AI changed the economics of cyberattacks. Here's what to do about it

TLDR:

• The big cyber risks are the ones we've had for decades: weak access controls, unpatched systems, and human error. So far, AI hasn't changed the risks much. It has made them cheaper to exploit.
• Cheaper attacks change who gets targeted. A regional healthcare provider or a credit union was less valuable to attack than a large bank. Now it is cheaper to attack, too.
• The answer isn't necessarily a bigger budget. It's attention: fix the known issues, buy your plumbing instead of building it, treat AI agents like employees, and write down where your data lives.

In September I sat down with Caleb Gawne, CEO of Kye, for his Nobody Built This For You series. Kye finds the inefficiencies in mid-market operations and deploys AI agents to fix them, and Caleb's thesis is that AI left mid-market companies behind while the Fortune 500 got dedicated transformation teams. He wanted to understand what all the coverage of "AI cyberattacks" had actually changed about cyber risk for mid-market companies.

Caleb wrote up our conversation as AI changed the economics of cyberattacks, and the full discussion is on the Nobody Built This For You YouTube channel. This post expands on the points I think matter most.

The risks are familiar. The economics are not.

Before Mycroft I spent over a decade at KPMG and EY auditing companies and responding to security incidents. Weak access controls, unpatched systems and human error have been major cyber risks for decades, and they still are. The risks aren't that different yet.

What AI changed is the cost of exploiting them. Work that used to need weeks or months from a large, experienced team is now within reach of a less sophisticated attacker. As I put it to Caleb: "What used to take 100 people to do, now takes 1."

That matters because attackers follow the path of least resistance. Large banks spend billions on cybersecurity because they are the main targets. A regional healthcare provider or a credit union has fewer defenses, mostly because it was less valuable to attack.

Recent AI models trained on cyber exploits change the math. The vulnerabilities in those smaller companies were always there. Now they take less time, less expertise and less money to find and use, which makes those companies cheaper to attack.

Make security a higher priority

The obvious response is to spend more money. I don't think that's necessarily the answer, and I say that as someone who sells security software.

A good CIO or CISO probably already has a list of known issues that would materially reduce risk. Some of those fixes may already be budgeted. Others may cost almost nothing. Management attention is often the real constraint.

The pattern I described to Caleb is that security is a number 10 problem on everybody's board deck until it becomes number 1 overnight. My advice is to move it from 10 to 5, so it never becomes 1.

In practice that means asking your technology leader one question: which one or two known issues would reduce risk the most for this business? Then give the team the time and support to fix them.

Don't DIY the plumbing

Some teams are unintentionally increasing their own risk through how they use AI.

AI makes it possible to build useful internal software in days, and for a lot of things that's a real win. But I draw a line around what I call plumbing software: the critical infrastructure that connects and powers the business. Identity systems, databases and other foundational tools are almost always better to buy.

The reason is simple. Specialized vendors invested years and large sums of money securing those systems, then spread that cost across many customers. When you build your own, you carry the whole cost yourself. Making version 1.0 work is only a fraction of it. You also need testing, monitoring, patching, maintenance and new improvements for years to come.

You can always build things in-house. The question is: what's the premium to make it actually secure?

Another way to think about it, for any system built or bought: assume it is compromised and the data gets out. How do you feel about that? That question is particularly important for AI agents.

Treat AI agents like employees

Companies are increasingly giving agents access to email, files, databases and operational systems, and it's tempting to click "allow all" so the agent can work without interruption.

My advice to Caleb was to treat AI agents as similar to people. Not every employee gets access to payroll, customer records, trade secrets or the entire company drive. Agents shouldn't either.

So classify your sensitive data, restrict each agent to what it truly needs, and monitor what it can read and do. My recommendation is to allow, with caveats.

Start with a piece of paper

The exercise I left Caleb with is the one I'd give any executive team: list out where all your data is.

It could be in your ERP, cloud storage, employee laptops, spreadsheets, vendors or AI tools. You don't need an expensive platform to do this. Write it down on a piece of paper.

You can't understand the risks, or prioritize what to fix, until you know what you have and where it is. Everything else in this post depends on that list.

No need to panic

The economics of attacking a mid-market company have changed, and that should get security onto the agenda. But today's risks are familiar and manageable if you give them the attention they deserve.

Thanks to Caleb and the Kye team for the conversation. If you lead a mid-market company and want help turning that piece of paper into a program, book a demo and we'll show you how Mycroft runs security and compliance end to end.