For years, many small businesses and nonprofits have operated on an assumption that provided quiet comfort: that their systems are too small, too obscure, or too unremarkable to attract serious attention from attackers. If you run a charity with a modest website and a shared folder of documents, the thinking goes, why would anyone bother?

That assumption is now out of date. And the reason is AI.

The concept has a formal name in security circles: security through obscurity. It refers to any approach where the defence depends on a potential attacker not knowing how a system works, not being able to find it, or not considering it worth the effort. It has never been considered best practice by security professionals, but in practice many organisations — especially smaller ones — have implicitly relied on it. The combination of limited resources and a low public profile felt like a reasonable substitute for more formal controls.

The economics have changed

AI has changed the economics of attacks. The tools now available to cybercriminals — many of them built on the same underlying technologies as legitimate AI systems — can scan networks, probe endpoints, enumerate subdomains, and identify software vulnerabilities at a scale and speed that was previously impossible without significant resources. What used to require a skilled attacker spending hours on reconnaissance can now be done in minutes, at negligible cost, across thousands of targets simultaneously.

The conversation going on in security circles right now is precisely this: the death of obscurity as a practical defence. Not because obscurity was ever a sound strategy, but because even the marginal benefit it once provided has been stripped away.

What this means for smaller organisations

For a small business or charity, this has concrete implications.

If your website is running an outdated version of a content management system, AI-assisted scanning tools will find it. If your email server is misconfigured, it will be discovered. If you have a login page with default credentials, somewhere, someone has already tried them. The fact that you have fifty employees instead of five thousand does not change your exposure — in many respects, it increases it, because smaller organisations typically have fewer controls in place.

The answer is not to panic, but it is to stop treating invisibility as a plan.

The basics still apply — they just matter more now

The fundamentals of good security practice have not changed. Keep software up to date. Use strong, unique passwords and a password manager. Enable multi-factor authentication wherever you can, particularly on email and financial systems. Know what systems and services you are actually running, and review them periodically. Make sure your team understands the basics of phishing and social engineering, because the human element remains the most common entry point.

What has changed is the urgency. These are no longer best practices for organisations with significant IT budgets. They are baseline requirements for anyone operating online, regardless of size.

Start with what you already have

One area worth reviewing specifically is your web presence. Many small businesses have accumulated a collection of plugins, integrations, and third-party services over time — added for convenience and rarely reviewed thereafter. Each one is a potential entry point. A periodic review of what is actually running on your website, and whether you still need it, is a straightforward and inexpensive step that most organisations skip.

The same applies to cloud services and software subscriptions. Accounts left open for former employees, integrations that are no longer in use, and services granted access they no longer need are all common vulnerabilities that do not require sophisticated AI to exploit.

AI has not invented new attack categories. What it has done is democratise the capability to carry them out at scale. The protection that came from being small and unremarkable has gone. The organisations that adapt will be the ones that stop relying on luck and start treating basic security hygiene as a routine operational matter rather than something to address after an incident.

If you are unsure where your organisation stands, an IT health check is a reasonable starting point. It will give you a clear picture of your current exposure without requiring you to become a security expert overnight.

https://www.in-the-sky-it.com