Incidents related to hackers and cybersecurity are becoming increasingly frequent. These cases involve the Port Authority of Santos, as well as major crypto exchanges like Binance and Mercado Bitcoin. Cyberattacks have intensified and become more common, often requiring only one hacker's involvement, which is largely linked to the progress of artificial intelligence (AI).
This is evidenced by the Cyber Pulse 2026 report from Acronis, published in early November. The document describes a case known as BOSSAI, where one individual used over ten AI models connected to tools to coordinate attacks against government systems in Taiwan, universities in Thailand, and financial institutions in Mexico.
It is noted that profound changes have occurred among both proponents and opponents of cybersecurity. This new landscape is particularly dramatic for small and medium-sized enterprises. Specialists from Olhar Digital discussed this 'new normal' scenario.
Carlo Til, an expert in technology and innovation, explained that AI is transforming the relationship between capability, scale, and resources in the digital environment. He specified that thanks to AI, small entities can achieve results that previously required significantly more resources. However, he emphasized that this capability is in the hands of malicious actors.
Leonardo La Rosa believes that the BOSSAI case demonstrates how AI allows one person to possess the operational reach of government-funded hacker groups. For Carlo Til, the most significant aspect of this case is the ability of one person to coordinate actions across different countries and sectors.
Gerald Caron, Chief Information Security Officer at Acronis, added the factor of speed. He stated that the main risks of the new reality are the speed and scale of attacks, as well as more convincing phishing campaigns and identity fraud (including deepfakes), and the lowering of entry barriers for attackers.
According to Caron, AI provides attackers with a tool for faster vulnerability detection, writing error-free phishing emails, automating tasks on a scale that would take a human much longer, and upskilling individuals with limited technical knowledge (e.g., for coding).
However, speaking about the defense side, Caron noted that much of these capabilities can be used positively: AI can accelerate threat detection, alert sorting, analysis of large volumes of logs, and automation of routine incident response tasks.
Til concluded that AI did not generate criminal intent but substantially expanded the possibilities for its execution. As a result, there is a change in scale that makes digital security a matter of much broader significance than just protecting large organizations.
La Rosa warns that the risk increases exponentially for small and medium-sized enterprises, as cybercriminals often target technology service providers. Caron emphasizes that SMEs are particularly vulnerable because they often lack dedicated security departments or sufficient budgets.
La Rosa explains that the compromise of one provider opens the door to infiltrating the networks of several SMEs simultaneously. He recounted a recent case involving a small company: the attack began unnoticed when an employee infected their computer with an infostealer designed to steal credentials and sessions. Using this initial access, criminals moved directly into the company's cloud environments, where they deliberately disabled protective tools and activity logs to create blind spots and avoid detection. This ultimately led to a complete halt of daily operations and a leak of confidential customer data.
This case, according to La Rosa, confirms that hacking one computer today is the first step toward a devastating chain attack. Another case described by the Acronis CISO also highlighted the risks of AI for small businesses. In a software vendor, an AI-based agent performed a routine task in a staging environment when it detected credential incompatibility. Instead of stopping, the agent independently decided to 'fix' the problem by deleting storage volume, which erased the entire production database and its volume-level backups in about nine seconds.
Caron specifically pointed out that there was no confirmation step, and no human was involved in verifying the action before it was executed. No instruction indicated that it should do so; the agent made the decision to execute itself. When the CEO asked why, the agent admitted it assumed the action would only affect the test environment, failed to verify this information, and carried out the destructive action without a request. Consequently, the company lost about three months of data and new customer records, and its commercial activity was suspended for approximately 30 hours until data recovery using the infrastructure provider. Caron noted that this was a consequence of the lack of additional controls, such as requiring human oversight to approve destructive actions. The agent had an access token with full permissions, and nothing required confirmation before deletion.
Carlo Til insists that the 'new normal' in cybersecurity requires 'special attention' from small and medium-sized companies. The problem lies in the combination of advanced attack capabilities and the growing dependence of businesses on digital services. Til identified three consequences. First—vulnerability due to third-party dependency. A company might have a well-structured business operation, but if an external provider managing systems or storing information encounters a problem, the client may also stop, even if they were not the initial target of the attack. Thus, an organization's security does not end at the boundaries of its own systems.
The second consequence—erosion of trust and reputation. A digital incident can expose customer information, disrupt service, and call into question the organization's ability to meet its obligations. In certain segments, trust is one of the main commercial assets. Recovery of operations may be relatively quick, but restoring brand trust is entirely different.
Finally, the third consequence—disparity in preparedness between companies. Large organizations usually have specialized teams, processes, and resources to manage technological risks. Small and medium-sized enterprises have to balance these decisions with other priorities such as growth, hiring, cash flow, and customer relations. Often, the risk only becomes visible after it has already had an impact. According to Til, the 'new normal' does not mean that all companies will eventually be targeted by a cyberattack. It means that 'the possibility of a technological incident has become part of the conditions under which any business operates,' partly due to AI.
