Artificial intelligence is changing cybersecurity on both sides of the equation.
Security tools can use AI to help identify unusual activity, suspicious messages, and malicious behavior. At the same time, attackers can use AI to create more convincing phishing messages, impersonate executives, automate portions of attacks, and make fraudulent communications harder to recognize.
For businesses, the answer is not to rely on one security product. The strongest defense is still a layered approach that combines employee awareness, identity protection, endpoint security, monitoring, backups, access controls, and good security processes.
Here are some of the most important AI-enabled and evolving cyber threats businesses should understand.
AI-Powered Phishing Is Becoming More Convincing
Phishing attacks have traditionally relied on poorly written emails, obvious spelling mistakes, or suspicious-looking messages.
AI makes it easier for attackers to create polished, personalized messages that sound more believable.
An attacker can potentially use publicly available information about:
- company executives,
- employees,
- vendors,
- customers,
- projects,
- job responsibilities,
- and business relationships
to create a message that appears relevant to the recipient.
The goal may be to convince someone to:
- click a malicious link,
- enter credentials into a fake login page,
- open an attachment,
- transfer money,
- change banking information,
- or approve an unexpected authentication request.
NIST specifically warns that artificial intelligence can be used to create increasingly convincing phishing messages and recommends employee training, email filtering, email authentication, and multi-factor authentication as important defenses.
For additional guidance, see NIST's official phishing guidance for small businesses.
Employee training still matters
AI may improve the quality of the message, but the attacker still needs the recipient to take an action.
Employees should be trained to slow down when a message involves:
- unusual urgency,
- password or MFA requests,
- confidential information,
- wire transfers,
- bank-account changes,
- unfamiliar links,
- unexpected attachments,
- or a request to bypass normal procedures.
Our guide to 5 Examples of Social Engineering Attacks explains several of the manipulation techniques attackers use to make these requests believable.
Ransomware Is More Than File Encryption
Ransomware remains one of the most disruptive cyber threats facing businesses.
Modern ransomware incidents may involve more than simply encrypting files. Attackers may also steal data before encryption and threaten to publish or sell it if the victim does not pay.
CISA describes this combination of encryption and data theft as double extortion and recommends a layered approach to ransomware prevention that includes phishing-resistant MFA, employee training, email filtering, endpoint protection, access controls, backups, and incident-response planning.
The current CISA StopRansomware Guide provides detailed prevention and response recommendations for organizations.
Reduce the chance of ransomware spreading
Businesses should focus not only on preventing the initial compromise, but also on limiting what happens after an attacker gets in.
Important controls include:
- multi-factor authentication,
- timely security updates,
- endpoint detection and response,
- restricted administrative privileges,
- tested backups,
- centralized monitoring,
- network segmentation,
- and documented incident-response procedures.
A ransomware attack may begin with one compromised email account or workstation. Whether it becomes a company-wide outage often depends on how much access that account or device has to the rest of the environment.
Deepfakes and AI Voice Impersonation Create a New Verification Problem
AI-generated audio and video make impersonation attacks more convincing.
An attacker may attempt to imitate:
- a company owner,
- executive,
- customer,
- vendor,
- financial institution,
- or even an IT support person.
The request might involve:
- transferring money,
- changing payment instructions,
- resetting a password,
- providing confidential information,
- purchasing gift cards,
- or granting access to a system.
The important lesson is that a familiar voice or realistic-looking video should not be treated as proof of identity.
Verify high-risk requests another way
Businesses should establish procedures requiring independent verification for unusual financial, access, or credential-related requests.
For example, if an executive appears to request an urgent payment change, the employee should verify the request using a phone number or communication method already known to be legitimate.
Do not verify a suspicious request using contact information supplied in the suspicious message itself.
This same principle applies to email, phone calls, video calls, text messages, and collaboration platforms.
Supply-Chain Attacks Can Reach Businesses Through Trusted Vendors
Businesses depend on software providers, cloud services, equipment vendors, consultants, and other third parties.
That creates another opportunity for attackers.
Instead of attacking your company directly, an attacker may compromise a trusted provider and use that relationship to reach customers.
A supply-chain compromise can involve:
- software updates,
- vendor credentials,
- remote-access tools,
- cloud applications,
- shared accounts,
- or third-party integrations.
The challenge is that traffic or software coming from a trusted vendor may initially appear legitimate.
Limit vendor access
Third-party access should be treated as carefully as employee access.
Businesses should know:
- which vendors have remote access,
- what systems they can reach,
- which accounts they use,
- whether MFA is required,
- whether access is logged,
- and whether old vendor accounts are removed when no longer needed.
Vendors should have access only to the systems necessary to perform their work.
This is especially important in manufacturing environments where machine vendors, automation contractors, and equipment providers may need access to production systems.
IoT and Connected Devices Expand the Attack Surface
Businesses are connecting more devices to their networks than ever before.
