# A widening cyber-security gap between big and small firms

Small firms can't scale their defences to match AI-powered attacks

Problem 0009 · Enterprise AI · Theme: Capacity · What it would take: A side project · Scope: Global · Editorial grade: Critical · Framed 21 September 2026 · Updated 28 September 2026 · Framed from public reporting

AI has made cyber attacks cheap to run and easy to scale. Large firms can answer in kind: they have security teams, budgets and tools, and they can grow each as the threat grows. Small businesses cannot. Their systems are often set up and looked after by outside suppliers, their defences are seldom tested, and a break-in is often found by someone else. So the same change raises the risk for big and small firms alike but the defence only for the large, and the gap between big and small firms widens. What is missing is defence that scales the way attacks now do: priced for a small firm, and able to run without a security team.

## Who lives with it

Owners of small businesses without a security team · the IT and web suppliers that set up and look after their systems · customers whose data is taken in a break-in · the banks and insurers that carry the losses

## Why now

An ENISA survey of small and medium enterprises, carried out during the pandemic, found that around nine in ten expected serious harm to their business within a week of a cyber incident and that over half believed it would likely end the business, against a backdrop of low security budgets and a lack of in-house cyber skills. BleepingComputer reported on 23 September 2026 that the security firm Gambit traced one operator who used open-source AI agents to breach at least 27 companies in five days and take more than 600,000 card records, at an average of $25.46 per completed scan. The UK government's Cyber Security Breaches Survey, published in April 2026, shows the defending side split by size: 76% of large businesses had a formal plan for handling an attack, against 21% of micro businesses

## Why it matters

An existential risk to the firms that make up the overwhelming majority of businesses, where the binding constraint is operator time rather than money or intent. Security that needs nobody to watch it is a different product from the one being sold. Security products assume someone to run them: alerts to sort, tests to commission, fixes to make. Small firms buy what their IT or web supplier offers, and many already pay one for security. A small team could start with one case where the stakes are clear, such as small online shops whose checkouts draw card thieves: constant, automated checks of the site, priced for a small firm and sold through the suppliers that already look after it.

## From public reporting

- [SMEs Cybersecurity](https://www.enisa.europa.eu/topics/awareness-and-cyber-hygiene/smes-cybersecurity), ENISA (European Union Agency for Cybersecurity)

## Cite it

“Small firms can't scale their defences to match AI-powered attacks.” Ainna Problem Radar, problem 0009, 21 September 2026. https://ainna.ai/problems/small-firms-face-enterprise-attacks-without-a-security-team

---
Page: https://ainna.ai/problems/small-firms-face-enterprise-attacks-without-a-security-team · The whole Index as Markdown: https://ainna.ai/problems.md