The cybersecurity agencies of the UK, US, Australia, Canada and New Zealand — the Five Eyes alliance — issued a joint statement this summer warning that frontier AI models are advancing fast enough to “fundamentally transform both offensive and defensive cyber capabilities”, and putting a timeline on it: months, not years. That’s an unusually blunt call from agencies that tend to speak in careful, hedged language. It followed the NCSC’s own figures showing a 38% year-on-year rise in reported UK cyber incidents, with AI now estimated to play a role in around 60% of the more sophisticated ones.

For a UK small business owner, this can read as background noise — big-picture geopolitics for GCHQ and the Pentagon to worry about, not something that changes what you do on a Tuesday morning. That reading is wrong, and the evidence for why is already sitting in incident reports.

What “AI-accelerated” actually looks like day to day

This isn’t really about killer AI hacking tools breaking into networks unaided. It’s about AI collapsing the cost and skill needed for attacks that already worked. A Birmingham engineering firm lost £340,000 earlier this year after a phone call that convincingly replicated their managing director’s voice, right down to speech patterns — a deepfake fraud call, not a sophisticated network intrusion. Automated tools now let attackers scan for and exploit known software vulnerabilities at a scale that used to require a team; phishing emails generated by AI are harder to spot because the grammar, tone and context are no longer the tell they used to be.

None of this requires your business to be a high-value target in the traditional sense. It requires an attacker to be able to run more attempts, more convincingly, more cheaply — and small businesses, with fewer checks and less time to double-check anything, are exactly where that volume shift bites hardest.

The defences that still work

The uncomfortable truth in the NCSC’s own advice is that the fix hasn’t fundamentally changed — it’s just more urgent. Multi-factor authentication, prompt patching, and staff who know to verify anything unusual through a second channel remain the most effective defences available, AI-accelerated attack or not. What has changed is that “we’ll get to it eventually” is a riskier strategy than it was a year ago, because the gap between a vulnerability being known and being exploited at scale keeps shrinking.

One habit worth adopting immediately: for any request involving money, credentials, or access — even one that sounds exactly like your MD, your bank, or a long-standing supplier — verify it through a separate, already-known channel before acting. A callback to a number you already have on file defeats a voice clone that a moment of trust wouldn’t.

Ongoing monitoring is the other half of the answer, and it’s where most small businesses have the least visibility. Services like KeepSafe exist precisely to give smaller organisations the kind of continuous incident monitoring that larger firms build in-house, so that if something does get through, you find out from your own systems rather than from a customer, a supplier, or the news.

Don’t let the warning become an excuse to freeze

There’s a temptation, when the language coming out of national security agencies gets this stark, to treat cybersecurity as a problem too large and too fast-moving for a small business to meaningfully act on. That reaction is exactly backwards. The Five Eyes statement isn’t describing a new category of unstoppable attack — it’s describing the same fraud and intrusion techniques UK businesses already face, arriving faster and in greater volume. Firms exploring how to use AI defensively, from automated log review to smarter anomaly detection, are the ones turning this shift to their advantage rather than just absorbing it — and it’s an area where a partner like ApplyAI can help an SME work out where AI-assisted defence is actually worth the investment, rather than adding tools for their own sake.

The takeaway

The Five Eyes statement is a rare moment of governments speaking plainly about how fast the ground is shifting. It doesn’t require you to become a cybersecurity expert overnight — it requires you to make sure the basics (MFA, patching, verification habits, and someone actually watching for trouble) are properly in place now, while “AI-accelerated” still mostly means faster versions of familiar scams, and before it means something harder to catch.