepublic. ↩

9. Anthropic, Disrupting the first reported AI-orchestrated cyber espionage campaign (November 2025). ↩

10. Google Threat Intelligence Group, via BleepingComputer. ↩