Attackers now use AI across the whole intrusion chain, and 2026 brought the first documented agentic ransomware operations. Small businesses absorb over 70% of breaches. Here is what changed and the defences that still work.
The defining security shift of 2026 is not a new category of malware. It is that AI has collapsed the cost of running a competent attack, so small organisations that were previously ignored are now targeted at industrial scale. Small and mid-sized businesses now account for over 70% of all data breaches, and 75% of SMB owners rank cyberattacks as the threat most likely to damage their operations this year.
Key takeaways
- In July 2026, Sysdig's Threat Research Team reported JADEPUFFER, classified as the first documented agentic ransomware operation.
- Anthropic disclosed disrupting an operation that used AI throughout a data-theft and extortion campaign against at least 17 organisations.
- One industry survey found 85% of organisations experienced at least one deepfake-related incident in the past year.
- The FBI's IC3 has flagged deepfake-assisted fraud as the fastest-growing category of AI-enabled threat.
What changed in the attacker's economics?
Historically, a targeted attack required a skilled human to research the victim, craft convincing pretexts, find a way in, and decide what to steal. That labour cost meant small businesses were rarely worth the effort. Generic mass phishing hit them, but tailored intrusion did not.
AI removed that constraint. Reconnaissance, pretext writing, vulnerability discovery and data triage can now be delegated, which means the attention once reserved for large enterprises can be pointed at a 20-person firm without meaningfully increasing cost.
How does agentic ransomware differ from ordinary ransomware?
Traditional ransomware encrypts whatever it reaches and demands a flat sum. Agentic operations behave differently in three ways that matter defensively:
- They select rather than sweep. The agent evaluates what it finds and prioritises the data most damaging to lose — contracts, patient records, payroll, unreleased financials.
- They price the ransom to the victim. Demands are tailored using information gathered during the intrusion, including your apparent ability to pay.
- They lean on exfiltration, not encryption. Double extortion — steal first, encrypt second, threaten publication — makes a clean backup necessary but no longer sufficient.
That last point deserves emphasis. Many small businesses treat backups as their complete ransomware answer. Backups restore availability; they do nothing about a threat to publish your customer database.
Why is deepfake fraud so effective?
Deepfake fraud works because it attacks trust in a channel people were trained to rely on. A finance assistant who would question a suspicious email will act on what sounds exactly like their director's voice asking for an urgent transfer.
The common patterns now include synthetic voice calls impersonating executives, video calls using generated likenesses, and synthetic identity documents used to open accounts or pass verification checks. Dark web marketplaces for AI-generated identity documents have made large-scale account takeover materially easier.
You cannot train staff to reliably detect a good deepfake. You can train them to follow a verification procedure that makes detection unnecessary.
What defences actually work for a small business?
The good news is that the highest-value controls remain unglamorous and affordable.
Out-of-band verification for money and access
Any instruction to move money, change bank details, or grant access must be confirmed on a second channel using contact details from your own records. No exceptions for urgency or seniority — urgency and seniority are precisely what the attack manufactures.
Phishing-resistant MFA
Move administrative, banking and email accounts to passkeys or hardware keys. SMS codes are now routinely defeated by real-time phishing proxies.
Offline, tested backups
Keep at least one backup copy that is offline or immutable, and actually restore from it periodically. An untested backup is a hypothesis.
Least privilege and named accounts
Shared logins make it impossible to tell what an intruder touched. Every person gets their own account with only the access their role requires.
Patch the internet-facing surface first
Automated vulnerability discovery means the window between a vulnerability becoming public and being exploited has narrowed considerably. Prioritise anything exposed to the internet — VPNs, remote desktop, web servers, routers.
An incident plan that exists on paper
Written down, printed, and stored somewhere retrievable when systems are encrypted. Include who declares an incident, who contacts the bank, and your legal notification obligations under the DPDP framework.
| Control | Effort | Blocks |
|---|---|---|
| Out-of-band payment verification | Very low | Deepfake and BEC fraud |
| Passkeys / hardware MFA | Low | Credential theft, phishing |
| Immutable backups | Medium | Encryption ransomware |
| Least-privilege accounts | Medium | Lateral movement |
| Rapid external patching | Medium | Automated exploitation |
| Data minimisation | Low | Exfiltration extortion |
The control most people skip
Data minimisation is the most underrated defence against double extortion. Every record you do not hold is a record that cannot be stolen and threatened. Deleting data you no longer need reduces breach impact and simultaneously advances your DPDP obligations — one action satisfying two requirements.
Conclusion
Attackers gained better tools in 2026; the fundamentals of defence did not change, but the tolerance for skipping them disappeared. Verification procedures, strong authentication, tested backups and less retained data will stop the overwhelming majority of what a small business will face. Our cybersecurity practice runs assessments built around exactly these controls, prioritised by what would hurt your business most — book a review if you want a clear picture of where you stand.
Frequently asked questions
What is agentic ransomware?
Agentic ransomware describes attacks where AI agents carry out large parts of the intrusion autonomously — reconnaissance, gaining access, choosing which data is most valuable to steal, and drafting tailored extortion demands. In July 2026 the Sysdig Threat Research Team reported JADEPUFFER, which it classified as the first documented agentic ransomware operation.
Why are small businesses targeted more than large enterprises?
Small and mid-sized businesses account for over 70% of all data breaches. They hold valuable data but rarely have dedicated security staff, and AI has removed the cost barrier that once made attacking small targets uneconomical. Attacks that needed a skilled human can now be run at scale against thousands of small firms simultaneously.
How can we defend against deepfake voice fraud?
Technology alone will not solve it — the reliable control is procedural. Require that any payment instruction or change of bank details be confirmed through a second, pre-agreed channel, using a number from your records rather than one supplied in the request. Make this rule mandatory regardless of who appears to be asking.
Is multi-factor authentication still effective in 2026?
Yes, but the type matters. SMS-based codes are increasingly bypassed through interception and real-time phishing proxies. Phishing-resistant methods such as hardware security keys or passkeys are substantially stronger and should be the default for administrative and financial accounts.
