October 2026

When I say, “Business owners of all sizes are being kept up at night worrying about cyber threats,” what image typically comes to mind if you imagine these bad actors? A shadowy figure hunched over a desk littered with soda cans, bleary eyes darting between Burp Suite on one monitor and Hashcat cracking a WPA2 handshake on another? You’d only be half right.

Those guys haven't gone anywhere, but they also no longer work solo. There’s a new tool in their toolbox: AI. It never sleeps. It never gets bored. It never has to refuel with another can of Code Red or the remnants of yesterday's pizza.

The internet has been infested with automated scanners and malware for decades, so what’s different now? The complexity, ingenuity, and amount of information these systems can and will use against us.

 Just as we trained ourselves to side-eye that urgent email from our “CEO” asking for a few thousand dollars’ worth of employee-appreciation gift cards, attackers switched up their methods: phishing attempts may now arrive cloaked as a malicious QR code attached to an otherwise boring-looking flyer; as a voicemail in a cloned voice that sounds scarily human; or even as a meeting on Google calendar that we don’t remember accepting. When we innocently click into the agenda—😱.

Critical thinking and a gut check are still our best defenses. I used to focus on training folks to look for misspellings, obviously fake domains, or suspicious extensions in attachments, but that no longer flies when AI can write more cleanly than most of us. The “Take9” campaign is one method we humans can use to spot a scam: it encourages us to pause and take 9 seconds to think about what we’re about to do (Was I expecting this meeting? Does my CEO really want $2,000 worth of Sephora gift cards?).

And when we do fall prey to something? Strong and layered identity controls, phishing-resistant authentication, break-glass accounts, and multi-party administrative requirements for sensitive actions help limit the damage. Because even the best of us can be distracted, rushed, or eager to impress a new boss.

 So next time your super-busy "CEO" makes a secret or unusual request, take 9. Call them using a known number. Your real CEO (and IT tech!) will thank you.