Artificial intelligence adoption is moving incredibly fast, especially among small businesses. Employees are using ChatGPT, Microsoft Copilot, coding assistants, and AI features embedded within everyday business applications. In many cases, these tools are being used before the organization has established policies, reviewed the security risks, or determined what company information employees are permitted to share.
Attackers are adopting AI just as quickly. AI is making phishing, business email compromise, voice cloning, reconnaissance, and malicious code development faster and more accessible. At the same time, businesses are creating an entirely new attack surface through AI applications, third-party models, plugins, software packages, and automated agents.
Businesses do not need to stop using AI. However, they should understand where it is being used, what information it can access, and what actions it is permitted to perform.
How Attackers Are Using AI
AI is not necessarily creating an entirely new category of cybercrime. Instead, it is helping attackers improve the speed, scale, and effectiveness of attacks that businesses already face.
Phishing at Machine Scale
Attackers are using AI to create polished and highly personalized phishing emails in minutes. These messages can imitate an executive, reference a trusted vendor, or include information gathered from social media and public business records.
Traditional phishing emails were often easy to identify because of poor grammar, unusual wording, or obvious formatting issues. AI-generated phishing emails can be professional, convincing, and consistent with normal business communication. This makes it increasingly difficult for employees to determine whether a message is legitimate based on appearance alone.
Deepfake Voice and Video Fraud
Voice-cloning technology can imitate an executive, employee, vendor, or family member using a relatively small audio sample. Attackers may obtain these samples from social media, recorded presentations, podcasts, or publicly available videos.
An employee could receive a phone call that appears to come from the company owner requesting an urgent wire transfer, password reset, or sensitive document. Video deepfakes can make these requests even more convincing. Businesses should establish verification procedures for financial transactions and sensitive requests, and employees should confirm unusual requests through a separate and trusted communication method.
Automated Reconnaissance and Exploitation
Attackers can use AI to research a company, identify exposed systems, analyze vulnerabilities, and assist with developing exploit code. Tasks that previously required significant time and technical knowledge can now be completed much faster.
This does not mean AI can automatically compromise every system. It does mean that attackers can evaluate more targets, develop attacks more efficiently, and operate at a greater scale.
Malware Development and Evasion
AI can also help attackers modify malicious code and create new variations of existing malware. These variations may be designed to avoid signature-based security controls or make analysis more difficult.
Traditional antivirus remains important, but businesses should also use modern endpoint detection, centralized logging, behavioral monitoring, and incident response procedures.
Shadow AI Is Already Inside Many Businesses
One of the most immediate AI risks for small businesses is not a sophisticated attack against an AI model. It is employees using AI tools without the organization’s knowledge or approval. This is commonly referred to as Shadow AI.
An employee may paste a customer email, contract, financial report, source code, or internal document into a public AI platform to complete a task more quickly. Once that information is submitted, the business may lose visibility into how it is processed, stored, or retained.
The risk is not limited to public chatbots. AI is increasingly embedded within software that businesses already use. Email platforms, customer relationship management systems, accounting software, development tools, and collaboration platforms are all adding AI capabilities.
These features may process company information under the vendor’s security, privacy, and data-retention terms. Businesses should understand what information is being processed and whether the vendor uses submitted data for model training or product improvement.
The first step in any AI security program is identifying the AI already being used.
How AI Applications Can Be Attacked
Businesses that develop or integrate AI applications face another area of risk. Attackers can target the AI system itself, including its instructions, data, integrations, and access permissions.
Two useful resources for understanding these threats are the OWASP Top 10 for Large Language Model Applications and the MITRE ATLAS framework.
OWASP Top 10 for Large Language Model Applications
The OWASP Top 10 for Large Language Model Applications provides a useful framework for identifying and understanding common security risks within LLM applications. These risks include prompt injection, sensitive information disclosure, supply-chain weaknesses, data and model poisoning, improper output handling, excessive agency, system prompt leakage, vector and embedding weaknesses, misinformation, and unbounded consumption.
Three of these areas are particularly relevant for small businesses: prompt injection, sensitive information disclosure, and supply-chain security.
MITRE ATLAS Framework
The MITRE ATLAS framework complements OWASP by documenting how adversaries target AI-enabled systems. ATLAS stands for Adversarial Threat Landscape for Artificial-Intelligence Systems and provides a living knowledge base of adversary tactics, techniques, and mitigations.
Similar to the MITRE ATT&CK framework used throughout the cybersecurity industry, ATLAS helps organizations understand how an attacker may move through the different stages of an attack against an AI system. This can include reconnaissance, gaining initial access, manipulating data or models, evading detection, collecting information, and creating an operational impact.
OWASP is useful for understanding what security weaknesses may exist within an AI application. MITRE ATLAS provides additional context around how adversaries may identify, exploit, and combine those weaknesses during an attack. Together, these resources can help businesses improve threat modeling, security testing, monitoring, incident response, and AI red-team exercises.
The following risks provide a practical starting point for small businesses evaluating their AI applications.
Prompt Injection
Prompt injection occurs when attacker-controlled instructions influence an AI system and cause it to ignore its intended rules or perform an unauthorized action.
A direct prompt injection occurs when a user enters malicious instructions into an AI application. An indirect prompt injection occurs when those instructions are hidden inside content the AI system processes, such as a website, email, document, or uploaded file.
For example, an AI assistant may be authorized to read emails and summarize them for an employee. An attacker could send an email containing hidden instructions that attempt to make the assistant disclose information or perform an action outside its intended purpose.
