If you run a company of fifty people, you have probably seen a headline in recent weeks about governments warning of a wave of cyberattacks, and possibly one calling this month "Black October." You have probably also noticed that the documents behind those headlines are addressed to boards, critical infrastructure operators and government departments, not to you.
The advice inside them applies to you all the same. Here is what was actually said, what it means, and what a business without a security team can do about it in the next month.
What they are actually saying
Strip away the language about frontier models and the message from the June statement is simple. AI is making it faster and cheaper to find weaknesses in software and to turn them into working attacks. The time between a flaw becoming known and someone using it against you is shrinking, and the agencies expect it to keep shrinking. In their words, "cyber risk assumptions can become outdated in months, not years."
The industry numbers point the same way. Mandiant's annual report found that in 2025 the average time to exploit a vulnerability fell to an estimated minus seven days, meaning exploitation routinely began before a patch existed. Verizon's 2026 breach report found that exploiting a vulnerability is now the most common way attackers get in, ahead of stolen passwords. The same report found the median time for organizations to fully fix the most dangerous known flaws went up, to 43 days.
Put those two numbers side by side and the problem is plain. Attackers are moving faster than the fix exists. Defenders, on average, take six weeks.
What they are not saying
It would be easy to read all this as a story about AI super-weapons. The evidence does not support that, and it is worth being clear about it so the response is proportionate.
Microsoft's own report on the AI-driven campaign says most of the targeting failed. The October advisory about China-linked hackers does not mention AI at all, and the vulnerabilities it lists are years old. A vulnerability research firm, VulnCheck, found little evidence so far that flaws discovered by AI are exploited more often than any others. And "Black October" is a media label, not an official one.
So the message from the agencies is not that a new kind of attack has arrived that nothing can stop. It is that the old kinds of attack are getting faster, and the basics that stop them now have a deadline. As the June statement puts it, "These actions are not new, but are now urgent."
Why a 50-person company is in scope
Automated attacks do not choose targets by size. They scan for anything that responds, try the weaknesses they know, and keep whatever works. The October advisory noted that the hackers it described tend to look for the more vulnerable targets, which is not a description that favors small organizations.
Size also does not protect you from your suppliers. Verizon found a third party was involved in 55% of breaches at small and medium-sized businesses, and October's breaches at hosting platforms like Railway exposed customer keys that many businesses did not know were stored there. When the PHP flaws were announced, most small businesses could not patch them at all; their hosting provider had to.
The five actions, translated
The June statement lists five practical actions. Here is what each one means for a business with an IT provider rather than an IT department.
1. Reduce your attack surface. The statement asks organizations to "challenge whether systems need to be exposed at all." In practice: list everything of yours that can be reached from the internet. Your website and any old versions of it, remote access, email, customer portals, the admin page of your firewall, the NAS someone set up for file sharing. Anything that does not need to be on the internet should come off it. Every system you remove is one less you have to patch on a bad morning.
2. Patch faster. Measure patching in days, not months, for anything internet-facing. More importantly, know who patches what. You, your IT provider, your web host and each of your software vendors are responsible for different pieces, and the time to find out who owns your website's server is not the day a critical flaw is announced. Agree in advance what happens if a fix cannot be applied quickly; in October the official answer was to take the system offline.
3. Deal with legacy systems. "Unsupported systems are easy targets." That old server in the cupboard, the PCs still on Windows 10 (which stopped receiving free security updates in October 2025), the website running an end-of-life version of PHP, the firewall the manufacturer no longer updates. Each one needs a replacement date, and the oldest should be treated as urgent.
4. Strengthen identity and access. Multi-factor authentication on email, remote access and every administrator account, without exceptions for senior staff. Review who has administrator rights and remove what is not needed. Remove former employees' accounts the day they leave. And look at the third-party apps connected to your Microsoft 365 or Google Workspace: the campaign Microsoft described abused exactly those connections, including one belonging to a compromised supplier.
5. Prepare for incidents before they happen. The statement says plainly that breaches will occur. Know who you would call, and have the number somewhere that does not depend on your own systems working. Keep backups that an attacker cannot reach, and test that you can actually restore from them. Decide in advance what you would do if your website or email had to go offline for a day.
What not to do
Do not treat this as a buying decision. The agencies are not asking you to buy an AI-powered security product. Every action above is about knowing what you have and keeping it maintained, and most of it costs time rather than money.
Do not wait for a complete plan. The point of "months, not years" is that a partly finished inventory and MFA on the most important accounts this month is worth more than a perfect program next year.
Do not leave it with IT alone. The statement is addressed to boards because these are business decisions: which systems to retire, how much downtime is acceptable, which suppliers hold your data. In a 50-person company the board is usually the owner, and the owner has to make those calls.
A 30-day plan
Week 1: know what you have. List everything that faces the internet and, next to each item, who is responsible for patching it. Include the website, the host and every domain you own.
Week 2: lock down the accounts. Close every gap in multi-factor authentication. Review administrator accounts and connected third-party apps, and remove what is not needed.
Week 3: set dates for the old stuff. Put a replacement date on every unsupported system. Put spending limits and alerts on any AI or other paid API accounts, so a stolen key cannot run up an unlimited bill.
Week 4: rehearse. Walk through two scenarios with the people who would be involved: "a critical flaw is announced and our website must be patched or taken offline today," and "an administrator's account has been taken over." Test a restore from backup while you are at it.
The summary
The governments' warnings are less dramatic than the headlines make them sound and more relevant to small businesses than their audience suggests. Nothing in them requires new technology. They ask every organization to do the things it already knew it should do, quickly enough that the work is finished before the next php2shell rather than after it.
For a 50-person company, that comes down to four things: know what you have on the internet, know who patches it, protect the accounts that matter, and have a plan for the day something goes wrong. A month is enough to make real progress on all four.
Sources
- The AI shift in cyber risk: why leaders must act now — Five Eyes cyber security agencies, via the UK NCSC (full statement, PDF)
- Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data — FBI, CISA, NSA and partners, advisory AA26-281A
- Critical vulnerabilities in PHP require immediate patching — CISA
- Storm-0940 uses ARTEX agentic AI and a ConnectWise supply chain compromise — Microsoft Threat Intelligence
- M-Trends 2026 — Mandiant, Google Cloud
- 2026 Data Breach Investigations Report: executive summary — Verizon
- State of Exploitation 1H 2026 — VulnCheck
- Frontier AI — UK NCSC
