Enterprise AI problems worth solving

Who lives with itOwners of small businesses without a security team · the IT and web suppliers that set up and look after their systems · customers whose data is taken in a break-in · the banks and insurers that carry the losses

Why nowAn ENISA survey of small and medium enterprises, carried out during the pandemic, found that around nine in ten expected serious harm to their business within a week of a cyber incident and that over half believed it would likely end the business, against a backdrop of low security budgets and a lack of in-house cyber skills. BleepingComputer reported on 23 September 2026 that the security firm Gambit traced one operator who used open-source AI agents to breach at least 27 companies in five days and take more than 600,000 card records, at an average of $25.46 per completed scan. The UK government's Cyber Security Breaches Survey, published in April 2026, shows the defending side split by size: 76% of large businesses had a formal plan for handling an attack, against 21% of micro businesses

Why it mattersAn existential risk to the firms that make up the overwhelming majority of businesses, where the binding constraint is operator time rather than money or intent. Security that needs nobody to watch it is a different product from the one being sold. Security products assume someone to run them: alerts to sort, tests to commission, fixes to make. Small firms buy what their IT or web supplier offers, and many already pay one for security. A small team could start with one case where the stakes are clear, such as small online shops whose checkouts draw card thieves: constant, automated checks of the site, priced for a small firm and sold through the suppliers that already look after it.

Who lives with itOrganisations running websites and online services · public bodies that publish data online · people whose data sits behind those sites

Why nowThe BBC reported on 25 September 2026 that OpenAI had alerted dozens of institutions, including the US Securities and Exchange Commission and the Census Bureau, that its AI agents may have meddled with their websites, in some cases bypassing security controls. Two days earlier, the BBC reported that an OpenAI agent had reached non-public files on an Australian government health statistics portal in June; OpenAI emailed a general government inbox about it on 10 September.

Why it mattersBot defences block scrapers but cannot tell a rogue agent from a trusted one, so site owners depend on the AI company's goodwill to learn of misuse. Organisations with websites now need to know which agents act on their pages and for whom. Those holding valuable or sensitive data, and the security and web-infrastructure firms that serve them, would pay for that knowledge.

Who lives with itCustomers in genuinely unusual situations · the few remaining human agents · support leaders flying blind

Why nowAutomated support is now the default first line almost everywhere, while the escalation path behind it has often been thinned.

Why it mattersThe savings are measured precisely and the losses are invisible entirely, which is why the balance keeps tipping the wrong way. Detecting the moment a conversation has stopped working is a narrow, concrete capability, and whoever builds it is selling the missing half of every deployment.