A convincing request to change a supplier’s banking details. A software update that keeps being postponed. An AI tool connected to confidential company files. Cybersecurity risks can sit within familiar work tasks, making them easy to overlook until something goes wrong.

Reports published by CrowdStrike and Verizon this year highlight how attackers are using AI to accelerate their activities and exploiting software vulnerabilities to gain access to company systems. These findings reinforce the need for business owners to reassess how they protect their operations.

Danie Schwartz, Senior .NET Engineer at Strider Digital, says one of the biggest misconceptions businesses continue to hold is that cyber threats are predictable.

“Cybersecurity isn't something you ‘set and forget’,” Schwartz explains. “The threat landscape is evolving in real time and the businesses that stay ahead are those that treat cybersecurity as an ongoing, adaptive strategy, supported by skilled people who can continuously assess and respond to risk.”

Schwartz points to five lessons that stand out from this year.

1. AI is helping attackers move faster

AI can help cybercriminals write convincing messages, research targets and automate parts of an attack. This makes it harder to rely on familiar warning signs, such as poor grammar, to identify a suspicious request.

CrowdStrike’s 2026 Global Threat Report recorded an 89% year-on-year increase in activity by AI-enabled adversaries during 2025. The finding highlights how attackers are incorporating these tools into their operations.

“AI is lowering the barrier to entry for cybercrime,” says Schwartz. “Businesses are facing increasingly sophisticated attacks that can be executed faster and at greater scale.”

For businesses, verification needs to become part of the process. A request to change banking details, transfer money or share confidential information should be checked through a separate, trusted channel. Before changing a supplier’s banking details, for example, call them on their usual, previously verified number to confirm the request.

2. People need support and systems need stronger safeguards

Employees have an important role in cybersecurity but describing human error as the weakest link overlooks the conditions that allow an incident to happen. Outdated software, weak access controls and poorly configured systems can expose a company even when its people are alert.

Verizon’s 2026 Data Breach Investigations Report found that exploiting software vulnerabilities accounted for 31% of breach entry points, overtaking stolen credentials for the first time in the report’s history. Although published this year, the report analyses incidents from an earlier reporting period.

“The reality is that cybersecurity is as much about people as it is about technology,” Schwartz notes. “Businesses need to invest in continuous education and build teams that are confident and capable, not just compliant, when it comes to cybersecurity.”

That education should sit alongside practical safeguards: installing security updates promptly, replacing unsupported software, enabling multi-factor authentication (MFA) on email accounts and limiting access to what each person needs for their role. Employees also need a clear way to report suspicious activity quickly, without fear of blame.

3. A company’s own use of AI creates risks too

The cybersecurity conversation often focuses on criminals using AI but businesses also need to consider what happens when their own teams use it.

Uploading customer information, contracts or internal financial documents to an unapproved tool can put sensitive data outside the company’s agreed controls. Connecting an AI assistant to email, shared folders or other systems can also give it access to more information than it needs.

Before introducing a tool, business leaders should understand how it handles data and what actions it can take. Its permissions should be limited to the task required, with appropriate human approval for payments, external communications or changes to important records.

Employees need clear, practical guidance on which tools they may use and what information they may share. They should know whether they can upload a document, connect an account or use an AI-generated answer in client work and who to ask when they are unsure.

4. Supplier access deserves closer attention

Cloud platforms, software providers and external contractors can all hold company information or have access to internal systems and it is these connections that need to be included in security reviews.

The practical question is not simply whether a supplier has a security policy, it is what that supplier can access, how its accounts are protected and how quickly it would notify the company of an incident.

Businesses should keep a record of suppliers with access to sensitive data or critical systems, review those permissions regularly and remove access when a contract ends. Important providers should also be included in incident planning, particularly where their services are essential to keeping operations running.

5. Recovery needs to be rehearsed

Ransomware can interrupt trading, expose confidential information and place pressure on teams that need to make decisions quickly. Having backups and a response document is useful but neither proves that a company can recover.

“Ransomware is no longer just an IT issue, it's a reputational and operational risk,” explains Schwartz. “Businesses need skilled teams, tested response plans and the ability to recover quickly, not just preventative measures.”

A practical starting point is to restore a file or system from a backup to check that it works. Businesses should also protect backups from compromise and agree which systems must be recovered first. A short incident exercise can reveal other gaps: who can authorise shutting down a system, who contacts service providers and who communicates with customers?

Specialist expertise remains essential but clear responsibilities and rehearsed decisions help the wider team act effectively when that expertise is needed most.

Building resilience for the future

The lessons available in 2026 thus far point to a practical priority: close the gaps that give attackers opportunities and that includes overdue updates, unnecessary access, unclear rules for AI use and recovery plans that have never been tested.

For businesses facing cybersecurity skills shortages, identifying these priorities can also make hiring and training more focused. Understanding where the greatest exposure lies helps determine which capabilities to develop internally and where specialist support is needed.

“Cybersecurity needs to be embedded into every part of the business, from leadership decision-making to day-to-day operations. It's not just about preventing attacks, it's about building resilience so that when incidents do happen, and they will, businesses can respond quickly, minimise disruption and recover effectively,” concludes Schwartz.