← Back to blog

The Six-Month Window Most Small Businesses Don’t Know They’re In

John Abbitt

·

·

9 min read

For years, being small and obscure protected most businesses from serious cyberattacks. AI is ending that protection by making it cheap to search everyone for weaknesses, and the people closest to the technology say businesses have a short window to get their basics in order.

On March 7, 2017, the organization that maintains a widely used piece of web software called Apache Struts announced a serious security flaw and released a fix. The next day, the Department of Homeland Security notified Equifax, the credit reporting company, about the threat. The day after that, Equifax's own security team emailed employees instructing everyone running that software to install the fix.

Equifax did almost everything right in those first three days. It heard about the problem quickly, understood it was serious, and told the right people to act. But one system, a portal customers used to dispute items on their credit reports, never got the update. Within days of the fix being published, attackers were already scanning the internet for servers that hadn't installed it, and they eventually found Equifax's. They got in that spring and stayed for months, in part because, as Equifax later told federal auditors, a security certificate on a monitoring system had expired, so the tool that should have flagged unusual traffic wasn't working. When Equifax finally disclosed the breach in September, the personal information of roughly 147 million Americans had been exposed, and the company eventually agreed to a settlement with the Federal Trade Commission of up to $425 million.

I start with Equifax because it's a story about a big company with a dedicated security team, a clear warning, and a fix in hand, and it still came down to one server nobody updated. I also start with it because the conditions that made that breach possible are about to become much more common for businesses of every size. AI is making it far cheaper to find exactly that kind of overlooked system, at exactly that kind of speed, across the entire internet at once. My argument in this post is that for most small and mid-sized companies, the thing that has quietly protected them for years was simply being too small to be worth the effort, and AI is ending that protection. The good news is that the defenses that work are mostly basic habits, and there's still time to build them.

What changed this year

To understand why, it helps to know how software weaknesses work. Every program your business relies on, from accounting software to the app your technicians use in the field, is made of code written by people, and people make mistakes. Some of those mistakes leave an opening an attacker can use. Security professionals call that opening a vulnerability. When a software company discovers one, it writes a fix and sends it out as an update, usually called a patch. The dangerous stretch is the time between when a vulnerability becomes known and when the people running the software actually install the patch, which is exactly the gap that caught Equifax.

This year, that gap got a lot more dangerous. Anthropic, one of the major AI companies, built a model called Mythos that turned out to be exceptionally good at finding vulnerabilities. Anthropic judged it too risky to release publicly and instead gave access to a small group of large organizations, including banks and technology companies, so they could find and fix their own weaknesses first. On October 6, Anthropic reported that partners using its Mythos models had uncovered at least 129,000 verified software vulnerabilities between April and July, with more than 33,000 rated critical or high severity. Many had gone unnoticed for years, and some for decades.

That's a remarkable win for the defenders who have access to it. It also tells us what's coming. Anthropic itself has warned that "it will not be long before such capabilities proliferate," potentially reaching people who won't use them responsibly. When that happens, the time it takes an attacker to find an unpatched system will shrink from weeks to something closer to hours, and the number of systems they can check will grow from a list of chosen targets to essentially everyone.

The window, and how seriously to take it

JPMorgan Chase CEO Jamie Dimon, whose bank has used Mythos since April, has been one of the most outspoken voices on this. This summer, he and Anthropic CEO Dario Amodei described a narrow six- to 12-month window for organizations to fix critical flaws before comparable AI capabilities become widely available.

I'd treat that estimate with both respect and some care. It was made in July by two people looking at the entire economy, and nobody can tell you the exact month the risk changes for a particular business. But if you take it at face value, a good portion of that window has already passed. I'd treat the coming months as the time to get your house in order, rather than waiting for a headline to announce that the window has closed.

Why small businesses lose their cover

Small businesses have always been attacked, of course, but most of the serious, targeted work went to larger organizations, because finding a way into a specific company took skill and time, and attackers spent that time where the payoff was biggest. Being a 40-person company with a modest IT setup was, in a sense, a form of protection. You weren't impossible to break into. You just weren't worth the trouble.

AI changes that math by making the search nearly free. When an automated system can check every business for a known, unpatched weakness, an attacker no longer has to choose targets. They can test everyone and go wherever the door happens to be open, and the businesses with the fewest people paying attention are the easiest to find.

The data on breaches already shows where that leads. Verizon's annual Data Breach Investigations Report is one of the most respected sources in the field, built from thousands of real incidents. In its 2026 edition, ransomware, where attackers lock up a company's systems and demand payment, appeared in 83% of breaches at small and mid-sized businesses, compared with 48% across all organizations. For those smaller businesses, the most common way in was exploiting a known vulnerability, at 26% of breaches. Verizon counts any organization under 1,000 employees as small, so the category is broad, but the pattern is clear: smaller organizations suffer the most damaging kind of attack, and very often the front door was a flaw a patch would have closed. AI makes that front door easier to find.

