Hackers are now using AI agents to attack businesses, here’s what to check

AI agent cyber attacks are now real, and they change the maths for every small business owner. Google has warned that hackers are deploying AI agents to run attacks that adapt on their own, probe for weaknesses, and keep going without a human at the keyboard. The short version. The tools that used to make you a hard target are not enough on their own anymore, and the fix is to review your email filtering, your multi-factor authentication and your staff training with your IT provider now, before something forces the issue.

You do not need to panic. You need to check the basics and close the gaps. Here is what that looks like.

What has actually changed with AI agent cyber attacks

For years, most attacks that hit small businesses were sprayed out at scale. Generic phishing emails, obvious scams, badly written messages you could spot from across the room. The defence was simple. Train people to be suspicious, filter the obvious junk, and you dodged most of it.

AI agents break that pattern. An agent can write a clean, convincing email in perfect English. It can read your website and LinkedIn, work out who reports to whom, and craft a message that sounds like it came from your finance manager. It can react to what your systems do, try a different route when one is blocked, and run around the clock without getting tired or bored.

That means the two things that used to protect smaller firms, being too small to bother with and relying on a person to spot the con, are both weaker now. The attack is cheaper to run and harder to spot. Google’s own security forecasting from its cloud team has flagged this shift toward automated, adaptive threats.

The real cost of waiting for an incident

Most owners treat cybersecurity like an insurance renewal. Something you deal with once a year, or once it goes wrong. The problem with that is the clean-up bill dwarfs the prevention cost every single time.

Think about what an actual breach costs you. The downtime while systems are locked. The staff hours spent firefighting instead of serving customers. The awkward calls to clients whose data may be exposed. The reputational hit that lingers long after the systems are back up. And if you handle personal data, there are reporting duties under UK GDPR that carry their own weight.

None of that is theoretical. It is the predictable outcome of leaving known gaps open. The stress alone is worth avoiding, and I say that as someone who has run businesses for a long time. You do not want to learn this lesson the expensive way.

What to check with your IT provider now

Book time with whoever handles your IT. Do not wait for their annual review. Walk through this list and get honest answers.

1. Multi-factor authentication on everything

MFA is the single highest-value control you can turn on. A password on its own is a weak lock. Check that MFA is enabled on email, your accounting software, your CRM, your cloud storage and any admin logins. Not just for you, for everyone. One account without it is the door left open. The UK’s National Cyber Security Centre small business guide puts this near the top for a reason.

2. Email filtering that catches more than spam

Ask what your email filtering actually does. Basic spam filters are not built for AI-written phishing that reads perfectly. You want filtering that checks sender reputation, flags external senders clearly, and catches attempts to impersonate your own domain. If your provider cannot explain what protection is in place, that is your answer.

3. Staff training that fits the new threat

Old advice was spot the bad spelling. That advice is dead. Your team needs to know the new tells. An unexpected urgency, a request to change bank details, a message that pushes them to act fast and quietly. Build a simple rule. Any request involving money or credentials gets verified through a second channel, like a phone call, before anyone acts. No exceptions, no matter how senior the sender looks.

4. Backups you have actually tested

A backup you have never restored is a hope, not a plan. Confirm your backups run automatically, are stored separately, and have been test-restored recently. If ransomware locks your live systems, a clean backup is what gets you trading again.

5. Access that matches the job

Not everyone needs admin rights. Not every old account needs to stay live. Ask for a list of who has access to what, and strip back anything that is not needed. Fewer open doors means fewer ways in.

Where automation helps you defend, not just attack

The same technology attackers use can work on your side. Sensible automation can watch for unusual logins, flag odd behaviour, and alert you before a small problem becomes a crisis. The goal is not to bolt on more tools you never look at. It is to build systems that quietly do the checking for you, so your defence does not depend on everyone staying alert every minute of every day.

That is the mindset I bring at 07 Heaven Systems. I am Luke Stillwell, and after 19 years running my own businesses I have added automation and AI to the toolkit using platforms like HubSpot, n8n and Claude. Understanding how these tools work is the best way to understand how they can be turned against you, and how to set up sensible guardrails.

If you want to understand how AI agents actually work, on both sides of the fence, and what that means for your business, join our next AI workshop. You will leave knowing what to check and what to ignore.

Common questions

What are AI agent cyber attacks?

They are attacks where hackers use AI agents to carry out much of the work on their own. Instead of a person writing each phishing email or probing each system by hand, an agent generates convincing messages, researches targets, and adapts its approach when it hits a blocker. That makes attacks faster, cheaper and harder to spot than the generic scams most small businesses are used to.

Is my small business really a target for AI-driven attacks?

Yes, and more so than before. Being small used to make you not worth the effort. Because AI agents lower the cost of running an attack, targeting smaller firms is now viable at scale. Small businesses often have weaker defences too, which makes them attractive. The good news is the core protections, MFA, good email filtering and trained staff, still work well when they are actually in place.

What is the first thing I should do to protect my business?

Turn on multi-factor authentication across every important account today, then book a review with your IT provider covering email filtering, staff training and backups. Do not wait for an annual check or an incident. The controls that matter most are cheap or free, and the value comes from having them switched on and tested rather than assumed.

Rather have it built for you? See what an AI automation agency actually does and how we build and run these systems for UK businesses.