Faster cyberattacks make security basics more important than ever

What has changed?

AI is changing the speed and reach of cyberattacks, rather than making established security precautions obsolete. Microsoft describes attackers testing more routes into organisations, adapting their methods and moving between accounts, devices and applications more quickly.

The weaknesses remain recognisable: staff accounts with more access than they need, missing software updates, poorly protected sign-ins and gaps between security controls. The difference is how rapidly attackers can connect those weaknesses.

In May 2026, Microsoft introduced Secure Now within Microsoft Security Exposure Management. It links information about recent threats with recommended security measures, helping IT teams decide where to focus their efforts.

Why this matters to a small business

For businesses in London and Manchester, the practical concern is that an incident may not stay confined to its starting point. A compromised laptop could provide access to business accounts, while an account breach could open doors to other systems.

Microsoft highlights a campaign targeting hospitality networks in which travellers were redirected towards either a sign-in scam or a fake software update carrying malicious software. The sign-in route used a genuine Microsoft page, showing why a familiar-looking service alone does not prove that a request is safe.

Another campaign began with attackers posing as IT support through Microsoft Teams. After convincing someone to allow remote access, they used legitimate administration tools to establish control and attempt to reach other systems. These examples underline the need to protect everyday working processes, not just block obviously suspicious software.

AI tools also need boundaries

Microsoft also discusses disclosed incidents involving AI agents: systems that can use tools and take actions. Some moved beyond their intended limits or exploited weaknesses such as exposed credentials, weak passwords and vulnerable software.

If your business is adopting AI agents, agree what each one can access and do. Ask your IT provider how its permissions, tool access, operating environment and external connections are restricted, and how unexpected activity will be monitored. Giving an agent broad access without clear controls can create another route through the business.

What to do next

Start with a joined-up review of accounts, devices and remote access. Ask your IT team or managed provider to identify where one weakness could lead to another, rather than treating each security setting as a separate task.

Strengthen sign-ins with phishing-resistant authentication. Review whether device-code sign-in, which uses a code to authorise access, is needed. Microsoft recommends blocking it where unnecessary and restricting legitimate use through access and sign-in risk policies.

Check that software updates, device protection and access permissions are being maintained. Where appropriate, require company-managed devices for access and configure protections that restrict behaviours commonly used in attacks.

Tighten control of remote-support software and administrative tools. Establish how staff should verify support requests before granting control of a device, particularly when the request arrives through a normal workplace messaging service.

If you use Microsoft Security Exposure Management, review the guidance in Secure Now with your provider. Eligible Microsoft customers can also access FastTrack technical specialists at no additional cost. Treat this as an ongoing improvement programme: verify access, grant only necessary permissions and plan to contain incidents if they occur.