When a low-skilled attacker can breach 14 companies
Security researchers have warned for a while that AI could put serious hacking power into unskilled hands. A new report shows it is already happening: a low-skilled attacker used AI coding agents (Claude and Codex) to breach 14 companies. The tools did the heavy lifting that once needed years of experience, lowering the skill floor for offensive cyber operations.
For a Sydney small business, the lesson is not panic, it is perspective. The old comfort of “we are too small or too obscure to be worth attacking” is gone. When the effort and skill needed to run an attack drop, the number of people willing to try goes up, and they cast a wide net. Smaller businesses with thinner defences become easy, profitable targets.
The good news is that the fundamentals still work. AI can speed an attacker up, but it does not magically beat well-configured basics. Here is where to spend your energy:
- Turn on multi-factor authentication (MFA) everywhere, especially email, banking and remote access. It blocks the vast majority of account takeovers.
- Patch promptly. Most breaches still ride in through known, unpatched weaknesses, not exotic new ones.
- Limit access. Give staff only what their role needs, so one compromised login cannot open the whole business.
- Watch and back up. Monitoring catches trouble early, and tested, offline backups mean a breach is a bad day, not the end of the business.
Vendors are responding too. Microsoft, for example, is adding controls to its Purview governance tools that let organisations stop AI assistants like Copilot from reading sensitive files – a sign that managing how AI touches your data is becoming part of everyday security.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.