You have antivirus installed. Your staff use Microsoft 365. There is a password on the Wi-Fi. You have a router in the office.
So your business is protected. Right?
Let me ask you a different question instead. It is the one I find myself putting to South African business owners more than any other this year.
As a small business owner, have you actually looked at how AI has changed your cybersecurity?
Not how AI can help you write emails or summarise documents. How it has changed the way criminals attack you?
That is where the ground has moved. Most SMEs are still planning, budgeting and protecting as though the cybersecurity landscape looks the way it did three years ago. It does not. And the gap between what businesses think they are protected against and what is actually coming at them has never been wider.
The threat changed while everyone was watching something else
Three years ago, SME security conversations were about the same handful of things. A virus on a laptop, a dodgy attachment, a suspicious email with bad spelling and a clumsy logo. Your staff were your last line of defence in those days. The grammar was wrong, the logo was stretched, the “invoice” was never expected. So they deleted it, and life carried on.
That defence has stopped working, and it stopped working without an alert.
Microsoft’s 2026 reporting puts phishing at 23% of incidents, up from around 7%. That is not because more phishing is being sent. It is because AI can personalise it at a scale human beings never could. Fluent, correctly spelled, addressed to the right person, referencing the real project, arriving at a plausible time of day, and sometimes with a hacked account.
The same reporting describes AI compressing the cyberattack lifecycle from days into minutes.
Verizon’s 2026 Data Breach Investigations Report still puts ransomware in 48% of breaches, and describes small organisations as disproportionately affected. AI is not yet the leading cause of breaches. It is the accelerant. Same attacks, faster, cheaper, and far more believable.
Then there is the part that has changed the most; identity.
Documented deepfake-enabled fraud losses have passed $3.7 billion, with roughly 89% of that damage landing in 2025 and the first half of 2026. Roughly a quarter of it was executive impersonation. Reporting from 2026 suggests around 400 companies a day are targeted by deepfake CEO scams. Among people who actually engaged with a voice-clone scam, 77% lost money.
Read that again, because it changes what you’re training your staff for.
Your financial manager receives a phone call from a voice that sounds exactly like you. Not a rough approximation, your voice, your cadence, your accent. They are asked to push through a payment that is urgent and confidential. Nothing about that call triggers the instinct that saved them five years ago, because there is nothing to smell. It sounds like you.
The psychology has also flipped.
“But we’re small. Why would anyone target us?”
The honest answer is that mostly, they are not targeting you. They are scanning for open doors and trying them.
Nobody sits down in the morning and decides to attack a fifteen-person logistics company in Bellville. They do not need to. They find a compromised password, an unpatched system, an exposed account, or a person who clicks at the right moment. If the door opens, they walk in.
But do not let the word “opportunistic” make you feel safe. Opportunistic attacks still find plenty of small businesses, and the SA numbers are brutal:
That last pair of numbers is the whole argument in one line. You are facing the same attackers, using the same AI-powered tools, funded by the same criminal economy, at roughly an eighth of the spend per person than that of your large competitor.
You will never outspend them and that is not the point. The point is that most SMEs are not losing to sophisticated attacks, they are losing to the same few open doors, every time.
“But we have antivirus”
This is the most common thing I hear when I raise cybersecurity with an SME owner, and it is worth being fair about. Having antivirus is better than having nothing.
But antivirus and cybersecurity are not the same thing, and the gap between them has widened dramatically in the last two years.
Traditional antivirus works in black and white. A known malicious file appears, and it is blocked. That is genuinely useful, and it still catches a lot.
Now consider what the attack actually looks like today: a phone call in your own voice. A supplier email, sent from the supplier’s real, compromised mailbox. An invoice with updated banking details that your finance person was half expecting anyway. A malicious instruction buried inside a document that an AI assistant was asked to read and summarise.
None of those are files. Antivirus has no opinion about any of them.
Proper cybersecurity asks better questions. How did the attacker get in? Was that credential in a leak last year? Is this login coming from a country we have never done business with? Could they move from that laptop to Microsoft 365? Is anything watching for behaviour that simply does not look right?
Antivirus tries to catch a known bad thing. Cybersecurity tries to make sure the attacker never gets that far, and to notice quickly when they do.
Your employees are the first point of entry, and that has not changed
One of the biggest cybersecurity challenges for an SME is not the technology. It is people. That was true before AI, and it is truer now, for a different reason.
