The phishing email your team learned to spot doesn’t exist anymore
For years, security awareness training told employees to look for the tells: bad grammar, a mismatched sender name, a logo that’s slightly off. That advice is going stale fast. Generative AI now writes phishing emails that are grammatically clean, contextually specific, and often built from real details scraped off LinkedIn, a company website, or a breached vendor list. The result shows up in the data: AI-generated phishing emails are getting opened at rates of 54 to 78%, compared with roughly 12% for traditionally crafted scams, according to recent industry research. Generative tools are now behind an estimated 78% of sophisticated social engineering campaigns, and AI-powered attacks against small businesses climbed 340% in 2025 alone.
None of that is theoretical for a security-first MSP like Cloud9 Tech Solutions. We watch this shift play out client by client, and the pattern is consistent: the attacks aren’t getting louder, they’re getting quieter and more convincing.
Small businesses are the preferred target, not an afterthought
There’s a persistent myth that attackers only chase large enterprises with deep pockets. The numbers say the opposite. Companies with fewer than 100 employees receive roughly 350% more social engineering attempts than larger organizations, and small businesses now see malicious emails at a rate of about 1 in every 323 messages, the highest exposure of any company size. Ransomware, often the payload that follows a successful phishing attempt, is involved in 88% of small business breaches versus 39% for large organizations, and 96% of those ransomware attacks specifically go after backup systems first, to remove the victim’s ability to simply restore and move on.
Yet 59% of small business owners with no formal security program still believe their company is too small to be worth attacking. That gap between perception and reality is exactly where damage gets done.
What actually holds up against this
Awareness training still matters, employees who’ve seen realistic simulated phishing attempts catch more of the real thing, but training alone was never going to keep pace with AI-written lures that read like they came from a real colleague. The defense that works is layered, so that a single moment of human trust isn’t the only thing standing between an inbox and a ransomware event:
- Phishing-resistant multi-factor authentication on every account that matters, not just email, so a stolen password alone can’t get an attacker in the door.
- Endpoint detection and response (EDR/XDR) that watches for the behavior after the click, unusual logins, lateral movement, encryption activity, rather than relying solely on stopping the email itself.
- Identity governance that limits what any single compromised account can actually reach, so a successful phish doesn’t hand over the whole network.
- Immutable, tested backups that ransomware can’t reach or overwrite, given how directly attackers now target backup infrastructure.
- Ongoing, realistic simulated phishing tied to real threat patterns, not a once-a-year compliance checkbox.
This is the same logic behind a Zero Trust posture: assume any single control can fail, and design the rest of the environment so that failure doesn’t cascade into a full breach. It’s less about finding one silver bullet and more about making sure no single mistake, made by a tired employee on a Friday afternoon, can take down the business.
The real cost of getting this wrong
Average losses from a small business breach now reach roughly $254,000, and about 60% of companies hit by a serious cyberattack close within six months. Downtime after a ransomware incident averages 24 days, which for most SMBs is not a survivable gap without a plan in place beforehand. Robert Borges, Cloud9’s founder, puts it plainly to clients: the goal isn’t to promise zero risk, no one honestly can, it’s to build an environment where one bad click doesn’t turn into a company-ending event.
Where to start
You don’t need to overhaul everything at once. Start by asking a straightforward question: if an employee clicked on a well-crafted, AI-written phishing email tomorrow morning, what would actually stop it from becoming a full breach? If the honest answer is “nothing,” that’s the gap worth closing first.
Schedule a free security assessment with Cloud9 and we’ll walk through exactly where your current defenses hold up, and where an AI-sharpened phishing attempt could still get through.