Small and medium-sized businesses (SMBs) are increasingly concerned about AI-driven cyber threats, but cybersecurity experts advise that foundational security practices remain the most critical defense against the most common attack vectors. While AI is enhancing attackers' capabilities, truly AI-powered malware is still rare, and the majority of incidents stem from familiar vulnerabilities.
According to the ESET SMB Cyber Readiness Index 2026, AI-powered malware is the top concern for global SMBs, with 33% of North American businesses citing it as their primary worry. However, ESET's Managed Detection and Response (MDR) service has not recorded any incidents where generative AI played a significant role. While ESET researchers did discover an AI-written ransomware proof-of-concept in 2025 and PromptSpy, an Android malware that abuses generative AI for persistence, these are considered isolated examples rather than widespread operational threats.
Instead, the most prevalent threats to SMBs continue to be phishing, unpatched security vulnerabilities, inadequate security monitoring, and weak passwords. Phishing was the most detected threat in the second half of 2025, accounting for 30.8% of incidents, with volumes steadily increasing. Social engineering tactics, including smishing (phishing texts) and vishing (voice calls), are also on the rise.
Unpatched security vulnerabilities represent another significant risk, as many SMBs struggle to manage diverse software environments and keep up with the high volume of new vulnerability disclosures. A lack of centralized security monitoring means that even businesses with security tools may be overwhelmed by alerts, making it difficult to identify genuine threats. Finally, weak and reused passwords persist as a major security challenge, despite the availability of more robust authentication methods like multi-factor authentication (MFA) and passkeys.
While AI is not yet the primary driver of novel malware, it is undeniably augmenting existing attack methods. Threat actors are leveraging AI to improve the quality and scale of phishing campaigns, including the use of deepfakes. AI also helps in rapidly identifying and weaponizing new vulnerabilities, analyzing large datasets to uncover common passwords, and performing reconnaissance to map out attack paths more quickly. This acceleration of attack capabilities can significantly narrow the window for businesses to respond to threats.
To counter these evolving threats, cybersecurity best practices remain essential. Implementing robust vulnerability and patch management, including continuous scanning for known CVEs and automated updates, is crucial. Identity security is also paramount, requiring strong, unique credentials, ideally managed by password managers, and the non-negotiable deployment of MFA. Privileged account management (PAM) tools can further reduce the attack surface for high-risk accounts.
For SMBs facing security skills shortages, outsourcing detection and response to a trusted third-party MDR service can alleviate complexity and integration challenges, which 21% of SMBs identify as a major barrier to improving their security posture. Ultimately, a proactive approach to cybersecurity, focusing on preventing, detecting, and responding to the most impactful threats, is vital for achieving business resilience.