Your staff spend the day sending emails, downloading documents, opening links, logging into Microsoft 365 and moving company information around. Some work from home, some connect to public or personal Wi-Fi, some use personal accounts on company laptops, some use their own devices for work without anything formal written down.
None of that is malice. It is simply that every person, device and account is another door.
What has changed is that we can no longer rely on your staff spotting an attack on instinct. The old defence was “something feels off about this email”. AI has removed most of the things that used to feel “off”. So the defence has to move from human instinct to process, and from process to technology. And that technology is watching.
NIST’s guidance for small businesses still holds: MFA, patching, protected and tested backups, strong authentication. It also describes cybersecurity as a continuous process rather than something you implement once and forget.
I would like to add one thing, because AI has now made it necessary. You need verification that does not depend on the channel the request arrived through.
If someone asks you to change banking details by email, you phone them on a number you already had. If you get an urgent payment request from a voice that sounds like the MD, you walk to their desk or call them back on a known number. If you cannot reach them, the payment waits. That rule costs nothing and it defeats most of what is coming at you.
Start where attackers actually get in
At Complete IT we do not believe cybersecurity starts by selling a business every security product on the shelf.
It starts with understanding the environment. When we assess an SME, we look at the laptops and workstations in use, encryption, Microsoft 365 accounts and permissions, MFA, the firewall, the Wi-Fi, the internal network and the backup jobs. Then we answer one question. Where are the gaps?
The answers are usually boringly similar. One business is running free or expired antivirus. Another has Microsoft 365 with almost no additional mail protection. Another has no firewall at all and relies entirely on the router the ISP supplied. Another has backups configured that nobody has checked in a year. Another has staff working remotely on devices nothing is watching.
None of those are exotic and none of them require a big budget to fix. They just require somebody to have actually looked.
For most SMEs, three areas matter more than the rest, because they cover where the majority of incidents begin.
Managed endpoint protection and EDR. Your computers are where people work, download and click. Managed endpoint protection with detection and response gives your security provider visibility into what is happening on those devices, and flags behaviour that does not fit. That is a different job from an antivirus product sitting in the corner.
Multi-factor authentication. A password should never be the only thing standing between an attacker and your business email or cloud services. MFA means a stolen password on its own is not enough. CISA recommends it specifically for email, file storage and remote access, and it remains the cheapest, highest-return control available to an SME.
Email filtering and protection. Email is where your team deals with the outside world all day. Invoices, links, attachments and account-login requests arrive constantly, and it is the environment AI has changed the most. Filtering catches what should never reach the person who then has to make a judgement call.
I want to be straight with you about this. Three controls do not make a business invincible. Nothing does, and anyone who tells you otherwise is selling something or is simply wrong. What they do is close the doors that get opened most often. That is a real, measurable improvement, and it is where any sensible conversation starts.
It has to be layered, and it has to be owned
As a business grows, security has to grow with it. Managed firewall and network security. DNS filtering. Microsoft 365 security monitoring. Endpoint detection and response. Backup protection. Security awareness training. Vulnerability assessments and penetration testing. Managed monitoring around the clock.
The important thing is not how many products you own. It is whether they work together, and whether a person is actually responsible for them.
There is no single product that replaces the rest. Good security is layered, and I have not seen a serious SME incident that a properly stacked set of layers would not have caught early.
You may not need a CISO but potentially the function of it.
This is why this article exists, why I wrote it.
You are not large enough to employ a Chief Information Security Officer. You do not need an internal security department. That is a reasonable position and I am not going to pretend otherwise.
But the work a CISO does does not disappear because you have not hired one. Somebody still has to be asking:
Right now, in most SMEs, that list is nobody’s job. It falls to whoever has time, which means it does not happen.
That is the honest case for managed security. Not that you need an enterprise department, but that the function needs an owner, and outsourcing the owner costs far less than building one.
And then there is everything happening outside the office
The office network is not the perimeter any more. Your employee starts the morning on company Wi-Fi, works from home in the afternoon, is in a coffee shop tomorrow and travelling next week. The laptop has not changed -everything around it has.
That is why a firewall at the office is no longer enough on its own. Security has to follow the user, the device, the account and the data, wherever they happen to be.
It also means you need clear answers to questions you may never have written down. If staff use personal devices for work, who secures them? What happens if one is lost? Can you remove company data from it? Is it encrypted? What is allowed to be stored on it locally? Those answers are much cheaper to write now than to work out during an incident.
“I’m not sure” is the answer that should worry you
Let me put one question to you, and I would like you to answer it honestly rather than quickly.
