AI is accelerating existing cyber threats; the most immediate impact of AI on the threat landscape is speed and scale, rather than entirely new attack types. Generative AI enables attackers to produce personalized, well-written phishing and Business Email Compromise (BEC) emails in seconds. It removes the grammar and phrasing mistakes that previously made phishing easier to identify, making attacks significantly more convincing (see CyberSentriq's guide to AI-powered phishing).
AI is also accelerating targeting and reconnaissance by allowing attackers to:
- Research organizations in minutes rather than hours.
- Gather information from public sources at scale.
- Tailor phishing lures far faster than manual research ever allowed.
- Launch highly targeted attacks more efficiently.
In addition, AI is helping to scale more advanced attack techniques, including:
- Adversary-in-the-Middle (AiTM)attacks.
- Device Code Phishing attacks.
These techniques steal an already authenticated session rather than a password, allowing attackers to bypass standard Multi-Factor Authentication (MFA) protections.
The Direction of Travel
Independent researchers have also highlighted the longer-term direction of AI-enabled cyberattacks. Anthropic's 'Claude Mythos Preview', a gated research model, demonstrated the ability to autonomously identify and exploit vulnerabilities. The UK AI Security Institute also confirmed the model successfully completed a full simulated network takeover scenario. While the model is 'not publicly available' and remains restricted to defensive research partners, it provides a clear indication of where attacker capabilities are heading.
Why this matters for SMBs
- As these capabilities mature, they are likely to become available to less skilled attackers, reducing the expertise required to carry out sophisticated attacks.
- SMBs are expected to be disproportionately affected because they typically lack the defensive depth, security resources, and resilience of large enterprises.
- For MSPs, this reinforces the importance of helping customers adopt layered security controls that can defend against increasingly sophisticated, AI-assisted attacks.
How Defenders Use AI (Detection, Triage, Automation)
Defensive use of AI generally falls into three areas: detection, triage, and automation. In detection, AI-driven behavioral analysis spots anomalies and impersonation that signature-based tools miss because it looks at patterns of behavior rather than matching known malicious content. This is the same approach used in Integrated Cloud Email Security to catch BEC and account takeover. In triage, machine learning helps prioritize the flood of alerts that any security stack generates, surfacing the handful that genuinely need human attention rather than leaving a technician to work through every alert manually. This matters enormously for MSPs managing dozens of tenants, where alert fatigue is a real operational risk.
In automation, AI supports faster response times, post-delivery email remediation, automated phishing-simulation campaigns, and real-time risk scoring across users and clients. The goal across all three areas is the same: let technology handle the volume so human expertise can focus on judgment calls AI cannot make.
Delivering Measurable Outcomes for MSPs
of MSPs rank cybersecurity as the #1 revenue driver
of SMBs fail within six months of a cyberattack highlighting how critical email protection is.
Users fall for phishing each year, making ongoing security awareness training essential to reduce human risk and protect customers.
environments protected, helping MSPs protect millions of users every day
The MSP's New Responsibilities in an AI World
AI adoption inside client businesses creates responsibilities that go beyond traditional IT support. MSPs are increasingly the ones helping clients vet new AI tools before adoption (see CyberSentriQ's guide to AI vendor due diligence), govern shadow AI use at the DNS layer, and update security awareness training to reflect AI-generated social engineering rather than older, more obvious phishing patterns. There is also a growing identity and access dimension. As AI agents start acting on behalf of employees inside platforms like Microsoft 365, they become a new kind of account to protect, with their own permissions and behavior to monitor.
This is a developing area MSPs should track closely as agent-based AI features become more common. Taken together, these responsibilities position the MSP less as a vendor reselling point products and more as the client's ongoing AI governance partner, a relationship that strengthens retention and creates space for new, recurring service lines.
Compliance and Governance: AI Act, GDPR, Shadow AI
Most SMB clients are deployers of AI tools, not providers. This means their EU AI Act obligations focus on:
- AI literacy
- Acceptable-use governance
- Transparency
Rather than the strict high-risk requirements intended for AI builders (see CyberSentriQ's guide to the EU AI Act for MSPs and SMBs). Where AI tools process personal data, GDPR obligations apply in full alongside any AI Act requirements. Businesses already compliant with GDPR have a head start on AI governance, since both regulations expect clear control over how data is collected and used.
Shadow AI sits at the intersection of all of this:
- Without visibility into which AI tools staff are actually using, a business cannot meaningfully claim compliance with either regulation
- DNS-layer governance and a documented, approved AI list are what turn compliance policy into something that can be evidenced rather than assumed
A Layered AI-Era Security Stack (Email, DNS, Backup, SAT, Archiving)
No single product addresses AI-driven risk on its own. A layered stack is the practical answer, with each layer covering a different stage of the attack chain or governance need. Multi-layered email security catches AI-written phishing and BEC before and after delivery, including account takeover detection through behavioral analysis. DNS-layer web protection governs shadow AI use and blocks the malware and phishing domains that AI-generated lures often lead to. Security awareness training keeps staff prepared for increasingly convincing social engineering, reinforced through realistic, ongoing simulation rather than a single annual session.
Backup and recovery across Microsoft 365, Entra ID, Azure VMs, and Google Workspace provide the resilience layer that matters when prevention is not enough: if an AI-accelerated attack does get through, independent, off-cloud backup is what enables clean recovery rather than reconstruction from scratch. Email archiving supports the compliance and eDiscovery side of this picture, and email encryption protects sensitive communications in transit.
Each of these layers is independent, so a single point of failure, including one within Microsoft's own infrastructure, does not compromise the whole stack. For MSPs, this layered model is also a clear, repeatable way to map every conversation about AI risk back to a specific, sellable service, turning a broad and sometimes abstract topic into concrete, recurring revenue.
Talk to CyberSentriq about building this layered resilience model into your service stack today.
AI Cybersecurity FAQs
Mostly, AI is accelerating and scaling existing attack techniques rather than inventing new ones. Phishing, business email compromise, and session-theft attacks like AiTM are not new, but AI makes the lures more convincing and the targeting far faster and cheaper to run at scale.
Defenders use AI for behavioral detection of anomalies and impersonation, triage to prioritize which alerts need human attention, and automation for tasks like post-delivery email remediation and ongoing phishing simulation campaigns.
Independent assessments suggest SMBs are likely to be disproportionately affected, mainly because they typically lack the defensive depth and dedicated security resources that larger enterprises have, even as the same AI-accelerated attack techniques are used against both.
Most SMBs are deployers rather than providers of AI under the EU AI Act, which means their main obligations involve AI literacy, acceptable-use governance, and transparency. Where AI tools process personal data, GDPR obligations also apply.
A practical stack typically includes layered email security, DNS filtering for web and AI tools, governance, security awareness training, backup and recovery across Microsoft 365 and identity systems, and supporting controls such as email archiving and encryption, each addressing a different stage of risk.
Ready to get started?
