Vertiance Insights.

If you run or lead a business today, you don’t need more scare stories. You need a quick, clear view of what’s actually changed — and where it hits revenue, operations, and reputation.

Here’s the headline: attackers are professionalized, identity and the browser are the new front doors, and your vendors are now part of your security whether you planned for it or not.

This is Part 1 of a short series. Here we’ll focus on the big shifts. Part 2 will cover what to do about them in a practical way.

1. Attackers aren’t “hacking in” — they’re logging in

Most attacks against small and mid-sized businesses now start with valid access: stolen passwords, hijacked browser sessions, or tricked employees.

AI has made phishing cleaner and more convincing. Malware steals browser cookies and tokens so attackers can “ride” existing logins and bypass MFA. Meanwhile, unvetted browser extensions and AI sidebars can see whatever your staff sees: email, CRM, HR, finance.

Once an attacker is inside as a “real” user, your firewall and old-school antivirus don’t help much. That makes identity, browsers, and approval workflows leadership issues, not just IT details.

What’s worth checking:

• MFA and single sign-on coverage for your core systems
• Which extensions and AI tools employees use with company accounts
• Whether large payments and access changes are approved only via email

2. Ransomware has turned into business extortion

Ransomware hasn’t faded; it’s evolved.

Many groups used to steal your data first, then encrypt what they can, then threaten to leak it to customers, competitors, or regulators. Recently there has been a shft towards skipping encryption and going straight to extortion.

For most SMBs, that means less “IT is down.” and more legal and insurance fallout. Paying the ransom doesn’t guarantee you get will not get exposed or that the data won’t be reused.

The real question for leadership is: if something happens, how bad is the damage to our reputation and how prepared are we?

Red flags:

• Key business systems all live on one flat network
• No clear, practiced plan for the first 24–72 hours of a major incident
• Backups exist but aren’t tested or kept separate from production

3. Your supply chain is now part of your security

More breaches now arrive through vendors than directly.

Your accounting platform, CRM, e-commerce or POS provider, logistics software, HR tools, and niche cloud apps often have deep access to your data and operations. If one of them is compromised, you may be exposed even if your own environment is reasonably well run.

We’ve seen attackers use compromised software updates or integrations to push malware to many customers at once. In those cases, the businesses hit didn’t do anything “wrong” locally — but they still took the impact.

That moves part of cyber risk into vendor management and contracts, not just firewalls and patching.

Questions to put to critical vendors:

• How do you protect and monitor access to our data and systems? Think security assurances like ISO 27001 certification or SOC 2 report.
• How and how fast will you notify us if you have an incident that affects us?
• How is access to our data segmented and logged on your side?

4. Shadow SaaS and “shadow AI” are creeping in

The next wave of risk isn’t big core systems; it’s all the little tools people quietly adopt to get work done.

Individual employees sign up for SaaS and AI tools with their work email, then connect them to email, file storage, CRM, or finance systems with “Sign in with Microsoft/Google” buttons. Over time, sensitive data spreads into places nobody is formally responsible for.

AI accelerates this: staff paste contracts, customer messages, and strategy docs into external tools to “get help,” often without thinking about where that data is going.

The answer isn’t banning modern tools. It’s deciding where your data is allowed to go and under what rules.

Where leaders should set simple guardrails:

• What types of data can’t be pasted into external AI tools
• Which SaaS tools are approved for customer, financial, or HR data
• Who must sign off before new apps get mailbox or file-storage access

5. Insurance and compliance are quietly raising the bar

Even if you don’t live in a heavily regulated space, you’re likely feeling pressure from insurers and larger customers.

Cyber insurers are tightening requirements for basics like MFA, modern endpoint protection, and tested backups or charging your bigger premiums. Bigger customers are folding security questions into vendor onboarding and renewals. Regulators and industry bodies are talking more directly about executive responsibility for cyber risk.

Security posture now affects:

• Whether you can obtain or afford cyber insurance
• Your ability to win and keep larger contracts
• How exposed you are if someone asks “What protections did you have?” after an incident

In short, security has moved from “IT hygiene” to a visible part of how ready your business looks to partners and the market.

Where to go from here

The real attack surface for SMBs has shifted away from just servers and firewalls to people, identities, browsers, cloud apps, and the vendors wired into your operations.

In Part 2, we’ll outline a practical roadmap for 10–500-employee companies: what “good enough” looks like, how to prioritize, and how to work with IT partners in a way that measurably reduces risk.

If you’d like to talk through what these trends mean for your organization specifically, contact Vertiance to schedule a conversation about your security posture and next steps.