Cybersecurity Insight

AI Cyberattacks: The New Reality Facing South African Small Businesses

For years, the advice on phishing was simple: look for the bad grammar, the strange sender address, the too-good-to-be-true offer. That advice is now out of date. AI has entered the picture on the attacker's side, and it's changing the maths of cybercrime faster than most small businesses can keep up with.

The phishing email you can no longer spot

Attackers have handed the writing over to AI, and it shows in the numbers.

• 82.6% of phishing emails now contain AI-generated content.
• AI-written phishing emails get clicked 54% of the time, versus just 12% for traditional, human-written phishing — over 4x more effective.
• Of the people who click an AI-generated phishing email, over a third go on to enter their credentials.
• 46% of SMBs report encountering AI-generated phishing in just the past 12 months.

What changed isn't the scam, it's the polish. AI can now write in a colleague's tone, reference a real project, and time a message to a real invoice cycle — all without the giveaways staff were trained to spot.

Deepfakes: hearing "the boss" isn't proof anymore

Text isn't the only thing AI can fake convincingly. Voice cloning and deepfake video are now cheap and fast enough for everyday scams, not just Hollywood. Locally, the picture is sobering:

• 63% of South African employees say they'd likely fail to recognise a deepfake attack at work.
• 86% now find AI-generated voice and video so realistic they struggle to trust what they see or hear at all.
• Voice-based phishing (vishing) has surged 442% in the past year.

"Attackers are moving at machine speed, using attacks such as deepfakes to target employees." — Anna Collard, CISO Advisor, KnowBe4 Africa

In practice, that means a phone call that sounds exactly like your MD asking for an urgent payment can no longer be trusted just because it sounds right.

Why small businesses are the ones paying for it

It's tempting to assume this is a big-corporate problem. It isn't.

• SMBs are targeted roughly four times more often than large enterprises.
• Around 1 in 4 SMBs have been breached in the past year — despite most already having some security tools in place.
• Ransomware is behind 88% of SMB breach incidents.
• Most breached SMBs report losses of R160,000–R1.6 million; 40% say a breach in that range would be enough to force them to close.
• Only around 1 in 10 SMBs have adopted AI-aware defences, with cost cited as the main barrier.

That gap — sophisticated, fast-moving attacks against under-defended small businesses — is exactly where the risk is concentrated right now.

What actually helps

The good news is that the fundamentals still work, they just need to be applied with the assumption that "it looked and sounded legitimate" is no longer good enough on its own:

• Verify out-of-band. Confirm anything involving money, credentials, or urgent requests through a separate channel — a callback to a known number, not a reply to the message itself.
• Turn on MFA everywhere. Most of these attacks are trying to steal a password, not break through a firewall.
• Keep systems patched. Outdated software remains one of the easiest doors in.
• Back up properly — and test the restore. A backup you've never restored from isn't a real backup.
• Train staff regularly. "Spot the bad grammar" no longer covers it — teach the current tactics instead.

Most SMBs don't have the in-house capacity to track this shift on their own — and they shouldn't have to. That's exactly the gap outsourced IT and cybersecurity support is meant to close: someone watching this so you don't have to.