AI Cyber Threats and Small Businesses: Why the Defense Starts With Cleanup

AI has made phishing more personal, vulnerability scanning faster and ransomware more automated, and Harvard Business Review's October 2026 guidance for small and mid-size businesses answers with an order: the basics first, then the security features you already pay for, then deleting what you no longer use, and new services last. Daniel Dobrygowski, who wrote it, cites a 2026 report from Sophos, the security firm he works for, that puts the median cost of recovering from a ransomware attack at $375,000.

All of it stays within an attacker's reach whether or not anyone still opens it.

What has AI changed about cyber risk for a small business?

You've probably watched AI take hours out of your own week this year: the first draft of a proposal, the meeting summary, the quick render pass; attackers got the same discount. Dobrygowski describes adversaries who use AI to scan networks continuously and to automate the work of breaking in, and he cites Verizon's 2026 Data Breach Investigations Report: where company size was known, breaches disproportionately hit businesses with fewer than 1,000 employees.

If you run a studio of eight, you may sit below what Dobrygowski calls the "cybersecurity poverty line," and from there it's easy to conclude that real security means a budget line you don't have. His first rungs cost you an afternoon and logins you already hold.

For a design practice, the exposure is mostly what you forgot you kept: years of client drawings in a shared drive, a residential client's floor plan in the same folder as their home address, invoices from projects that closed in 2021, and whatever someone on the team pasted into a free AI tool last spring. That last one has its own Briefing, Shadow AI Is a Provisioning Gap, and the steps below clear the rest.

Why does the order of security steps matter for a small firm?

Before any AI security product, Dobrygowski sends you to two free lists: the Pentagon's "brilliant at the basics" initiative and the FBI's Operation Winter SHIELD, ten actions every company should take. The three he names first are multifactor authentication on every account, backups kept where an attack on your main systems can't reach them, and patching that runs on a schedule so nobody has to remember it.

His ladder above that floor runs in the same order we'd use for any system: turn on what you already pay for, clear out what you've stopped using, test what's left, and bring in outside services last. You'll see new security tools pitched every quarter; the order you adopt them in is the part that stays the same.

Rung one: the security features you already pay for

If your studio runs on Google Workspace or Microsoft 365, those services increasingly include AI security tools that only need turning on, Dobrygowski writes, and password managers increasingly check for compromised credentials. Spend an hour in the admin settings of the two or three services your business runs on and switch on what's there.

A stricter sign-in setting will lock out the contractor who still uses a shared account, and someone will ask you to turn it back off. Decide in advance that shared logins end, and set that person up with their own account the same day.

Rung two: clear out the digital detritus

You can list every tool, drive and device your studio touches in an afternoon, which is the advantage of a business whose whole picture fits in one room. Dobrygowski points to the governance tools already inside Microsoft 365 and Google Workspace, Purview and Vault, which can flag inactive data and apply retention rules you set.

Start with the data. Sort the shared drive by last modified, and for each kind of record decide how long it stays: active drawings, closed projects, client contact details, financial records. Then retire the hardware and accounts nobody uses, like the old laptop in the closet or the trial subscription that outlived its project; with no committee to convince, you can cancel it this week.

Before you delete anything, check whether a contract, your insurer or your accountant needs you to keep it, and set any automatic retention rule on one folder first so you can watch what it flags for a week. The first time a past client asks for a 2019 drawing set, you'll want to have made that call on purpose.

Rung three: test the plan with tools you already use

Dobrygowski suggests a paid tier of a chatbot such as Claude, Gemini or ChatGPT, with data sharing turned off, to draft a security and recovery plan for your company. Let it produce the template, fill in the details from what you know about your business, then hand it back and ask what's inconsistent or missing. You decide what the plan says, and nothing confidential goes in unless you're sure it stays out of training data.

He also points to AI phishing simulations as an affordable test of the most common way small businesses get breached. If you run one, expect someone to click, and keep the conversation afterward blameless: talk through what made the email look real.

Rungs four and five: questions for whoever runs your IT

The top two rungs are services. A virtual CISO, often arranged through a managed service provider, pairs monitoring software with human security expertise; a managed detection and response partner watches for attacks around the clock, and Dobrygowski discloses that his employer sells this kind of service. If you work with an outside IT provider, ask them what each would cost at your size and what it would catch that the first three rungs miss.

What this changes for a studio adopting AI

We read Dobrygowski's ladder as the fundamentals holding while the tools change: the work that makes your studio safer is the work that makes AI useful to it, knowing what you have, where it lives, and what you can let go of.

This week, block two hours. Turn on the security settings in your email and file platform, then open the shared drive, sort by last modified, and write down your record categories and how long each one stays. Keep that list; any AI tool you adopt later will need the same inventory. If your team has no written rule on what goes into AI tools, Your Design Firm Already Has an AI Policy. You Just Need to Write It. walks through drafting one. It's also where our own work starts, since a single source of truth comes before anything gets automated.

All Governance Briefings