"We have antivirus, and our IT guy handles it"

The most common response I hear from owners is some version of, "We're covered. We have antivirus, and our IT provider takes care of this." I understand why it feels that way, and in many cases the IT provider is doing good work.

The Equifax story is a useful check on that confidence. Equifax had far more security resources than any small business will ever have, and its breach still came down to a single update that slipped through the cracks and a monitoring tool nobody noticed had stopped working. The failure was in ownership and follow-through, the ordinary habits of making sure the right thing actually happened on every system. Antivirus software doesn't install patches on your accounting server, and an outside provider can only update the systems they know about and have access to.

There's also a newer gap that most businesses haven't accounted for, which is the AI tools their own teams are using. IBM's Cost of a Data Breach report examined AI security for the first time last year, and among organizations that had a breach involving AI models or applications, 97% said they lacked proper AI access controls. It also found that organizations with heavy "shadow AI," meaning AI tools employees use without the company's approval, paid about $670,000 more per breach on average. Verizon's 2026 report found that 67% of users were reaching AI services through personal accounts on work devices. In practice, that means customer lists, pricing, and contracts being pasted into tools under accounts the company can't see or control. I'd treat that as a reason to choose AI tools deliberately and give people approved business accounts, since banning AI tends to push it further out of sight.

What protection looks like for a small business

The encouraging part of all this is that the defenses that matter most are well understood and within reach of any company. Dimon himself, with the most advanced defensive AI available, has stressed that foundational security practices remain critical, and Verizon's Chris Novak has urged smaller businesses to focus on strong passwords, timely patching, and security awareness training.

It starts with knowing what you have. Make a simple inventory of the software, devices, and online accounts your business depends on, including the easily forgotten ones, like the security camera system, the remote access tool someone set up years ago, and the old server in the back room. Equifax's breach began with a system that slipped off the list.

It continues with a named owner for updates. One person, inside your company or at your IT provider, should be responsible for making sure patches get installed, with an agreed timeline for critical ones. This is also how the AI-powered security work happening at large companies reaches you. When those companies find and fix flaws in widely used software, the protection arrives on your systems as an update, and it only helps if someone installs it.

It includes two-step login, where you enter a password and then confirm with a code on your phone, turned on for email, banking, payroll, your CRM, and any AI tools. It's the cheapest meaningful protection available.

It requires backups you've actually tested, because a backup you've never restored is really just a hope, and ransomware is far less threatening when you can recover on your own.

And it depends on people who know to pause. AI is making fake invoices and urgent requests from "the boss" much more convincing, so a team that's been trained, and encouraged, to stop and verify anything unusual is one of the strongest defenses a small business has. Finally, write down who you'd call in an incident, including your IT provider, your bank, and your insurer, before you need them.

Where Avolis stands

We're an AI transformation firm, and we're not a cybersecurity company. For managed security and monitoring, you want a qualified IT or security provider, and we're glad to work alongside yours. Where we come in is the AI side of this picture, which has become a security question whether businesses planned for it or not.

When we help a company adopt AI, we choose the tools deliberately and explain why, so the team works in approved business accounts rather than a patchwork of personal ones. The workflows and agents we build get only the access each job requires. We train each role on how to use AI well, including what's safe to share and what should never leave the building, and we set clear rules for what AI handles on its own and what needs a person's approval. Every tool we introduce goes onto the inventory with an owner attached, so nothing we bring in becomes the forgotten system in someone else's breach report.

AI has made it cheaper to attack a small business, and it hasn't changed what keeps one safe: up-to-date systems, sensible access, and people who know what normal looks like and speak up when something seems off. If you'd like an honest look at where your team and your tools stand, a good place to start is our AI Readiness Evaluation.

Sources

Everyone’s Using AI. Almost Nobody’s Using It Well.Oct 28, 2026
The AI Rule Toyota Figured Out Decades AgoOct 21, 2026
The Six-Month Window Most Small Businesses Don’t Know They’re InOct 14, 2026
Your MSP and Your AI Partner: Who to Call for WhatOct 9, 2026
Nobody Will Promise Your AI Agent Will BehaveOct 7, 2026
What Your KPIs Can't See, and What an AI Readiness Evaluation Should Hand YouOct 5, 2026
The One AI Advantage Your Competitors Can't BuySep 29, 2026
The Service-as-Software Model Has a People ProblemSep 24, 2026
The Next Customer for Your Software Is an AI AgentSep 23, 2026
Your Next Coworker Is an AI Agent. Here's How to Onboard It Well.Sep 16, 2026

Ready to make AI work for you?

Book an AI readiness evaluation. If there’s nothing worth automating, we’ll tell you.

Start the conversation