Five cyber threats for business and the hackers' new tactics

Over the years of Russia’s full-scale invasion, Ukrainian business has learned to operate in conditions that not long ago seemed incompatible with normal operations. Companies have contingency plans for air raid alerts, power cuts, and damage to offices, warehouses or production sites. Businesses are diversifying their logistics and securing backup connectivity and energy supplies.

There is another type of infrastructure without which almost any company can grind to a halt today: digital. Cybersecurity has long ceased to be a purely technical routine for the IT department. A single large-scale data breach or a blocked website can paralyse a team’s work and undermine customer trust built up over many years.

Staying inside, unnoticed

One recent trend is that cybercriminals are increasingly less eager to lock a system immediately or announce their presence. It is far more valuable to them to remain quietly inside a company’s infrastructure, studying its structure, processes, access rights and connections, gathering information and waiting for the right moment.

This changes the very meaning of a cyber incident. Restoring a system from a backup is not enough if the company has not established how the intrusion happened. If a compromised account, an unpatched vulnerability or a poorly configured remote access point remains, the door is still open, and the attacker may return.

Typical entry points are entirely mundane: delayed software updates, stolen credentials, the absence of multi-factor authentication, phishing and pirated software. A company’s weakest point is most often not a sophisticated technology, but whatever has been put off “until later” for years.

Five risks businesses should watch

The belief that “we are of no interest to anyone”. This is especially common among small and medium-sized businesses. Yet most attacks do not require anyone to pick a specific company by hand. Automated tools scan the internet for vulnerable servers and poorly protected accounts. Company size guarantees nothing.

Cybersecurity funded as an afterthought. An antivirus and a system administrator are no longer enough to count as a proper security system. What is needed is access control, regular software updates, backups, monitoring, an incident response plan, and people who know what to do when something goes wrong.

Employees. Not because people are inherently the “weakest link”, but because a huge volume of communication passes through them. A single email apparently from a manager, partner or government body can become an entry point. Modern phishing is increasingly hard to spot from poor language or odd formatting: messages are personalised to the recipient’s position, company and professional contacts. Staff training should be as regular a procedure as software updates.

Software of uncontrolled origin. Pirated programs, outdated solutions and products no longer supported by their vendor widen the attack surface. For Ukrainian businesses there is an additional need to assess separately any products linked to the aggressor state and check them for compliance with current restrictions.

Personal devices and remote work. A corporate system may be well protected, but if an employee accesses it from an unmanaged laptop, reuses the same passwords for personal and work services, or connects via unsecured networks, the company’s perimeter effectively extends to every such device. In 2026, it is no longer easy to say exactly where the corporate network ends.

AI as another source of risk

A new threat is now added to the traditional ones: the widespread use of artificial intelligence. For business, AI is both a productivity tool and a new attack surface. It helps detect anomalies and phishing faster, but the same technologies make it possible to craft more convincing fraudulent messages, imitate a specific person’s voice or video, and automate social engineering.

A separate issue is what data employees themselves with external AI services. Commercial information, extracts from contracts, customers’ personal data, internal code and financial figures should not end up in public systems simply because it is quicker for an employee to complete a task. An internal AI usage policy is gradually becoming as essential as rules for handling personal data: a company must define which services may be used, what data may be shared with them, who has access to corporate AI tools, and where human review is mandatory.

Autonomous AI agents, which can not only generate answers but also take actions independently, require particular attention. In late August, researchers demonstrated an instructive scenario. Analysing thousands of corporate websites, they found references to unregistered software packages and domains in llms.txt and llms-full.txt files, which are documents containing structured instructions for AI agents. The researchers registered some of these names and published test packages, and AI agents inside corporate environments began following the instructions and contacting the infrastructure the researchers had created.

What matters here is not the specific file or technology, but the principle: once AI is given the right to install software or execute commands on its own, any flaw in the chain of trust becomes a risk for the entire business. The actions of an autonomous agent should be treated much like those of a new employee who is not yet given the keys to every door: minimum necessary permissions, restricted access to data and systems, action logging, human oversight of critical operations, and the ability to stop the agent quickly if it behaves abnormally.

Digital security essentials

For most companies, the first step does not require a complex transformation: multi-factor authentication for corporate systems and email, control of devices and access rights, regular software updates, and backups with verified data recovery.

It is also important to keep event logs and have a clear incident response procedure with designated responsible persons. An employee should not have to look for the system administrator’s phone number at the very moment they have opened a suspicious file or lost access to their email. Companies should use official channels for sharing information on cyber threats and work with specialist organisations.

Technology is only part of the system. Cybersecurity should be built in long before a product is released. A good example is the practice of companies in the Ukrainian IT community that embed security checks at the design stage. At SharksCode, for instance, the process involves not only information security specialists but also the development, DevOps and Product teams: infrastructure is reviewed, scanning and penetration testing are carried out, and critical vulnerabilities are fixed before the product is released. In the technology industry, this approach is known as Shift Left, where security is built into the product from the very start.

For business, the principle is simple: it is cheaper to find a weakness yourself than to wait for someone else to exploit it.