And today, one thing is making the security landscape move even faster: AI.
AI hasn’t completely changed how cyberattacks work. In many cases, attackers are still using the same tactics they always have: phishing, stolen passwords, fake login pages, deploying ransomware, and exploiting systems that haven’t been properly secured.
What AI is changing is the speed and scale at which those attacks can happen.
Attackers can use AI to create more convincing phishing emails, rapidly customize messages, impersonate people and organizations, and automate parts of an attack that once required more time and effort.
The reality is that businesses need to take cybersecurity more seriously than ever. AI is giving attackers the ability to move faster, create more convincing attacks and operate at a greater scale. Those threats are going to continue to evolve and become harder to recognize and stop.
That doesn’t mean businesses need to panic. It means they need to collaborate with their IT and cybersecurity providers, take recommendations seriously, and follow through on the protections being recommended.
Here are five areas every business should be working on with their IT provider today:
1. Make sure MFA is protecting more than just email
Multi-factor authentication should be enabled anywhere a compromised password could provide meaningful access to your business. That includes Microsoft 365, remote access tools, administrative accounts and, importantly, your company VPN.
2. Review who has administrator access
Employees shouldn’t routinely work from accounts that have administrator privileges. Your IT provider should regularly review who has elevated access and remove permissions that are no longer necessary.
3. Keep computers, servers, firewalls and software patched
Attackers actively look for known vulnerabilities. Make sure operating systems, applications, firewalls and other critical infrastructure are being routinely updated, not just when something breaks.
4. Prepare your employees for better phishing attacks
AI makes it easier to create emails that look polished, personal and legitimate. Security awareness training and phishing simulations are increasingly important because employees need to recognize more than just obvious spelling mistakes and suspicious-looking emails.
5. Make sure your backups are actually recoverable and tested
Having a backup isn’t the same as having a recovery plan. Ask your IT provider where your backups are stored, how they’re protected from ransomware, how often they’re tested, and how long it would realistically take to restore your business after an incident.
The headlines around AI and cybersecurity can make the problem feel overwhelming. It doesn’t have to be.
Good cybersecurity still starts with doing the basics extremely well: protect identities, limit access, patch systems, educate people and maintain recoverable backups.
Cybersecurity Awareness Month may be over. The work shouldn’t be.