AI is Making Cyber Attacks Faster. Defences Are Catching Up, Slowly.

If you’ve ever worried that the people trying to break into business systems are a step ahead, the honest answer is: right now, sometimes they are. AI has made it cheaper and faster to run phishing campaigns, find unpatched software, and write convincing fake emails. What used to take a skilled attacker hours can now take minutes.

The UK’s National Cyber Security Centre has acknowledged this shift directly, noting that AI-enabled attacks will accelerate, and that the number of serious incidents it handled more than doubled in 2025. Ransomware is still the biggest concern, but the wider problem is that AI lowers the bar for less skilled attackers too. Someone with no real technical background can now use off-the-shelf tools to run a credible attack on a small business.

What the UK government is actually doing

The government has committed £90 million to help smaller organisations strengthen their cyber defences. It’s also pushing a voluntary Cyber Resilience Pledge, which asks businesses to take three concrete steps:

• Make cyber security a board-level conversation, not just an IT one
• Get Cyber Essentials certified (a government-backed scheme that covers the basics)
• Keep staff trained and aware of current threats These aren’t complicated asks, but a lot of small businesses across North Wales haven’t got round to them yet.

What actually works right now

AI-powered defence tools exist, but the honest position is that most small businesses are years away from deploying them meaningfully. The good news is you don’t need them to be reasonably well protected.

The boring stuff still works:

• Patch your software promptly, every time
• Use strong, unique passwords and turn on multi-factor authentication (a second confirmation step, usually a code on your phone) wherever possible
• Keep backups that attackers can’t delete, even if they get into your main systems
• Train staff to spot phishing, and make it easy for them to report something suspicious without embarrassment If you handle card payments, legal files, or medical records, the pace of change means cyber security can’t be a once-a-year conversation any more. Phishing emails in particular have got much harder to spot as AI-written messages now pass the usual tests people are trained to look for.

Worth a conversation with whoever looks after your IT. Not urgently, not in a panic, but soon.