In recent security tests, AI models got into real company systems on their own — not through some clever zero-day, but by finding an access key sitting in a public repository and guessing a weak password. For a small company the message is uncomfortably simple: your most boring security debts are now discoverable at industrial speed.
The cost of attacking dropped; your weakest spot stayed the same
None of these weaknesses are new. API keys have been left in source code for decades and weak passwords have been guessed for just as long. What changed is the economics: previously someone had to bother looking at your specific company. Now the same work runs automatically across thousands of organisations at once, without anyone ever deliberately putting your name on a list.
That retires the most common security strategy among smaller firms — "we're too small, nobody would waste time on us". You are no longer a target, you are part of a sample. And every new AI integration, automation or Zapier-style connection adds one more key to that sample.
The hour of work that covers most of the risk
We recommend starting at the dullest end, not the most exciting one. Do a key inventory: list in one spreadsheet every service your systems access as a machine — payment provider, e-commerce API, accounting, CRM, AI model APIs, newsletter tool. Three columns per row: who owns it, where the key physically lives, and when it was last rotated.
Two things usually surface. First, keys live in places nobody ever planned for — Slack threads, email, a Google Sheet, the laptop of a contractor who left two years ago. Second, most of them have never been rotated. At minimum, rotate the ones that were accessible to people who no longer work with you, turn on secret scanning in your repositories, and move all human passwords into a password manager with two-factor authentication. This is not a project; it is one afternoon.
The second door goes through people, not code
Running in parallel is a campaign that doesn't try to break your software at all — it tries to persuade your people. The pattern repeats: an attractive job or partnership offer arrives, a video call follows, and during the call the victim is asked to install a "meeting plugin" or paste a terminal command copied from the clipboard. Developers and technical leads are the primary targets — precisely the people whose machines hold every access credential.
The countermeasure costs nothing: agree on one written rule. During a call with an unknown party, nobody installs software, pastes command-line instructions or runs scripts — no matter how plausible the story sounds. If in doubt, end the call and verify through a second channel. The same rule protects the manager who receives an "urgent" payment or access request that looks like it came from a colleague.
Where the limit is
An honest caveat: one news story is not a reason to buy a large security programme or start a certification project. For a ten-person company, a password manager, two-factor authentication, a list of keys and one agreed rule genuinely cover most of the real risk — and do it cheaper than any consulting package.
The limit appears in two situations. First, when other people's sensitive data is the substance of your business — health, finance, large customer databases. Then you need real external review, not a checklist. Second, when you give an AI agent access to your database. Model choice is not the issue there: permission logic has to be tested as carefully as functionality, because an agent will try things none of your users would have thought to try. If you don't know what data the agent can see, you don't know what data can leak.