Photo by Towfiqu Barbhuiya on Unsplash
Training Your SMB Team to Look Out for AI-Generated Cyberattacks
AI has done a lot to speed up our work and help smaller businesses do more with less. But it’s a favorite tool of bad actors to speed up their own activities too, making it easier than ever for them to trick your team.
Deepfakes vs. phishing
IBM’s Cost of a Data Breach 2026 report shared that one in four attacks were AI-driven over the past year, up from one in six in 2025. Deepfake impersonations were the primary avenue attackers used (45%), but AI-generated phishing (19%) was often used as well.
What’s the difference? Phishing uses written means like emails or texts to trick someone into sending data, passwords or funds to an attacker, while deepfake impersonation uses technology to clone someone’s voice or face to make a request appear even more believable.
These deepfake attacks are so sophisticated that employees have a hard time determining they’re not real. In one 2024 incident, a financial employee sent $25 million to scammers acting as the firm’s CFO after they created a deepfake video that appeared to be a meeting of the company’s entire board to convince the employee to send the funds.
Think about the team in your own growing business. You’re probably a fairly close group who wouldn’t hesitate to help each other out of a jam. But that’s exactly what we want you to train them to do: hesitate.
4 tips for training your team
1) Teach them not to trust requests that seem at all unusual. Train your team to stop, think and ask questions when they get a request that’s even a little bit strange.
Is it normal for the CEO to call someone in accounts payable to ask for funds to be sent immediately? What about if they call the marketing coordinator to ask for 100 gift cards for an event? In an effort to please an executive, lower-level employees might rush to fulfill a request without considering if it’s real.
2) Make sure they know it’s not just OK but preferred if they ask questions. Never get upset if someone questions your legitimate request. Train your team to reach out to the “person” making the request in another way. If they get a call from someone pretending to be you with deepfake technology, make sure they know to confirm the request by hanging up and calling you directly. It’s better to delay your request than accidentally hand information or funds to an attacker.
3) Train them often. We get it — no one loves sitting through long in-person sessions or online learning, but it’s incredibly important. Cybersecurity training in particular can feel like a “gotcha” tactic to employees. But with frequent training, these topics stay top-of-mind for your team. A managed cybersecurity program can provide monthly training for your team to spot phishing and deepfake attempts by bad actors by keeping them up to date on the latest tactics.
4) Talk to your team personally. This is a tip you won’t see in every training guide, but we encourage leaders to get to know each person on their team better so they can play a strong role in preventing AI-enabled attacks.
Let your team know you expect them to follow your documented procedures every time and that you’ll never ask them to skirt the rules. When employees feel more comfortable with you, they’re more likely to follow the training, report suspicious requests and protect the business.
Let Corporate Technologies train and protect your SMB team
We know how stressful it is when you hear about a cyberattack on a small business. You probably worry how long it will be until it happens to yours.
The Corporate Technologies team has the expertise to not only train your team on best practices to avoid AI deepfakes and phishing but also to implement security measures that lessen the impact if an attack does occur. Reach out to us today to get a handle on AI cyberattacks before one gets to your business.