Cybersecurity in the AI Era: Protecting Your Business from Faster, Smarter Attacks

Artificial intelligence is changing both sides of cybersecurity. It can help defenders analyse logs, test systems and identify unusual activity. It can also help criminals create convincing messages, imitate trusted people, scan for weaknesses and move through an attack more quickly.

In July 2026, the Australian Signals Directorate's Australian Cyber Security Centre warned that attackers may use AI to rapidly discover and exploit vulnerabilities, particularly in internet-facing services, target many victims and move quickly from compromise to data theft or extortion. The response is not panic. It is disciplined cyber hygiene combined with clear rules for business use of AI.

How AI changes the threat

More convincing impersonation

Poor spelling is no longer a reliable warning sign. AI can produce polished emails, messages and scripts tailored to a company, role or current event. Voice and video cloning can add pressure to an urgent payment request. Staff must verify the request, not merely the appearance or sound of the sender.

Faster discovery of exposed systems

Attackers can use automation and AI to identify internet-facing services, search for known weaknesses and target many organisations quickly. Unused systems, outdated software and unsupported websites can become easy entry points.

Data leakage through everyday AI use

Employees may paste customer records, contracts, source code, financial data or internal strategy into a public AI tool to save time. The OAIC recommends that organisations do not enter personal information, particularly sensitive information, into publicly available generative AI tools as a matter of best practice.

New risk from connected AI agents

An agent with access to email, files, a customer database or payment workflow can create real-world consequences. Malicious instructions may be hidden in content the agent reads, and an error can be amplified when agents hand work to one another. Limit permissions and require human approval before consequential actions.

Ten controls every business should prioritise

• Identify internet-facing assets. Keep an up-to-date list of websites, email systems, cloud services, remote access tools and other exposed services. Remove anything no longer required.
• Patch rapidly. Apply security updates to internet-facing services, operating systems, browsers and applications. Replace products that no longer receive vendor support.
• Use multi-factor authentication. Protect email, cloud administration, finance, payroll and remote access accounts, and restrict administrative privileges.
• Verify sensitive requests through a separate channel. Call a known number before changing bank details, releasing confidential information or making an unusual payment. Do not rely on contact details supplied in the request.
• Maintain protected, tested backups. Keep recent backups that cannot be easily altered or deleted by an attacker, and test restoration before an incident occurs.
• Create an AI acceptable-use policy. Define approved tools, permitted data, prohibited uses, review requirements and a process for requesting a new use case.
• Assess AI vendors. Understand data retention, training use, access controls, logging, incident notification, subcontractors and where information is processed.
• Limit agent permissions. Use the minimum access required, separate testing from production and require human approval for external messages, record changes, payments and destructive actions.
• Train people for modern social engineering. Practise how to respond to urgent requests, unusual links, unexpected attachments, deepfake calls and instructions to bypass normal process.
• Prepare and exercise an incident plan. Define who to call, how to isolate systems, reset access, restore backups, communicate with stakeholders and report an incident.

Use AI as a controlled defensive assistant

The ASD guidance supports careful, secure and human-supervised use of AI to help find vulnerabilities, analyse security logs and assist with penetration testing or vulnerability assessment. Keep these tools within an approved environment and have qualified people confirm findings before taking action.

AI should strengthen professional judgment, not replace it. A confident-looking output may still be incomplete or wrong. Maintain logs, document decisions and preserve the ability to stop or roll back automated actions.

A 48-hour security reset

• Confirm multi-factor authentication is enabled for email, finance, payroll, cloud administration and remote access.
• Review outstanding critical patches and unsupported internet-facing systems.
• Tell staff that bank-detail changes and unusual payments require independent verification.
• Issue an interim rule prohibiting confidential, personal or sensitive information in unapproved public AI tools.
• Confirm who will lead the response if a cyber incident occurs and keep the Australian Cyber Security Hotline number available: 1300 CYBER1.

The leadership question

Cybersecurity is not only an IT responsibility. It protects revenue, customer trust, business continuity and the reputation of every organisation in the supply chain. Leaders should ask one question regularly: if our email, website or core system were compromised today, could we detect it, contain it, continue operating and recover?

If the answer is unclear, begin with the ten controls above and seek qualified cyber, privacy or legal advice for the risks specific to your business.

Sources and further reading

• ASD's ACSC - Defending against AI-enabled cyber attacks
• ASD's ACSC - Essential Eight explained
• ASD's ACSC - Protecting against business email compromise
• OAIC - Privacy and commercially available AI products