The new world of AI hacking risk

That the world of work has changed in a profound way is an uncontested view. When I read the news these days, I continually come across the term "AI fog". Meaning, we've reached a point in society where the impact of AI entering our workplace, our civilisation and our culture, has vastly reduced meaningful predictions of emerging trends by forecasters, researchers and business managers. Basically, nobody knows what's going to happen six months from today, let alone five years from today. And that is creating levels of global uncertainity. Business hates uncertainty. Executive teams cannot plan quarter-by-quarter when they can't see opportunities, threats and risk coming. So they stand still, and wait, to see what happens. But there is one group that isn't standing still waiting for the fog to clear; criminal hackers who are now enhancing their technical capabilities to break into websites using AI. In exactly the same way that AI has amplified the capacity of an individual to perform meaningful work, it has amplified the abilities of hackers to find and exploit vulnerabilities that are the literal holes in websites. Basically, it's much easier for less skilled individuals to find the unlocked backdoors of your digital assets for theft, ransom or reputation loss. Sometimes all three.

How is AI changing the hacking threat landscape

In the years before AI, hackers were a sophisticated technical class of computer operators. In order to break into websites they needed to have a broad domains of knowledge across operating systems, website frameworks, security tools and programming languages. The very best hackers could easily be the equivalent of a corporate technical CTO. But, targeting websites was much more an individual activity. It would take some work to scan a site, find the vulnerabilities and exploit them. The bigger the company, the larger the reward, but the more work it took to break in. I've attended some conferences with presentations that explained how multinational organisation hacks were done over a period of years. However, AI is changing hacking in the same way AI is changing general work; it's easier for less technical people to break into websites.

In the same way there are several implementations of AI large language models, there are several implementations of hacking-focused AI systems. WormGPT, FraudGPT, HexStrike AI, and BruteForceAI, are just a few that are being referenced in cybersecurity research articles I'm reading. The threat from these tools isn't necessarily enabling the best hackers to break into very secure systems, instead, it's putting tools into the hands non technical criminals to allow them to break into websites. Think of it this way, you've probably talked to a non technical friend who is using AI to vibe code up a hobby website for fun, or as a side gig to their main job. In exactly the same way, hacking AI systems enable non technical criminals to mass scan the internet for vulnerable sites and expoit them. No technical experience necessary. Minimal effort required. Point and click hacking.

How this increases SMEs hacking risk

The risk this poses for SMEs is particularly high because most SMEs simply are not aware of their website security. This is something I see personally. I'm a member of a professional networking group on the Gold Coast where I meet and talk to business owners across a range of domains and a variety of sizes. When the conversation turns to website security and are they doing something to manage their risk, the answers are generally always the same. My business is too small to be a target; my website isn't that important, it's only a digital business card; my IT vendor takes care of all that, I don't need to worry about it; noone is going to hack me, there's nothing on my site to steal. Bluntly put, none of these are true. Every site is a legitimate target, every site can found and added to a list for mass scanning, and while not every site has IP assets that can be stolen, every site is the brand of your business. A hacker doesn't need to steal anything to cause you damage, by locking up your site with ransomware or hijacking your website landing page and swapping out your hero image with porn, the reputation damage will definitely affect your business and your ability to leverage your business brand for income. What compounds the problem is that in the SME affordable space for solutions, the vulnerability testing options are slim. Big corporates, who are big targets, have big budgets for the best solutions and the best resources to operate them. SMEs can neither afford expensive solutions or have the expertise to operate the free opensource alternatives. Hence, it's easier for an SME owner to stick their head in the sand and say it won't happen to them.

Simple steps for real risk mitigation

As real as the threats are, the steps to mitigate the risks are relatively simple. SME websites are not big digital assets and do not require massively sophisticated tools at expensive prices to test for vulnerabilities. And, the vulnerabilities that are common in most websites are easily closed. These are the two most common high-level vulnerabilities that we see over and over again.

• Missing Strict-Transport-Security (HSTS) Header (There’s a small but real attack window. And, you are especially dangerous on public networks).
• Missing Content-Security-Policy Header (Without CSP, your website blindly trusts all content it loads, including anything an attacker manages to inject).

These are in present in pretty much every scan report we have. (Except ours, because we use our own service to test our service).

They are easily detected with testing, and with your own AI solution, they are relatively straightforward to fix. Closing those security holes significantly improves your overall site defense level.

Do yourself a favour and test your business website

Whether you choose to use our service to test your website for security vulnerabilities, or you choose another vendor or an opensource solution, just go and test your website. If you outsource your IT services to a vendor, contact them and ask them for a recent vulnerability scan of your website to show you - with report evidence - that your site does not contain high-risk vulnerabilities. A good hosting provider or tech team won't have any problem at all providing you an on-demand security vulnerability report. If they can't, or won't, for whatever reason, you have a problem, and you should seriously consider moving to a more reputable company.

Website testing is no more intimidating or difficult than getting a blood test organised with your doctor. Honestly, the analogy here holds up. Testing gets you ahead of problems. Being proactive is a lot easier than being reactive. Using Biz Secure Online to scan your website gets you report results in 15 minutes, including the time to register for a free account.

If there is one takeaway that I can leave you with, it's go and test your website. Don't wait, do it now.

Wrap-up

Please feel free to email us on support@bizsecure.online with real feedback or suggestions.