For years, one of the easiest ways to spot a scam email was bad writing. Odd phrasing, clumsy grammar and strange formatting gave it away. That safety net is fading. Attackers now use AI tools to write fluent, well targeted messages in minutes, in any tone and in either official language. The goal has not changed, but the cost of trying has dropped, which means more attempts reach more inboxes.
This article explains how the threat has shifted and what a sensible defence looks like for a small or mid sized business. It reflects what we see supporting clients across the GTA through our cybersecurity services Toronto team.
What has changed with AI
AI does not create new kinds of crime so much as it makes familiar ones cheaper and more believable:
- Phishing messages read naturally and can be personalised from public information, such as a company website or a LinkedIn profile.
- Voice and video impersonation makes “urgent request from the boss” scams harder to dismiss on instinct.
- Reconnaissance that once took a skilled person hours can be automated, so smaller businesses are no longer too minor to bother with.
The defences that matter are the same ones that matter against any attack, applied more consistently.
The threats we see most
Credential theft and business email compromise
A stolen password is still the most common way in. Once inside a mailbox, attackers read conversations, wait for a payment, and then step in with a convincing request to change bank details. Technical filters help, but the reliable fix is a process: any payment detail change is confirmed by phone, using a number you already have. Our guide to email protection explains the technical layer.
Ransomware
Ransomware encrypts files and demands payment, and increasingly attackers steal data first so they can threaten to leak it. Ransomware protection is layered: patched systems, endpoint security that blocks malicious behaviour, restricted admin rights, and backups that are tested and kept out of reach of the attacker.
Cloud misconfiguration
Public storage left open, overly broad sharing links and forgotten accounts expose data without any hacking at all. A regular review of Microsoft 365 and Azure settings catches most of this.
Insider mistakes
Most “insider” incidents are honest errors: sending a file to the wrong person, approving an unexpected sign in request, or reusing a password. Clear rules and short, regular training reduce them.
A layered defence that fits a small team
| Layer | What it does | Why it matters |
|---|---|---|
| Multi-factor authentication | Requires a second proof of identity | Stops most stolen password attacks |
| Endpoint security | Blocks and contains malicious software | Limits ransomware damage |
| Email filtering | Screens phishing and spoofed mail | Reduces what reaches staff |
| Security awareness training | Builds good habits | Covers what filters miss |
| Managed detection and response | Watches for threats around the clock | Catches what slips through |
| Tested backups | Restores systems after an incident | Removes the attacker’s leverage |
If you can only do three things this quarter, turn on multi-factor authentication everywhere, confirm your backups restore, and run a short security awareness training session using real phishing examples. Our overview of managed detection and response explains what round the clock monitoring adds.
Know where you stand
Defence works best when it is aimed at your actual gaps. A short assessment of your accounts, devices, email setup and backups shows what to fix first. You can start with our free IT risk assessment, then talk to us about a full cybersecurity assessment.
Take the free IT risk assessment. It takes about three minutes and gives you a prioritised list.
Start the assessmentFrequently asked questions
Is AI making phishing impossible to spot?
It makes it harder to spot by writing quality, so look at context instead: an unexpected request, urgency, a changed bank detail or a sign in prompt you did not trigger. When in doubt, confirm through a separate channel.
Do small businesses really get targeted?
Yes. Attackers often prefer smaller organizations because defences tend to be lighter and a single payment can be worth the effort.
What is the cheapest improvement we can make?
Multi-factor authentication on every account, especially email and remote access.
How often should we train staff?
Short sessions every few months work better than one long annual session.
Related service: Cyber Security Assessment
Last updated
