AI: a Double-Edged Sword for Cybersecurity

Issue #9: 10 December 2025

Artificial Intelligence (AI) is transforming the world of cybersecurity at high speed, for better and for worse. For small and medium-sized enterprises (SMEs) outside the IT sector, AI offers opportunities to detect and fend off cyber threats faster and smarter. At the same time, cybercriminals are deploying AI as a weapon to make attacks more convincing and more dangerous than ever. In this article we look at how AI is currently used for cyber defence, how attackers abuse AI (with examples of recent AI-driven attacks), and above all which practical steps a non-technical SME can take to embrace AI safely. We specifically zoom in on the Belgian situation: what does this mean for SMEs here?

Finally we explain why this subject is so important for SMEs in 2025.

AI as defender: how AI strengthens cyber defence

AI and machine learning have become essential allies in cybersecurity. Where traditional security often depended on pre-known signatures or manually set rules, AI can offer a much more proactive, smart approach. Some ways AI is helping defenders today:

• Anomaly and behaviour analysis: machine learning is used for User and Entity Behavior Analytics (UEBA), learning what normal user and device behaviour looks like and detecting deviations. For example, if an employee suddenly downloads large amounts of data at night or signs in from an unknown location, AI can flag this as suspicious. Such behavioural detection helps not only with external attacks, but also with tracking down insider threats or hacked accounts.
• Fewer false alarms: because AI is self-learning, it can adapt to reduce false positives. Traditional systems regularly throw out unjustified warnings (giving IT responsible parties "alarm fatigue" and causing real threats to be missed). AI models refine themselves based on feedback, so they get better and better at distinguishing genuinely dangerous from innocent deviant behaviour. This raises detection accuracy.
• Automated incident response: AI makes it possible not only to detect faster, but also to respond automatically to threats. Modern security platforms use AI-driven SOAR (Security Orchestration, Automation and Response) to take action immediately on an alert: isolating infected devices from the network, quarantining suspicious emails, temporarily blocking accounts, and so on. All of this can happen in real time, without a person intervening, so a potential attack is nipped in the bud before there is any damage.
• Predictive analysis: based on historical attack patterns and current threat information, AI can even predict where the next risks lie. For example, by analysing trends on the dark web or hacker forums, AI systems can warn earlier about emerging attack methods. That way organisations can proactively take measures (patching, config updates) before a new exploit is used against them.

With these capabilities AI adds an extra layer of intelligence to security that was previously impossible. Many modern security tools companies use today, from antivirus to firewall, therefore contain AI components under the hood.

Still, it is not all sunshine and roses: AI systems are only as good as the data they are trained on. They can adopt biases or be misled by so-called adversarial examples (deliberately distorted input to fool AI). And the complexity of AI also brings challenges in transparency: sometimes it is not clear to a human why the model labels something as a threat or not. We come back to that later with GDPR and regulation. But the fact is: for defenders, AI has proven a powerful lever to spot malicious activity faster and better on an increasingly busy digital highway.

"AI systems are only as good as the data they are trained on"

AI as a weapon: how cybercriminals abuse AI

Unfortunately, every sword has two edges. The same AI techniques that help us defend are also deployed by adversaries. Cybercriminals see AI as an opportunity to level up their attacks: they can reach more victims with less effort, and make their tricks more credible. Here we look at the main ways attackers use AI:

Deepfakes and AI imitation: the rise of fake voices and images

One of the most talked-about threats is deepfakes: hyperrealistic fake videos or audio, created with AI. With this technology criminals can imitate someone's face and voice as if that person says or does something, when they do not. This is increasingly used for fraud: think of scammers who clone the voice of a CEO or business owner and call or video-call employees with an urgent payment request.

Damage of deepfake scams (2025)

$200 mln
Estimated worldwide loss from CEO deepfake fraud in the first half of 2025

Smart phishing: credible mails at scale

We all know phishing emails, those misleading messages trying to make you click or give up sensitive information. They used to be often amateurishly written, full of language and spelling errors. Exactly those errors were handy recognition points. Generative AI has changed that game: with tools like ChatGPT, scammers can now produce perfect, flawless messages in any language. The classic red flags (odd language use, bad grammar) disappear. As a result, phishing mails become much harder to distinguish from real communication.

Better still, AI makes it possible to personalise phishing. Cybercriminals can gather public information about a target (for example via LinkedIn, social media, press releases) and feed it to an AI to write a highly credible spear-phishing email that truly matches the recipient. For example a mail in your boss's name referring to a current project you are working on, including the same writing style as your boss, complete with correct form of address and not a single typo. Even trained users struggle to recognise that as phishing.