Depending on the environment, those devices may include:
- cameras,
- printers,
- access-control systems,
- environmental sensors,
- smart televisions,
- production equipment,
- CNC machines,
- PLCs,
- building-management systems,
- and other Internet of Things devices.
Some of these devices receive limited security updates, use default credentials, or were not designed with modern cybersecurity requirements in mind.
That makes them different from a traditional workstation or server.
Separate devices based on risk
Businesses should avoid assuming every device belongs on the same network.
At a minimum:
- change default passwords,
- install firmware updates when available,
- disable unnecessary services,
- restrict device access,
- monitor unusual communication,
- and separate higher-risk devices from sensitive business systems.
For manufacturers, office IT, IoT devices, and operational technology should not automatically operate on one flat network.
Our Manufacturing Network Segmentation Guide explains how segmentation can help isolate production equipment, IoT devices, office systems, and other network resources.
MFA Is Still One of the Most Important Controls
AI may make phishing more sophisticated, but stolen credentials remain valuable to attackers.
Multi-factor authentication creates an additional barrier when a password is compromised.
NIST recommends MFA for accounts that support it and notes that phishing-resistant forms of authentication provide stronger protection against credential-based attacks.
For businesses using Microsoft 365, our guide on how to activate MFA for Microsoft 365 explains the basic setup process.
MFA should be especially important for:
- email,
- remote access,
- administrator accounts,
- cloud applications,
- financial systems,
- and accounts with access to sensitive information.
Backups Must Be Protected From the Attacker
Backups remain essential for ransomware recovery, but simply having a backup is not enough.
Attackers may deliberately attempt to delete, encrypt, or disable backups before deploying ransomware.
Businesses should know:
- what is being backed up,
- how often backups run,
- where copies are stored,
- who can access them,
- whether backup systems use separate credentials,
- and whether recovery has actually been tested.
CISA recommends protecting critical backups and incorporating recovery planning into ransomware preparation.
A backup that has never been successfully restored should not be assumed to work during an emergency.
Security Monitoring Helps Detect Problems Earlier
Many cyber attacks do not begin with an obvious outage.
An attacker may spend time:
- using stolen credentials,
- exploring systems,
- escalating privileges,
- accessing email,
- moving between devices,
- or gathering data
before the organization realizes something is wrong.
Endpoint protection, identity monitoring, email security, centralized logging, and alert review can help detect suspicious activity earlier.
The important part is not just generating alerts. Someone must be responsible for reviewing and responding to them.
Businesses that need ongoing monitoring, endpoint protection, identity security, email protection, and cybersecurity management can learn more about our Managed Security Services.
Cybersecurity Should Be Layered, Not Product-Based
There is no single “AI cybersecurity tool” that can prevent every phishing attack, ransomware incident, deepfake scam, vendor compromise, or IoT threat.
The strongest approach uses multiple layers:
- employee awareness reduces social-engineering risk,
- MFA protects accounts,
- email security filters suspicious messages,
- patching reduces known vulnerabilities,
- endpoint protection detects malicious behavior,
- backups support recovery,
- access controls limit exposure,
- segmentation limits lateral movement,
- and monitoring helps identify suspicious activity sooner.
NIST describes cybersecurity as an ongoing process rather than a one-time project and recommends continuous improvement as threats, technology, and business conditions change.
That is a better way to think about AI-related cyber risk as well: the tools and attack methods will continue to change, but strong security fundamentals remain important.
What Manufacturers Should Consider
Manufacturers often have additional complexity because office systems and production environments may share technology dependencies.
A compromise involving email or an employee workstation can become much more serious if attackers can move from office IT into production equipment, industrial systems, or vendor-connected devices.
Manufacturers should pay particular attention to:
- MFA,
- network segmentation,
- endpoint protection,
- backup and recovery,
- vendor access,
- legacy systems,
- production IoT,
- administrative privileges,
- and documented incident response.
These controls may also appear in cyber-insurance applications and renewal questionnaires.
Our Manufacturing Cyber Insurance Guide explains how cybersecurity controls such as MFA, backups, security awareness, endpoint protection, and network security can factor into cyber-insurance readiness.
AI Changes the Threat, but the Fundamentals Still Matter
AI can make cyber attacks faster, more personalized, and more convincing.
That does not mean businesses need to abandon established cybersecurity practices.
In many cases, the most effective defenses are still the fundamentals:
- verify unusual requests,
- protect identities with MFA,
- train employees,
- patch systems,
- monitor endpoints and accounts,
- limit access,
- segment networks,
- protect backups,
- and prepare for recovery.
The goal is not to depend on employees recognizing every sophisticated attack perfectly or to assume technology will block everything.
The goal is to build enough layers that one convincing email, stolen password, compromised device, or vendor account does not become a major business disruption.
