When AI Suddenly Switches Sides
A few months ago, a managing director of a mid-sized engineering company called us. His voice sounded tired. "We've been hacked," he said. "And the crazy thing is—the phishing email was so perfectly written that even our IT manager fell for it." What followed were three weeks of chaos, six figures in damages, and a hard lesson about what's become "normal" in 2026.
Because cybercrime has changed—fundamentally. What used to be poorly written spam emails with obvious typos are now surgically precise attacks. The difference? Artificial intelligence.
Why AI Has Completely Changed the Playing Field
Remember those typical phishing emails from five years ago? "Dear Custmer, Your acount has been suspendid." You didn't need to be an expert to spot them. That's no longer the case.
Modern attackers feed their AI systems with publicly available information about your company—LinkedIn profiles, press releases, even your website copy. The result: emails that sound like they genuinely come from your business partner. The AI imitates writing styles, knows about internal projects, strikes the right tone. And it works around the clock, targeting thousands of victims simultaneously.
Then there are the deepfakes. A German company lost over one million euros in 2025 because an employee spoke with their "CEO" on a Teams call—except it wasn't the real CEO. The voice was right, the face was right, even the way he spoke. All AI-generated. And we're not talking about Hollywood technology here: today, three seconds of audio material is enough to create a convincing voice clone.
The Uncomfortable Truth for SMEs
Large corporations have SOC teams, dedicated threat intelligence departments, and budgets bigger than many mid-sized companies' annual revenue. SMEs don't. And that's precisely why they're the preferred target.
It sounds paradoxical—why would someone attack a small company when they could hack BMW? The answer is simple: because it's easier. Ransomware groups operate on the principle of scale. They automatically scan for vulnerabilities, and a company with 50 employees and an outdated firewall is significantly easier to crack than a corporation with a hundred-person security team.
The statistics paint a clear picture: 78% of all phishing attacks now use AI-generated content. Deepfake-based CEO fraud attacks have quadrupled since 2024. And the average time until an AI-powered attack is even detected is 287 days—nearly ten months of someone moving through your network unnoticed.
What You Can Do About It—Without a Million-Dollar Budget
Now the good news: you don't need a Fortune 500 budget to protect yourself. What you need is a smart approach. Let me break it down into three areas.
The Technical Foundation
Let's start with what makes the biggest difference immediately: multi-factor authentication. Yes, MFA. Sounds boring, but it's the single most effective thing you can do. Microsoft says MFA blocks 99.9% of all credential attacks. Not 50%, not 80%—ninety-nine point nine percent. If you're still accessing business-critical systems anywhere without MFA, that's like a front door without a lock.
However, not all MFA is created equal. SMS-based codes? Can be bypassed through SIM swapping. Authenticator apps are significantly better, and hardware tokens like YubiKeys or Passkeys are the safest option. A YubiKey costs about €50-70 per employee—that's cheaper than a single call to the IT emergency service.
Then: email security. Not the free spam filter that comes with your mail system, but a real security solution that detects AI-generated phishing emails. Solutions like Microsoft Defender for Office 365 or Proofpoint analyze writing styles, check links in real-time, and detect when someone is impersonating your boss. The cost? Three to five euros per user per month.
And finally: EDR instead of traditional antivirus. Endpoint Detection and Response doesn't just detect known viruses—it monitors behavior on your devices. If a process suddenly starts mass-encrypting files, EDR raises the alarm—and stops it before the damage is done.
The Human Factor
Technology alone isn't enough. If your employees don't know what to watch out for, the best security software is just an expensive placebo.
But forget the annual mandatory training where everyone clicks through a PowerPoint half-asleep. That achieves nothing. What works: short, regular micro-trainings—five to ten minutes per week, integrated into the workday. Combined with simulated phishing campaigns where your employees receive real (but harmless) fake emails. Anyone who clicks gets an immediate, brief training session. No finger-pointing, no shaming—just learning in the moment.
Especially important: a verification process for financial transactions. Every transfer above a certain amount should be confirmed by phone—using a known number, not the one from the suspicious email. Sounds old-fashioned? It would have saved the engineering company I mentioned at the beginning one million euros.
The Emergency Plan
No protection is perfect. That's why you need a plan for when it does happen. And you need it before it happens.
What many get wrong: shutting down the computer in a panic. Don't do that. The RAM often contains the only traces that enable forensic analysis. Instead: unplug the network cable, disable WiFi—but leave the device running.
A good incident response plan fits on two pages. It answers the most important questions: Who do we call? Who decides what? How do we communicate internally and externally? Where are our backups? Print it out and hang it next to the server room. Because when the ransomware hits, you won't be able to access your digital documents anymore.
What This All Costs—and What It Saves
Let's talk money. For a company with 50 employees, we roughly estimate: email security (€150-250/month), EDR (€250-500/month), MFA tokens (one-time €2,500-3,500), security awareness training (€100-200/month). Total: €15,000 to €30,000 per year.
Sounds like a lot? Compare that with the average cost of a successful ransomware attack: €150,000 to €500,000. Without counting the reputational damage, which can't be measured in euros but can drive away customers.
The calculation is simple: prevention costs a fraction of the cure. My grandmother already knew that—only she was talking about dental care, not cybersecurity.
Start With the Quick Wins
My advice: don't let the complexity overwhelm you. Start this week with three things. First: activate MFA everywhere. Second: explain to your employees why they should always pick up the phone for urgent transfer requests. Third: check whether your backups actually work—not whether they exist, but whether you can restore from them.
Everything else can come after, step by step. Because perfect security doesn't exist. But "significantly better than yesterday" is a goal any company can achieve today.
*Have questions about your IT security? We're happy to advise you—honestly and without sales pressure. Schedule a conversation*
