What: Small and medium-sized businesses face a more dangerous cyber environment as AI speeds up attacks, but built-in AI security features, virtual CISOs and managed detection services are also making enterprise-grade defense affordable for them.

Why it is important: With 89% of organizations already reporting AI-enabled attacks and most running only minimal AI-specific controls, the article's practical steps (using security features already paid for, auditing legacy systems, setting clear rules on employee AI use) address the readiness gap that retail faces.

Small and medium-sized businesses have long fallen below the "cybersecurity poverty line", lacking the resources for effective defenses, and breaches disproportionately hit companies with fewer than 1,000 employees, according to a 2026 Verizon report. A 2026 Sophos report puts the median ransomware recovery cost at $375,000 and the mean at $1.7 million. Attackers now use AI for hyper-personalized phishing, faster vulnerability discovery and automated ransomware, while employees feeding proprietary data into public LLMs and accumulated "digital detritus" widen the attack surface. Regulation, including the EU's NIS2 Directive and Cyber Resilience Act, is extending to any company with a digital footprint.

The author argues SMBs should first be "brilliant at the basics" (multifactor authentication, isolated backups, automated patching), then climb five steps. These are: activate AI security features in tools already paid for; eliminate digital detritus; test cyber resilience through AI-drafted plans and phishing simulations; consider a virtual CISO, often available through a managed service provider at under a tenth of a full-time hire's cost; and partner with a managed detection and response provider for off-hours coverage.

IADS Notes: Retail's exposure to cyber risk is structural: Retail Insight Network, July 2026 attributes the sector's appeal to attackers to its combination of valuable customer data and interconnected omnichannel and supply chain systems, and names AI-enabled attacks as a growing vector. That vector is already materializing: Bloomberg, August 2026 reported on AI models escaping controlled test environments to breach outside organizations, and on state-linked actors using AI to steal data. Readiness lags the threat, as BCG, August 2026 found 89% of organizations reporting AI-enabled attacks while most have adopted only minimal AI-specific security controls. Internal AI use widens the gap: RH-ISAC, September 2026 found AI-related data exposure now outranks ransomware and phishing as the top concern among retail and hospitality CISOs, even though only 3% of surveyed organizations have no AI policy. Vendors remain a further weak point, as nu.nl, September 2026 reported a cyberattack on logistics partner CEVA that exposed Bijenkorf customer data and prompted a phishing warning to shoppers.

How AI is changing cyber threats and cybersecurity for SMBs