Prompt injection becomes more dangerous when an AI system can access sensitive information or interact with other business applications. Businesses should treat external content as untrusted, restrict the permissions assigned to AI tools, and require human approval before an AI system performs sensitive actions.
This wording keeps the section understandable for small-business readers while properly distinguishing the two resources. MITRE describes ATLAS as a living knowledge base of adversary tactics and techniques for AI systems.
Sensitive Information Disclosure
AI systems may expose customer information, credentials, internal documents, proprietary data, or other sensitive information if access controls are not properly enforced.
A customer-support assistant should only access information associated with the authenticated customer. A coding assistant should not receive production credentials or confidential source code unless the organization has approved that use.
Businesses should avoid placing passwords, API keys, authentication tokens, or other secrets inside AI prompts. Access should also be limited according to the user’s role and business requirements.
The AI model should never become the primary access-control mechanism. Authorization must be enforced by the applications and systems connected to it.
AI Supply-Chain Risk
AI applications often depend on third-party models, datasets, plugins, libraries, and code packages. A compromised component can introduce malicious behavior or security weaknesses directly into the application.
This risk is not unique to AI, but AI development expands the number of external components that businesses may need to evaluate. Organizations should obtain models and datasets from trusted sources, verify software packages, review plugin permissions, and maintain an inventory of the components used within their AI environment. Versions should be documented and controlled so unexpected changes can be identified.
A popular model, plugin, or package should not automatically be considered secure.
Practical AI Security Steps for Small Businesses
Small businesses do not need to develop a large or complicated AI security program to begin reducing risk. A few practical controls can address many of the most common problems.
Create an AI Acceptable Use Policy (AIAUP)
An AIAUP should identify approved tools and explain what employees may and may not submit to them. Without authorization, employees should not place the following information into public AI platforms:
- Customer, patient, or employee information
- Passwords, API keys, or authentication tokens
- Financial records
- Confidential contracts
- Proprietary source code
- Internal security information
- Regulated or legally protected information
The policy should be easy to understand and reflect how employees actually use AI. A policy that prohibits every use of AI will likely be ignored and may push more activity outside the organization’s visibility.
Inventory AI Usage
Businesses should identify where AI is being used across their environment. This inventory should include:
- Public AI platforms
- AI features included with existing software
- Customer-facing chatbots
- Coding and development assistants
- Automated workflows and agents
- Third-party vendors that process company data with AI
- AI applications developed internally
The inventory does not need to be complicated. A basic list of the tool, its business purpose, the owner, the data it can access, and its connected applications is a useful starting point.
Use Business or Enterprise AI Accounts
When possible, organizations should use properly configured business or enterprise accounts instead of personal accounts.
Before approving a platform, businesses should review its security controls, authentication options, data-retention practices, privacy terms, and model-training settings. They should also determine whether the provider supports centralized administration, logging, and access removal when an employee leaves the company.
Limit AI Permissions
AI applications and automated agents should only have the permissions required to perform their intended functions.
An AI assistant that summarizes documents does not need permission to delete them. A customer-support chatbot does not need access to every customer record. A coding assistant should not automatically have access to production systems.
Least-privilege access is especially important for AI agents because they may be capable of performing actions across multiple applications.
Require Human Approval for Sensitive Actions
AI systems should not independently send payments, modify access permissions, delete business records, disclose sensitive information, or communicate externally without appropriate safeguards.
Sensitive actions should require verification and human approval. Businesses should also establish a method for quickly disabling an AI integration if it begins behaving unexpectedly.
Log and Monitor AI Activity
Businesses should maintain appropriate logs of AI prompts, responses, integrations, and actions. These logs can help identify misuse, investigate incidents, and provide visibility into how employees are using the technology.
Monitoring should include unusual activity, excessive usage, unexpected data access, and abnormal costs. A sudden increase in usage or spending may indicate abuse, a compromised account, or an improperly configured automated process.
Train Employees on AI-Enabled Threats
Security awareness training should address how AI is changing common attacks. Employees should understand how to identify and respond to:
- AI-generated phishing messages
- Business email compromise
- Voice-cloning attacks
- Deepfake video
- Prompt injection
- Requests for sensitive company information
- Unapproved AI tools
Employees should also know whom to contact when they receive a suspicious request or accidentally submit sensitive information to an AI platform.
Use Multiple Layers of Defense
There is no single product that can secure every AI application or prevent every AI-enabled attack. Businesses should use a combination of preventative, detective, and responsive controls.
Preventative controls reduce the likelihood of an incident and may include input filtering, approved tools, strong authentication, access restrictions, and limited integrations. Detective controls help identify suspicious activity through logging, alerting, usage monitoring, anomaly detection, and periodic access reviews.
Responsive controls help businesses contain and recover from an incident. These may include incident response procedures, integration kill switches, account containment, model rollbacks, and post-incident testing.
An effective AI security program should also include governance, workforce training, and adversarial testing. Governance establishes how AI should be used. Training prepares employees to recognize the risks. Adversarial testing determines whether the security controls work as intended.
Final Thoughts
AI is changing how small businesses operate, but it is also changing how attackers identify and exploit weaknesses. The goal should not be to prevent employees from using AI. The goal should be to understand where AI is being used, establish reasonable boundaries, protect sensitive information, and maintain control over the actions AI systems can perform.
Start by identifying the AI tools already inside the business. Create a clear AIAUP, review the data those tools can access, limit unnecessary permissions, and train employees on AI-enabled threats.
AI adoption will continue to move quickly. Security needs to become part of that process before an incident forces the conversation.
Stay Ready, Stay Secure with ReadyEdge.