# Big company security on a small team budget. Why attackers pick small firms, and what automatic checks close. > Attackers rarely pick small firms by name; they send one trick to many. See what hurts, what AI changes and what automatic checks on your Macs can close. Page: https://cybee.ai/blog/ai-powered-cybersecurity-smes/ (Big company security for a small team) - [Blog](https://cybee.ai/blog/) - Big company security ai tools Most attacks on small firms are not aimed at them. A message goes out to a hundred thousand inboxes, and one person answers. A small team cannot hire a security department. It can let software do the checking that department would do on a timer, and keep its own attention for the parts only people can handle. By [Cybee](https://cybee.ai/about/#founders) Published 28.10.2026 10 minute read In one minute - Attackers mostly send the same trick to thousands of firms at once. In a UK government survey, 46% of small businesses and 42% of micro businesses had found an attack in the past twelve months. - Most incidents in that survey cost little. The ones that hurt take time: new protections, extra staff hours, a day when nobody could work. - AI helps attackers write messages without the spelling mistakes that used to give them away. So careful reading is no longer enough on its own. - A Mac can check itself every 12 hours, put a drifted setting back and keep a dated record. Cybee does this on the Mac, and no AI model in Cybee’s backend decides what is malicious. - Accounts, backups and a written plan for a bad day still belong to people. ## Do attackers really pick small firms? Mostly they pick nobody. A criminal who writes one convincing message can send it to a hundred thousand inboxes for next to nothing, then wait to see who answers. A five person studio and a hospital group get the same email. The studio has no one whose job is to doubt it. The Swiss National Cyber Security Centre says fraud dominates the reports it receives: 27,128 voluntary reports in the first half of 2026 alone. The UK government asks businesses the same question every year. In the latest round, 46% of small businesses (ten to 49 employees) and 42% of micro businesses (one to nine) said they had found an attack in the previous twelve months. Medium and large firms report more, 65% and 69%, so size protects nobody. Small firms are far from exempt. How often small firms are hit 46% of small businesses in the UK found an attack or an incident in the past twelve months. For micro businesses it was 42%. Source: UK government survey of business cyber security, 2025/2026 60% of the ways attackers first got in, across 4,875 incidents studied in Europe, started with phishing. Source: ENISA, EU threat report 2025 Phishing is the common way in. Fieldwork for the UK survey ran from August to December 2025, and 38% of all businesses had met phishing, more than any other kind of attack. Why do small firms stay easy to reach? Not because anyone studied them. Their Macs run on default settings, one person holds the keys to every account, and an odd request from a client gets answered because the answer takes ten seconds. A larger company has layers that catch some of this. A small one has the person who opened the email. **Q:** What is phishing? ### What phishing is. A message built to make someone do something they should not: type a password into a fake page, open an attachment, pay an invoice that looks right. It arrives as an email, a text message or a call, often as a voice call from a person who claims to be the IT helpdesk. The trick is rarely technical. The message only has to look like it belongs in the day. ## How do attacks hurt a small firm? Less often in money than you might expect, and more often in time. The UK survey asked each business what its most disruptive incident cost. The middle answer was £0. Only the top five percent of answers reached £4,000, for small firms and for all businesses alike. Owners gave their own estimates, so read those figures as a feel for the size, not as a bill. Time shows up in the next set of answers, from businesses that had an incident. Three in ten reported at least one effect. Nineteen percent had to take up new protections afterwards, 16% spent extra staff time on it, and 11% found that staff could not do their normal work for a while. A small team feels a lost day as a day without a product, a missed delivery to a client, a founder doing clean up instead of selling. And the survey leaves out the most important part. When a client’s files or keys are involved, the question stops being what it cost you. It becomes whether that client stays, and what the next questionnaire asks. > Most incidents cost almost nothing. Be ready for the one that does. Being ready starts with a written plan, and here small firms trail most. Only 21% of micro businesses in the survey had a formal incident plan, against 76% of large businesses. That gap costs nothing to close. It takes one page. **Q:** What is ransomware? ### What ransomware is. Software that locks your files and demands payment to give them back. Paying does not guarantee you get the files back, and a backup you have tested is the better answer. It usually gets in the way phishing does: someone opens a file or runs a program they should not have. ## What does AI change for each side? For attackers it changes the quality of the message. In January 2024 the UK National Cyber Security Centre judged that AI would almost certainly raise the volume and the impact of attacks over the following two years. It singled out social engineering, the part where a person is talked into something. Phishing often gives itself away through odd spelling and grammar. The centre expected AI to remove those tells, and to make it hard for anyone, whatever their security knowledge, to tell a genuine email or password reset from a fake. It also found the biggest gain among the least skilled criminals, who start from a low base. The numbers are moving the same way. ENISA, the European Union agency for cybersecurity, passes on a report that more than 80% of social engineering activity seen worldwide by early 2025 already used AI to some extent, and it marks the figure as reported, not measured. On 24 August 2026 the Swiss centre wrote that attackers now use AI systematically to deliver tailored, personal and credible content to their victims. Defenders get the same technology, and the UK assessment is careful about what that buys. Detection and secure design offset part of the effect, it says, and more work is needed to show how far. > A better written message is harder to doubt. A setting that stays on does not read it. That is why reading every message more carefully cannot be the whole defence. What still works is dull and mechanical: the Mac has its own safety