AI Has Made Every Small Business a Hacker's Target

The small businesses that haven't been hacked yet haven't been lucky. They've been too low-value to be worth a professional attacker's time. That calculus changed when large language models made exploit development fast and cheap enough to apply at scale. The obscurity defense — "we're too small to target" — is no longer valid.

This post explains why, and what SMBs should do about it.

The Two-Stage Attack Pipeline

Modern targeted attacks against small businesses don't start with a human choosing a target. They start with a scan.

Tools like Shodan and Censys continuously index every internet-facing machine. At roughly 36,000 scans per second, the entire addressable IPv4 space gets fingerprinted multiple times a day.^[1] Every result records the server software, its version, the open ports, the CMS name, and the plugin list. This phase costs the attacker nothing but an API key.

Stage 2 is where AI enters. The scan results feed a scoring model. Each target gets rated on two axes:

1. Profitability signals — e-commerce indicators, domain age, linked payment processors, social profile references, estimated traffic
2. Exploitability signals — version fingerprints matched against known CVEs, exposed admin panels, headers revealing software identity, outdated plugin versions

High-score targets join an exploitation queue. An LLM receives the CVE descriptions for the target's known vulnerabilities and generates a working exploit chain. Research from the Ethical Hacking Institute found that LLMs produce exploit code 80% faster than manual coding and can generate OS-specific exploits with a 90% success rate.^[2] What used to require a professional researcher spending days on a single target now runs in minutes, automatically, across thousands of targets simultaneously.

In 2025, Darktrace captured a real-world intrusion where a fully AI-generated malware sample exploited CVE-2025-55182 (React2Shell). The entire chain — reconnaissance, exploit code, payload delivery — was machine-produced.^[3]

The Patching Window: 4 Hours Versus 14 Days

The timeline mismatch is severe.

When a new CVE is published, attacker infrastructure begins scanning for vulnerable targets within 4 hours of public disclosure. The average small business WordPress administrator takes 14 days to apply a critical security patch.^[4] That gap — a ten-day window of exposure, scanned at machine speed — is where most SMB compromises begin.

The scale of WordPress exposure makes this concrete. As of 2025, security databases track 64,782 known vulnerabilities across the WordPress plugin and theme ecosystem. In 2024 alone, 7,966 new vulnerabilities were disclosed — a 34% increase over 2023. Critically, 35% of those vulnerabilities remained unpatched in 2025. One in three known plugin flaws had no security update available at all. 92% of successful WordPress breaches originate from plugins and themes, not core software.^{[4] [5]}

A single popular plugin installed across 3 million sites represents 3 million potential entries into the exploitation queue the moment a CVE is published. The attacker doesn't choose — the scoring model does.

Ransomware Has Scaled Down

The economics of ransomware shifted in parallel. Attacking a small business used to require a professional's time: reconnaissance, custom exploit development, manual lateral movement. The expected payout from a company with €300,000 in annual revenue couldn't justify that labor cost.

That calculation no longer holds. AI-automated exploitation reduces the per-target cost to near zero. Ransomware-as-a-Service groups — which grew 50% year-over-year in 2025^[6] — now deploy automated pipelines across thousands of SMB targets simultaneously. The aggregate payout from many small ransoms exceeds what a single large enterprise would pay, with far less risk of triggering a coordinated incident response.

Modern ransomware operations also use double extortion: data is exfiltrated before encryption. A backup strategy doesn't protect against this. The attacker already has the data and is threatening to publish it. For SMBs in regulated industries — healthcare, legal, accounting — that threat carries regulatory liability on top of the ransom demand itself.

The numbers make the stakes clear: 43% of all cyberattacks now target SMBs,^[8] 88% of SMB breaches include ransomware,^[6] 75% of SMBs say they could not continue operating after a ransomware attack,^[6] and 60% close within six months.^[7]

What Small Businesses Should Actually Do

The goal is not to become unhackable. The goal is to not be in the top percentile of the scoring model.

1. Patch fast. The 14-day average patch cycle is dangerous. Configure automatic updates for WordPress core, plugins, and themes. If a plugin developer abandons a project and a CVE is published with no patch, remove that plugin the same day.
2. Suppress version fingerprints. Every Server: Apache/2.4.51 header in your HTTP responses is a free data point for the scoring model. Remove or generalize version strings from HTTP headers, HTML meta tags, and generator fields.
3. Remove unused plugins and themes. Every installed plugin is attack surface. An inactive plugin with a known CVE is just as exploitable as an active one. Delete what you don't use.
4. Restrict exposed admin panels. An accessible /wp-admin path with no additional controls is a signal. At minimum, apply IP allowlisting or a second authentication factor.
5. Inventory what you expose. You cannot reduce your score in the attacker's model if you don't know what you're exposing. Run a basic external scan against your own infrastructure — free tools will show you exactly what Shodan sees.

None of these require a dedicated security team. They require discipline and a 30-minute monthly review.

If you've audited your own attack surface recently, what did you find? Specifically: how many plugins on your production site have had no update in the last six months?

References

1. allaboutai.com — AI Cyberattack Statistics 2026
2. Ethical Hacking Institute — How Hackers Use LLMs to Generate OS-Specific Exploit Code
3. Darktrace — AI/LLM-Generated Malware Used to Exploit React2Shell
4. Patchstack — State of WordPress Security 2025
5. WP Security Ninja — WordPress Vulnerabilities Database 2026
6. programs.com — The Latest Small Business Ransomware Statistics (2026)
7. spacelift.io — 60 Small Business Cybersecurity Statistics to Know in 2026
8. alphacis.com — Small Business Cyberattacks 2026: Why SMBs Are #1 Targets