The impact is clear: more people fall for it. Since the general availability of ChatGPT at the end of 2022, the volume of phishing attacks has exploded. A security report noted a +1265% increase in malicious phishing emails within the year after. The number of Business Email Compromise (BEC) cases, fraud via fake business emails posing as colleagues or management, also increased nearly tenfold. Attackers have even launched specialised "AI-malicious" tools such as WormGPT and FraudGPT, which have no ethical restrictions and are made purely to generate phishing and malware texts. So it is no longer necessary to write a convincing scam message yourself: you type in a few keywords ("pretend you are the CFO and ask for a transfer") and the AI spits out a professional-looking email.

Phishing emails

+1265%
Increase in malicious phishing messages since Q4 2022

(through the use of generative AI)

AI-generated malware: self-learning viruses and polymorphic attacks

A third domain where attackers are exploring AI is automatically generating or adapting malware. The idea: instead of a human writing a computer virus or trojan, you let an AI model create malicious code. Generative AI can moreover tweak malware slightly each time, so-called polymorphic malware, so every copy is different and traditional antivirus detection becomes much harder.

Imagine a hacker wants to create a series of new virus variants that steal passwords from web browsers. With AI that hacker can feed the model hundreds of examples of existing malware code and then ask: "Give me 10 new variants that do roughly the same, but encode them slightly differently". The AI can then for example vary the encryption method, the way it hides in the system, shuffle function names and so on: all functionally similar, but unique under the hood. As a result, simple virus scanners, which rely on recognising known pieces of code, will miss many of them. Researchers warn that a smart AI model could spit out thousands of malware variants at lightning speed this way, with minimal extra effort for the attacker.

So far many of these AI malware experiments were still prototypes or proofs-of-concept. Early 2024 a research team showed that the first generations of "AI malware" often still stumbled and in many cases were fortunately still easy to detect with good security software. But developments continue: in an interview, Palo Alto Networks experts confirmed they succeeded in having an AI model write malware code for multiple platforms, and that later versions of that code were advanced and unsettling. A particularly worrying finding was that the AI was even able to imitate the style of known malware families, to mislead researchers about the origin. Think of a virus that looks (in code pattern) as if it comes from a certain hacker group, while it was actually made by someone else with AI: that makes attribution of attacks even harder (false flags can be planted with AI).

Although AI-generated malware does not appear to be circulating massively in the wild yet, the trend is set: attackers are going to use AI to develop their malicious software faster and make it more elusive. It could for example involve AI that automatically searches for vulnerabilities in systems, something that normally takes a lot of manual research but which a smart model could speed up. Or AI that adapts during an attack to countermeasures: imagine a virus noticing it is being detected, an AI component could then change its technique on the fly to stay under the radar.

Why this matters for SMEs

Finally: why should an entrepreneur who does not run an IT company worry about AI and cybersecurity? There are already so many fires to put out in an SME. Yet in 2025 this subject is crucial to take seriously, for several reasons:

• AI changes the threat landscape at lightning speed. Where SMEs used to think "ah, we are not that interesting for hackers", that is outdated. Cybercrime has become Big Business, internationally organised. With AI, attackers can automatically identify weak targets and scale up attacks without much effort.
• SMEs are often more vulnerable due to limited resources. Large enterprises invest heavily in cybersecurity (dedicated teams, expensive systems). SMEs often have a small IT department or external IT company focused on operations (keeping everything running), with security as an afterthought. Attackers know that. They see SMEs as "easy prey" or even as a springboard towards larger partners. More than half of significant data breaches in 2024 hit an SME. In Flanders nearly 1 in 10 SMEs reported being the victim of a successful cyber attack in 2023. Those figures rise every year.
• The impact of a cyber incident is often even heavier for an SME. A large company can sometimes still absorb a blow of 100k or even 1 million; for an SME such an amount can jeopardise continuity. Ransomware that encrypts all your systems means days or weeks of not being able to work normally: very costly for large companies, but potentially fatal for a small one.
• Customers and regulation raise the bar. More and more often, large clients demand that their suppliers (often SMEs) have certain security measures in place. Think of ISO27001 certification, or at least filling in a questionnaire about your security before you get a contract. This is directly related to NIS2: large companies must secure their entire chain and therefore also look at you, the smaller suppliers.

Conclusion

AI is a double-edged sword. For SMEs the point is to aim the cutting edge at the attackers by deploying AI-driven defence themselves, while blunting the sharp edge of attackers through awareness and precaution. The technology available now (often included in tools you already have) gives SMEs the ability to defend themselves at a level once reserved for big players. By proactively investing in these resources and preparing your organisation with training and policy, cybersecurity becomes not a burden but a strength. Your company becomes more resilient, more reliable and more future-proof in an era where digital threats and innovations go hand in hand.

Feel free to contact us or your IT partner if you want to discuss how your specific SME can take steps here.

PS: You do not have to do everything yourself; there are user-friendly solutions and experts who can assist you. The most important thing is to adopt the mindset now that safe digital working is just as essential as good bookkeeping or insurance.