The newest AI has learned the security work small businesses could never afford: it reads your systems the way a patient burglar would, tests which weaknesses are real, and drafts the repair in plain language. Finding, proving, and fixing used to take three different specialists. This week's Scale with AI episode explains how the workflow works, why the builders handed it to defenders first, and the two patterns careful owners are already running with it.
The Shift
One workflow now does the whole job: find the hole, prove it can actually be used, draft the fix. In a 2026 survey of small and midsize business owners and security leaders across North America, three in four ranked cyber attacks as the threat most likely to hurt their business this year, ahead of inflation and recession. Most owners still handle security themselves, only about a third scan their systems regularly, and four in ten said an attack costing one hundred thousand dollars or less could put them out of business. Attackers have always been able to rent this kind of capability. Now the defense can too, at a fraction of a human security team's cost — for the owners who actually put it to work.
The Law
Tuesday is election day, so the rules, as they stand: a request to loosen the rules on political calls made with AI voices is still just a request — it has not been granted, and the law today is unchanged. An AI voice counts as an artificial voice; calls using one to a cell phone require consent first. Any AI caller for your business must honestly identify itself, honor an opt-out immediately, and call only in legal hours. Here in Washington, recording a call requires everyone's consent. And one rule for your team this week: a familiar voice is not proof of anything. Verify any urgent request for money, a password, or a bank change on a number you already trust, never the number that just called you.
Who's Doing It
Two patterns keep showing up. First, find and fix, pointed at yourself: the AI examines your own public systems — website, booking page, customer portal — reports weak spots in plain language, drafts the fixes, and a human approves each change before it goes live. Holes that sat open for months close in days. Second, the checker rule: new safety research shows AI can absorb bad habits from material that looks innocent line by line, so careful owners give every AI-produced change that touches customers or money — a website edit, an email, a quote — a second set of human eyes before it ships. Neither owner learned to code or hired a security department. They bought an outcome, the way they buy bookkeeping or payroll.
Your Move
Three steps this week. First, get a find-and-fix check of your own public systems this month, before someone less friendly runs the same check for free. Second, write down your checker rule: which AI outputs need a human review before they reach a customer, and who that human is. Third, brief your team for election week — urgent requests get verified by callback on a known good number, every time, no exceptions for a convincing voice. If you want that built for you, that is exactly what we do at The Agency. Start with a free AI Audit and we will show you where your business stands today.