Five years ago, a good attack took craft. Someone studied your organisation, wrote a convincing email and called the right person. That took time and effort, which put a natural brake on how many attacks could run at once.
That brake is gone.
With AI, attackers can personalise at scale. A single criminal can now produce in an afternoon what once took a team: convincing phishing that uses your internal language and names your suppliers and open invoices, a cloned voice of your CFO asking for an urgent payment, and vulnerabilities found and exploited faster than your patch cycle can keep up with.
What This Means for the Boardroom
The attack methods have not changed much. The speed and volume have. What used to be an incident at one organisation is now an automated campaign against thousands at once. And attackers do not wait for your next quarterly review.
That is why this is not an IT question. The question that belongs on the board's table is not "do we have an AI tool for phishing?", but:
- Do we know where we are exposed? If you have not mapped which systems, suppliers and processes are critical, you cannot set priorities. Attacks tend to land exactly where you did not expect them.
- How fast can we act? An attack that plays out in hours will not wait for a decision process that takes weeks.
- Who decides, and on what evidence? Without current, reliable evidence, decisions are made on gut feeling. That was always risky. Now it is dangerous.
Many of these entry points are the same weak spots we described in Threats 3: invisible weak spots. AI does not create them, it simply finds and uses them faster.
What You Can Do Today
Do not treat AI as another product on the backlog. Treat it as a change in your assumptions about how fast an attack can unfold. Then ask your security team for one thing: show us where we are most exposed right now, not where we want to be in six months. Regular security testing gives you that picture based on evidence rather than assumptions.
Attacks have become faster. Your insight into your own exposure has to keep pace.
Some of that exposure is easy to miss, because it sits inside your own organisation. You might want to read this too: Shadow AI: the risk that is not in your IT inventory