switches on, a program that behaves like an attack gets stopped, and somebody sees it when a switch drifts. None of that depends on how well the message was written. ## What can a small team borrow from a big one? A large company covers its Macs with people and paperwork. A small team can cover the Mac part of that ground with software that does the same job on a timer. Cybee, which runs on Macs with an Apple chip, M1 or newer, on macOS 15 or newer, works this way. Every Mac audits itself three minutes after it joins and then every 12 hours. You pick one of three levels of safer settings: Essential changes nothing, Balanced and Fortress turn on more of the Mac’s own switches. A setting that drifts is put back and recorded. A setting nobody agreed to is never changed, and everything is reversible. Figure: Part of the same ground, done by software on the Mac. The Trust Passport and its checks cover technical controls on your Macs only. The Trust Passport records technical observations on the Macs it lists, with dates. A fingerprint at its foot shows the page is unchanged since Cybee sealed it. It does not check the facts a second time, and it is not an audit or a certification. Protection and the safer settings are free on every Mac. The sealed Trust Passport belongs to the paid plan, called the Cybee subscription. Cybee subscription The sealed Trust Passport and security training are part of the Cybee subscription: CHF 9 per Mac per month, or 90 a year, excluding tax, with a 14 day trial. Protection and the 118 checks stay free on every Mac. **Q:** What are the 118 checks? ### What the 118 checks are. The CIS Benchmark for macOS is a public list of the safest settings for a Mac, kept up to date by an industry group. It sorts them into two levels. Cybee audits every Mac against all 118 checks, such as whether disk encryption and the screen lock are on. Cybee has no formal relationship with CIS. It uses the public list as the source of every check. [See what each level changes](https://cybee.ai/docs/hardening/) ## Where does your AI assistant fit in? There is no separate screen to log in to. Your AI assistant builds any view you ask for: you type a question in the AI assistant your team already uses, such as Claude or Cursor, and Cybee answers from the dated record on your Macs. The answer is the same in every AI assistant, and it comes as a short card or as plain text. Figure: A made up team with four Macs. One question, answered from the record, and the person who uses the Mac decides about the fix. The AI part of Cybee stops there. There is no AI model in Cybee’s backend that decides what is malicious. Detection, safer settings and fixes run on the Mac itself, and Cybee acts on the Mac first: it quarantines a file, stops a program or puts a setting back. The AI assistants your team uses are a risk of their own, because one can run commands and reach other tools. Cybee lists the AI tools on each Mac and the outside tool servers each one trusts, so a forgotten connection does not stay hidden. It raises two alerts: when an AI agent tries to run a destructive command, and when it tries to disable or alter security tooling. It alerts. It does not stop the agent, and it does not limit what an agent can reach. ## What still needs a person? Plenty. Cybee covers the technical controls on your Macs. It does not cover your accounts, your backups, your phones or your policies, and a record of the Macs does not answer for them. The UK National Cyber Security Centre’s small business guide names three places to start: backups, protecting your devices and accounts, and spotting scams. For the accounts, turn on a second step at sign in for email and every cloud tool that holds client work. For backups, restore one file from a backup this month, so you know it works before the day you need it. And write the plan. One page: who to call first, who tells the client, which accounts to lock if a laptop goes missing. Keep it where anyone on the team can find it. A plan that exists beats a better one that does not. ## What to remember. Pick one Mac this week and ask what is open on it. Write the one page plan the same afternoon, while nothing is wrong. ## Sources and product scope. Written by Cybee for small teams. Every outside figure comes from a page opened on 28 October 2026. The product statements come from our own documentation. - [UK government: cyber security survey of businesses 2025/2026, published 30 April 2026](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) - [ENISA: EU threat report 2025, press release of 1 October 2025](https://www.enisa.europa.eu/news/etl-2025-eu-consistently-targeted-by-diverse-yet-convergent-threat-groups) - [UK NCSC: the near term impact of AI on the cyber threat, January 2024](https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat) - [Swiss National Cyber Security Centre: semi annual report 2026/1, 24 August 2026](https://www.bacs.admin.ch/en/hjb-26-1-en) - [UK NCSC: Small Business Guide](https://www.ncsc.gov.uk/collection/small-business-guide) - [Cybee: the three levels of safer settings](https://cybee.ai/docs/hardening/) ## Turn the checks on for your Macs. See what each of the three levels changes on a Mac, and how to put every change back. [See the three levels](https://cybee.ai/docs/hardening/) On this page - Do attackers pick small firms? - How attacks hurt a small firm - What AI changes for each side - What a small team can borrow - Where your AI assistant fits - What still needs a person - What to remember - Sources Cybee Checks every Mac every 12 hours and keeps a dated record. Protection and the safer settings are free on every Mac. [See how it works](https://cybee.ai/product/) ## The next question your team asks. Three more guides. [AI tools Which AI tools are on your work Mac? Find the assistants, the connections set up in each one and the experiments nobody switched off. Read the guide](https://cybee.ai/blog/ai-tool-inventory/) [Mac security Are Macs secure enough for a small business? What your Mac already protects, what your business still needs to check and how to keep a useful record. Read the guide](https://cybee.ai/blog/mac-security-small-business/) [Mac security What happens after a security check? The step between finding a weak setting and changing it safely, worked through on one screen lock. Read the guide](https://cybee.ai/blog/checking-and-hardening/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. What the command does - Installs a notarized agent on this Mac. - Creates no account. The install is identified by a token. - Starts protecting the device at once. - Changes no setting until you confirm it in your AI assistant. - Asks for this Mac’s administrator password once, and for no email address. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)