Short answer
AI cyberattacks small firms face are changing how fast an attack moves. AI lowers the time and skill an attack takes, and small firms are hit hardest by ransomware. Architects and engineers hold client drawings, financial records and email accounts that attackers want. Basic security controls and a clear understanding of your cyber coverage matter more as attacks speed up. Coverage always depends on the actual policy terms and underwriting.
What AI cyberattacks mean for small firms
In mid-September 2025, a state-sponsored group used Anthropic’s Claude Code to attack about 30 organizations, according to The Hacker News. AI reportedly handled 80 to 90 percent of the tactical work, and humans stepped in at only a few decision points. Some of the intrusions succeeded.
Anthropic said the barriers to sophisticated attacks have dropped substantially. The AI also made mistakes, such as fabricating credentials, as the same report notes. So AI does not make attacks flawless. It does reduce the effort and expertise an attacker needs.
For a small firm, the practical point is simple. Attackers can try more targets in less time, and a small firm no longer has to look too small to bother with.
How fast do attackers exploit software flaws?
Verizon’s 2026 Data Breach Investigations Report found that exploiting software flaws is now the top way breaches start, at 31 percent. It passed stolen credentials for the first time in the report’s 19 years. Verizon also says AI is shrinking the time to exploit a known flaw from months to hours, according to its release.
This puts pressure on update habits. A firm that waits weeks to install a security update on a remote access tool or file-sharing system leaves a longer window for attackers.
Why small firms feel ransomware hardest
The 2025 Verizon report found ransomware in 88 percent of small and mid-size business breaches, compared with 39 percent at large organizations, as reported by Infosecurity Magazine.
Small firms often have fewer staff to manage security, which can make recovery slower. An engineering firm locked out of its project files may miss deadlines, which can strain client relationships.
Want this looked at for your firm?Tell us what your firm does. A specialist reviews it and comes back with options.
Get a Quote →What do fraud losses show about email and payments?
U.S. reported cybercrime losses reached $20.88 billion in 2025, up 26 percent, according to the ABA Banking Journal. Business email compromise caused about $3.05 billion of that total, per dmarcian’s summary of the FBI report. The FBI also received more than 22,000 complaints referencing AI in 2025, iTnews reported.
Design firms send invoices, handle retainers and coordinate with subconsultants by email. A convincing fake message can redirect a payment before anyone notices.
Example: a 12-person engineering firm
A hypothetical engineering firm uses a file-sharing tool with an outdated security update. An attacker finds the flaw and locks the firm’s project drawings. Staff cannot open files for several days, and a client deadline passes.
The firm’s response depends on its backups, its security controls and its insurance. Whether a cyber policy responds, and how, depends on the policy wording, the facts of the incident and any conditions the carrier set at underwriting.
What small firms can check about AI cyberattacks
- Do you install security updates quickly on remote access, email and file-sharing tools?
- Do all accounts use multi-factor authentication?
- Can you restore project files from backups that an attacker cannot reach?
- Does your team verify payment changes by phone before sending money?
- Do you know what your cyber policy covers, and what controls the application asks about?
Our Cyber Liability page explains the main coverage areas. When you are ready to apply, the cyber application shows the controls underwriters ask about.
Can AI really run a cyberattack on its own?
The reported September 2025 case involved AI doing most of the tactical work, with humans making a few key decisions. The same report says the AI made errors, so it did not operate perfectly.
Are small design firms really targets?
The Verizon data cited above shows ransomware appeared in most small and mid-size business breaches studied. Attackers do not need a firm to be famous. They need access.
Does a cyber policy cover ransomware?
Many cyber policies address ransomware in some form, but terms, sublimits and conditions vary. Read the policy and the application carefully.
Your firm's situationWant us to check how your policy handles this?
Send us the policy or the contract. We will tell you what we see.
