National security implications of frontier AI have never been more visible than over the last few months, but what should SMBs be concerned about?
In July 2026, the US Commerce Department issued an export control directive ordering Anthropic to suspend all access to its most advanced models, Fable 5 and Mythos 5, citing concerns that their cybersecurity capabilities could be misused.
Closer to home, Singapore’s Coordinating Minister for National Security K Shanmugam has similarly flagged that threat actors are increasingly using frontier AI to aid cyber-attacks, and that Singapore’s critical infrastructure sectors are “high-value targets”.
Arctic Wolf’s 2025 Trends Report found 70% of Singapore businesses surveyed suffered a breach in the past year, while the nation’s Cyber Security Agency noted that three in five ransomware attacks hit SMBs.
But while policymakers and industry players are focused on frontier AI’s ability to discover new vulnerabilities, the far more immediate risk – especially for SMBs – is how AI is being used today to dramatically industrialise the majority of cyber-attacks that rely on existing weaknesses, such as phishing and social engineering, among others.
Are organisations focusing too much on hypothetical frontier AI risks, while missing the reality of AI being used to scale everyday cyber-attacks? We find out in this interview with Laura Ellis, Senior Vice President, Artificial Intelligence, Arctic Wolf.
Laura Ellis, Senior Vice President, Artificial Intelligence, Arctic Wolf
Disproportionate attention seems to have been given to zero-day discovery. Do you agree, and why?
Ellis: I absolutely agree. Not every cyberattack involves a shadowy elite squad deploying a flawless, never-before-seen zero-day exploit to breach a system. It makes for great headlines, but it’s a distraction from what’s actually happening on the ground. AI has lowered the barrier for entry for attackers. Launching a cyberattack is now trivial for threat actors with access to frontier models.
The cybersecurity landscape has evolved dramatically, but one thing remains: Attackers are business-minded and will go for the highest return on investment. Why waste the high costs associated with finding and leveraging a novel zero-day asset when an organisation has left its digital front door unlocked? The far more immediate risk, especially for SMBs, is the frequency of attacks targeting existing weaknesses.
Our data clearly backs this up. When we surveyed nearly 2,000 IT and security practitioners for the 2025 edition of our AI Cybersecurity report, we found that organisations are firmly waking up to this reality. A security team’s most pressing challenge is, and always will be, the fundamental need to find and prevent immediate, everyday threats. We need to stop obsessing over edge cases and start focusing on protecting the foundational infrastructure.
How is AI being used to scale everyday attacks such as phishing, credential abuse, etc., at unprecedented speed and volume?
Ellis: Think of AI as the ultimate force multiplier. Just as it helps legitimate software engineers write code faster, it allows threat actors to optimise their workflows and automate the tedious parts of cybercrime.
Take phishing and social engineering, for example. Historically, there was a natural bottleneck: attackers had to manually draft emails, and if they were targeting a different country, the copy was often riddled with obvious grammatical errors and awkward phrasing.
Now, a low-level attacker can instantly generate thousands of hyper-convincing and localised phishing lures in seconds. The same applies to credential abuse and vulnerability scanning. Malicious AI tools can scan thousands of networks simultaneously, identify unpatched legacy systems, and launch automated credential-stuffing attacks with terrifying speed and precision.
This dramatic shift is exactly why 48% of organisations we surveyed stated that the attackers’ use of AI is directly increasing their own sense of urgency to adopt the technology. The adversary is using AI to achieve accuracy quickly, and legacy defense strategies simply cannot keep pace with that kind of volume.
With the emergence of “spray-and-pray” cyber campaigns targeting thousands of SMBs simultaneously, enabled by lower technical barriers, what should organisations prioritise in the AI arms race?
Ellis: We know that AI has significantly lowered the barrier to entry for attackers. SMBs, which may have limited cybersecurity resources, need to be highly strategic in prioritising which capabilities of AI to tap into.
The strategy shouldn’t be about fighting code with code in a vacuum. Instead, organisations must prioritise two things:
- 24×7 security operations automation: Because these automated campaigns hit simultaneously at any hour, you need AI-driven systems capable of enforcing around-the-clock threat detection and initial triage. You have to shorten the window between detection and containment.
- A strategic human-AI partnership: AI is a powerful instrument. Like a hammer, it can build or it can break, depending on the skill of the user. That being said, AI cannot operate in a vacuum. While it excels at sorting through trillions of events to flag anomalies, you absolutely need human analysts to step in as alert validators to provide context, strategic oversight, and execution.
The organisations that win this arms race will be the ones that successfully pair automated toolsets with trusted partners and human expertise to shut down attacks before they turn into breaches.
