AI-Generated Cyberattacks: Threats and Security Strategies for Small and Medium-Sized Enterprises

Sammanfattning

The rapid rise of generative artificial intelligence (AI) is reshaping the cyber-threat landscape, enabling attackers to automate, personalise, and scale intrusions. Small and medium-sized enterprises (SMEs), which compose over 90% of global businesses, lack the financial and human resources of large organisations and are therefore uniquely exposed to these AI-driven threats. Existing research has focused largely on AI threats to critical infrastructure and larger enterprises, leaving SME-specific vulnerabilities and counter-measures under-explored. We combined a literature review with semi-structured expert interviews. Themes were identified directly from the data and findings were triangulated to ensure alignment between academic literature and expert perspectives. Generative AI-enhanced phishing emerged as the most pervasive threat against SMEs. The most feasible defences for SMEs are continuous employee awareness training, multi-factor authentication (MFA), Security-as-a-Service (SECaaS) for advanced monitoring and simplified adoption of frameworks such as the NIST AI Risk-Management Profile. By aligning technical safeguards with human-centred training, SMEs can achieve a proportionate yet robust security posture against generative-AI attacks.