The fear is the wrong one
Almost every report on AI and cybersecurity tells the same story. Attackers get a super-brain, invent attacks no human has ever seen, and you urgently need a new tool with "AI" in its name to survive.
That is the wrong fear.
AI does not make attackers smarter. It makes them faster and cheaper. And for an SME that is a much more uncomfortable truth, because most successful attacks were never clever. They were simply faster than your response.
Anthropic, the company behind the AI model Claude, published a clear guide on this. Their core point: AI lowers the resources, the time, and the skill needed to find and exploit vulnerabilities. Over the next 24 months, countless previously undetected bugs will be found by AI and chained into working exploits. The second half of the sentence often gets lost: defenders who use the same tools can move just as fast.
This can be managed. It is a question of speed, and speed is something you can plan for.
What actually changes: the window is closing
Picture how it used to go. A vendor discloses a flaw. A security researcher writes a proof of concept weeks later. Criminals eventually turn it into a usable attack. You had, roughly speaking, a few weeks to patch.
That window was already shrinking before AI. In our experience, many SMEs still plan their updates in monthly cycles, with a maintenance window on the weekend and an approval process ahead of it. That very rhythm becomes the problem.
When a flaw becomes known and an automated attack runs against it a few hours later, your monthly cycle is no longer caution. It is an open barn door.
That is the whole point. It is not the attack that gets more dangerous. It is your inertia.
Six things that matter for an SME
The Anthropic guide lists seven recommendations for large security teams. Most are written for a corporation with its own department. We have boiled them down to what a Swiss SME with 50 to 500 employees can and should actually do.
1. Close your patch gap
This is the most boring topic in IT security. It is also the most important.
There is a public list of vulnerabilities that are demonstrably being actively exploited. The US agency CISA maintains it under the name "Known Exploited Vulnerabilities". Anything on that list that affects you needs patching immediately. Not in the next maintenance window. Immediately.
For everything else, prioritising by likelihood of exploitation helps, so you do not drown in a list of 4000 theoretical CVEs. And for anything reachable from the internet, a simple rule of thumb applies: patch within 24 hours once an exploit exists. If that only works with automatic rollout and automatic reboots, then that is the way. A manual approval process that takes three days costs you more in this world than it protects.
2. Expect more found vulnerabilities, not fewer
If AI makes finding vulnerabilities cheaper, then the good side finds more too. Your scanners, your service providers, your developers will suddenly produce ten times as many reports.
That is no reason to panic, but a reason to prepare. You need a simple process for how reports come in, how they are sorted, and who tracks them to resolution. A spreadsheet is enough at the start. What is not enough is "Roman will look at it when he has time".
And the same standard applies to your suppliers. If you expect fast patching from yourself, expect it from the companies whose software runs on your network too. That belongs in the contract, not in a gut feeling. More on this in our post Your supplier was hacked.
3. Build for the breach, not just against it
This is the thinking error we see most often. Security budgets flow almost entirely into the wall meant to keep the attacker out. Almost nothing flows into the question of what happens when they get in anyway.
In a world where attacks appear in hours, the weight shifts. You can no longer assume the wall always holds. So you build so that a break-in at one point does not mean the whole house.
In concrete terms: every request is verified, including the ones from your own network. Access is tied to a physical factor that cannot be phished by email, such as a passkey or a hardware key. And long-lived passwords and keys are replaced by short-lived, narrowly scoped access. That is the idea behind Zero Trust, and we explained it without the marketing fog in Demystifying Zero Trust.
4. Make yourself smaller
Here lies the biggest lever for an SME, and it usually costs no money, only discipline.
Every server, every service, every interface reachable from the internet is a door an automated attacker can touch. The uncomfortable reality from almost every assessment we do: nobody has a complete list of those doors. There is always the old server, the "temporary" access from three years ago, the forgotten test environment.
Keep a current list of everything facing outward. Shut off what nobody needs anymore. Reduce what each service offers to the outside. This is not technology, it is tidying up. But it simply takes away the AI attacker's targets. What is not reachable does not get attacked.
5. Shorten your response time
When attacks get faster, it is no longer prevention alone that decides, but how fast you notice something is happening and how fast you act.
This is exactly where AI helps you instead of working against you. A model can take the first pass over alerts and filter out the noise before a human looks. It can take notes during an incident, set timestamps, and deliver the first draft of the postmortem while your team solves the problem instead of documenting it.
You do not have to build this yourself. But you should have played through once what happens when it is not one incident but five at the same time. And you should have an emergency procedure that lets you patch or isolate within minutes in a real case, without the normal approval path. What such a real case actually looks like is in Incident Response Readiness.
6. Use the same tailwind
The part the fear version of the story leaves out: everything that makes the attack cheaper makes the defence cheaper too.
The same AI that finds flaws can review your code before it goes live. It can merge duplicate findings, suggest fixes, and take over the dull grunt work that has held back your few security people so far. For an SME this is not a threat, it is a levelling. For the first time, defence scales about as cheaply as attack.
That is why the right response is not "more budget for a fear tool". The right response is to make the gap between "we know about the flaw" and "it is closed" as small as possible. That is work on your process, not an item on a shopping list.
And if you have no security team at all?
Many SMEs have no person whose job is security. That is fine. The Anthropic guide has a short, honest list for exactly this, and it matches what we advise small operations anyway:
- Turn on automatic updates, everywhere. Operating system, browser, applications.
- Prefer managed services over a self-hosted server. Let someone else patch, someone who does it full time.
- Use passkeys or hardware keys on every account that supports them.
- Turn on the free security features you already have, for example in Microsoft 365.
This is not high security. But it closes the doors that the vast majority of automated attacks come through.
Where to start tomorrow morning
If you take only one thing from this article: the problem is not the clever attack. The problem is the gap between the moment a flaw becomes known and the moment you close it.
So do exactly one thing tomorrow morning. Open the CISA list of actively exploited vulnerabilities and check whether any of it runs at your place. If so, patch it this week. Not this month.
The rest, the attack surface, the assume-breach architecture, the incident process, follows from there. But it follows at your pace, planned and budgeted, instead of grabbing in a panic for the next tool with "AI" on the box.
And if you do not know which of your doors stand open: that is exactly what we look at first in a Security Assessment. Usually the list is shorter than feared and the first step is cheaper than expected.