If there was suspicious activity on one of your company laptops right now, who would know?
Would your employee have to notice something first? Would you wait until the machine started behaving strangely? Would somebody get an alert? Would anybody actually investigate it?
If the answer is “I am not sure”, that is not a failing on your part. It is the most common answer I get, and it is exactly where the conversation should start. Because “I am not sure” and “nobody is watching” are usually the same sentence.
We were in this situation with a client last week
I am going to describe something that happened recently without naming the client, because the details are theirs.
We picked up suspicious activity inside one of our clients’ environments. It was not caught by an antivirus alert. Nothing had visibly broken. It was caught because we monitor, we knew what normal looked like in that environment, and something did not fit.
We contained it, we worked out how it had got in, we closed that door, and we checked whether anything else had been touched. The client’s business kept running.
In most SMEs with no monitoring in place, that same activity would have sat there silently for weeks before anyone noticed, and the first sign would have been a ransom note or a payment that never arrived.
I am not telling you that story to frighten you. I am telling you because it is the entire argument in one incident. It did not get stopped by a product on a shelf. It got stopped because somebody was watching, and because that somebody was accountable for noticing.
That is the difference between owning security software and having your security managed. One is a purchase, the other is a responsibility with a name attached to it.
Why the AI question matters more than the product question
Most security conversations with SMEs start in the wrong place. They start with “which cybersecurity product would you like?”
The right starting question is “what are you currently exposed to?”
Because there is no point buying another security product without understanding the risks already sitting inside the business, and the risks have shifted enough in the last two years that last year’s assumptions are no longer a safe basis for this year’s decisions.
The businesses that are getting through this in good shape are not the ones with the biggest security budgets. They are the ones where somebody has genuinely looked at how AI has changed the threat, mapped that against their own environment, and put an owner on the gaps. That is a smaller list than you would expect, even now.
I have been in this industry since long before AI changed it, and I will be honest with you about something: I do not like the word expert. What I know this year can be obsolete next year, and anyone who tells you otherwise in this field is not paying attention. What I do know is that this problem is solvable for an SME, at an SME’s scale, and that most of the businesses we assess are closer to being properly protected than they think. They are usually just missing the person whose job it is.
Find out where you are actually exposed
You do not have to become a cybersecurity expert, your business does not need its own CISO and nobody is asking you to become a security specialist on top of everything else you already do. However, your business does need somebody taking responsibility for the things a security team would normally be watching, and in the AI era that is no longer optional.
Complete IT Business Solutions assesses your devices, your Microsoft 365 environment, your network, your firewall, your user security and your existing protection, and we tell you plainly where the gaps are. We serve businesses with our Cybersecurity solutions across South Africa.
If you are running a business and you want to know what is actually protecting it, book a IT and Cybersecurity Assessment. You will get a straight answer about what is protecting your business, what is not, and what the gaps would cost you to close. No obligation, and no pressure to buy anything on the call.
Book a free IT and Cybersecurity Assessment
You do not have to fix everything at once. You do need to know what you are facing.
I want to leave you with something practical rather than a warning.
No SME owner I have met has the time to become a security specialist on top of running a business. That is not a criticism. It is the reality of a small team, and it is exactly why this work gets outsourced in the first place.
So please do not read this article as a list of everything you are doing wrong. Most of the businesses we assess are closer to being properly protected than they expect. They are missing a handful of specific things, and, more often than not, they are missing a person whose job it is to watch those things.
That is the whole conversation I would like to have. Not a product pitch, and not a scare campaign. Just an honest look at your environment so that you can see what is protecting your business and what is not.
You do not have to act on all of it at once. The first genuinely useful step is simply knowing. Once you can see the gaps, you can decide which ones matter most for your business, what they would cost to close, and what can sensibly wait. Plenty of businesses start with one or two fixes and build from there, and that is fine. Visibility first. Decisions second.
If you take one thing from this article, take the question: as a small business owner, have you looked at how AI has changed your cybersecurity? If the answer is no, that is not a failing on your part. It is a conversation nobody has had with you yet. I would like to be the one who has it.
Reach out to Complete IT Business Solutions and let us show you what a proper assessment looks like. You will walk away with a clear picture of where you stand, whether or not you decide to work with us afterwards. That is the least we can offer, and it costs you nothing to find out.
Visit completeit.co.za and book a IT and Cybersecurity Assessment. Even if you do nothing else this quarter, at least know what you are dealing with.
Regards,
Hannah
Find out whether your IT is simply working or actually being managed.
