The rise of AI-driven cyber threats: what mid-market businesses should know

AI is becoming a powerful tool on both sides of the digital battlefield. While malicious actors are weaponising AI to bypass traditional security measures, ushering in a new era of risk for mid-market organisations, it can also be harnessed to strengthen defences and outsmart evolving threats.

2025 has already seen a wave of devastating cyberattacks across the UK, many of which were powered by AI. Marks & Spencer suffered a six-week operational shutdown following a ransomware breach initiated through an AI-enhanced phishing attack on a third-party IT contractor. In one notable case* criminals used AI-generated voice technology to impersonate a London-based executive, successfully convincing an employee to transfer thousands of pounds to a fraudulent account. And then there’s the emergence of ransomware strains like BlackMatter, an evolution of DarkSide that demonstrates how AI is being used to refine encryption strategies and evade endpoint detection systems. These intelligent attacks can identify high-value targets such as financial records or intellectual property, execute outside of business hours to avoid detection and spread rapidly across networks without human intervention.

But it’s important to understand that AI is not the root cause of these cyber breaches. It’s simply an amplifier. While it’s true that AI is increasing the speed, scale and sophistication of attacks, the vulnerabilities being exploited already exist. AI enables

threat actors to identify and exploit existing weaknesses more efficiently and human beings remain the weakest link in the chain. Some 98% of cyberattacks rely on social engineering according to the latest Verizon Data Breach Report.

It is more critical than ever that mid-market businesses have robust cyber resilience strategies in place.

Mid-Market, Maximum Risk: Why Cybercriminals are Zeroing in on SMEs The UK Government’s 2024 Cyber Security Breaches Survey found that 45% of medium sized businesses experienced cybercrime in the last 12 months, a rise from 26% in the previous year's survey.

The game has changed. Mid-market companies are no longer flying under the radar. They are now prime targets. Exposed and increasingly under attack.

And the reason for this shift? Because mid-market businesses are vulnerable. It only takes one bad day for criminals to succeed.

They hold valuable data but often lack the hardened defences, rapid response plans and recovery capabilities of larger enterprises. This makes them easy and profitable targets. With no clear path to threat detection, containment or recovery many mid-sized businesses are forced to pay the threat actor’s ransom.

To counteract this threat, I would recommend that mid-market firms adopt a proactive, multilayered defence strategy. This includes deploying AI-driven anomaly detection systems, partnering with managed security providers and enhancing employee education programmes to reduce insider risk. Zero Trust Architecture should be deployed to segment networks and enforce Least Privilege Access, significantly reducing the risk of breaches and lateral movement within the network.

With regulatory pressures mounting and the cost of breaches rising, cybersecurity must become a board-level priority for mid-market firms. Investing in scalable, intelligent defences and preparing for AI-enhanced threats is no longer optional, it’s essential for survival and growth.

Fighting Fire with Fire: Using AI to Defend Against AI-Driven Threats AI shouldn’t be viewed solely as a threat. It also offers significant opportunities for business advantage and defending against AI-driven attacks. When used effectively, AI can enhance security processes, streamline operations and drive greater efficiency and agility. It’s crucial that SMEs recognise this potential and actively harness AI as a force for good.

AI offers levels of speed, scale and intelligence that traditional cyber security methods can’t match. It enhances threat detection by analysing vast amounts of data in real time to spot anomalies in user behaviour, network traffic or system activity, enabling your team to focus on the right critical events. It can isolate affected systems or block

malicious actions before they cause damage. It strengthens email security by detecting sophisticated, AI-generated phishing attacks using natural language processing.

Often, it identifies threats that would otherwise go unnoticed.

Beyond detection and response, AI helps security teams prioritise risks by continuously learning from new threats, correlating intelligence across multiple sources and enforcing adaptive, behaviour-based defences.

As attackers use AI to evolve their tactics, businesses can and must leverage AI defensively to stay one step ahead. When aligned with human oversight and a solid cybersecurity strategy, AI becomes not just a line of defence, but a strategic advantage.

Not If, But When: Why Mid-Market Firms Must Prepare for Inevitable Cyberattacks With 45% of SMBs experiencing a cyberattack in the last year, it’s no longer a question of whether a business will encounter threat actors, it’s a question of when. No system is flawless and even the best defences can be breached. That’s why having a well-defined, thoroughly tested Cyber Incident Response Plan (CIRP) is now a critical component of cyber resilience.

Business cyber resilience is the ability to withstand, adapt to and rapidly recover from cyberattacks while continuing critical operations and the key to achieving it, is to plan and test. There’s no point waiting for a breach to happen, only to discover that your response plan includes a two week roll back.

This means going beyond simply having a disaster recovery document on file. It means having a written CIRP that covers the six important phases of preparation, identification, containment, eradication, recovery and lessons learned. And the most important step? Regular testing. Testing of backup systems, attack simulation scenarios, recovery processes and validation My advice? Test, test again and then test under pressure. A tested plan not only reduces the impact of a breach but also builds confidence among stakeholders, regulators and customers that the business can withstand and recover from even the most sophisticated cyber threats.

The threat landscape is evolving so what works today, may not work tomorrow. Plan and test regularly to reveal flaws in your plan and to ensure a level of business cyber resilience that will keep data protected and the business thriving. *[ The New Cyber Threat: How AI is Fueling Attacks on UK Businesses | 4th Platform]