When “Looks Legitimate” Is No Longer Safe: Protecting Your Business from AI-Powered Scams

Businesses with around 50 to 250 staff are often in a difficult position.

They may have significant revenue, valuable customer data, supplier relationships and access to financial systems—but not the internal security team of a major enterprise.

Staff also tend to be busy and versatile. A finance employee may manage invoices, payroll and supplier changes. A manager may approve payments between meetings. An administrator may receive documents from customers, couriers, banks and external service providers throughout the day.

Criminals exploit that pace and familiarity.

In 2025, Australian small businesses made 2,228 reports to Scamwatch. Of those, 287 involved financial theft, with reported losses totalling $9.5 million.

The financial loss is only part of the impact. An incident can also create:

• Business disruption
• Recovery and investigation costs
• Damage to customer or supplier trust
• Cyber insurance complications
• Privacy and reporting obligations
• Lost staff time
• Reputational harm

Consider a common scenario.

A finance employee receives an email from what appears to be a regular supplier. The message explains that the supplier has changed banks and asks the business to update the account details before paying the next invoice.

The message is polished. The invoice branding is correct. The tone matches earlier emails. The sender even refers to a recent order.

But the supplier’s mailbox has been compromised—or the sender address has been carefully imitated. The employee changes the bank details and processes the payment.

By the time the real supplier follows up, the money has gone elsewhere.

This is a form of Business Email Compromise (BEC). It succeeds because the attacker targets a trusted process and a normal business decision—not necessarily because they defeat every technical control.

Identity attacks may also involve stolen passwords, hijacked browser sessions, malicious inbox forwarding rules, rogue applications or compromised Microsoft 365 accounts. Huntress Managed Identity Threat Detection and Response is designed to monitor for precisely these types of identity and email-based activity.

Arrow is seeing an increase in organisations approaching us after identity theft, mailbox compromise, phishing, invoice fraud or another security event.

Many of these businesses have 50 to 250 employees and already have an external Information Technology provider.

They often believed they were reasonably protected because they had antivirus, Multi-Factor Authentication (MFA) or Microsoft 365 security features enabled. Those controls are important—but they are not the complete picture.

The questions businesses increasingly need to ask are:

• Are our Microsoft 365 identities monitored continuously?
• Would we detect a hijacked session or malicious inbox rule?
• Are our devices patched and configured consistently?
• Does anyone investigate security alerts after hours?
• Are staff regularly tested and trained?
• Can we demonstrate our controls to an insurer, auditor or customer?
• Do we know our current Microsoft Secure Score?
• Are we aligned with the Essential Eight?

There is no single application that makes a business secure. A stronger approach combines technology, people, process and ongoing monitoring.

1. Protect endpoints: Laptops, desktops and servers remain important attack targets.

Managed Endpoint Detection and Response (EDR) monitors for suspicious behaviour that may bypass traditional preventative tools. Huntress combines endpoint monitoring with a 24/7 Security Operations Centre, where specialists investigate and respond to credible threats.

2. Protect identities and Microsoft 365: A legitimate username, password or session token can allow an attacker to look like a normal user.

Managed Identity Threat Detection and Response (ITDR) helps identify suspicious logins, session hijacking, rogue applications, mailbox manipulation and account takeover activity across Microsoft 365. Huntress

This matters because criminals increasingly try to log in rather than “break in”.

3. Secure and manage every device: A strong identity system cannot compensate for unmanaged, unpatched or inconsistently configured devices.

Arrow DeviceShield, powered by Devicie, uses Microsoft Intune to automate device deployment, policy configuration, software updates, application management and compliance visibility across computers and mobile devices.

It also supports key operational activities associated with Essential Eight controls, including application control, application and operating-system patching, user hardening and restricted administrative privileges.

4. Train people continuously: Security Awareness Training should not be a one-off presentation delivered during onboarding and forgotten.

Arrow can run an ongoing program that includes:

• Monthly simulated phishing campaigns
• Ralistic supplier, login and payment-themed tests
• Short training videos
• Brief knowledge checks
• Targeted training for higher-risk users
• Reporting on participation, clicks and improvement
• Education about phishing, passwords, social engineering and Business Email Compromise

The Australian Signals Directorate advises businesses that employee cyber awareness should cover phishing, scams, Business Email Compromise, password security and invoice validation—and that training should be refreshed periodically rather than treated as a one-time exercise. Cyber.gov.au

The objective is not to catch staff out or embarrass them. It is to help people recognise pressure tactics, question unusual requests and report concerns early.

5. Improve the business process: Technology cannot determine whether every payment or supplier change is commercially legitimate.

Businesses should also consider practical controls such as:

• Independently confirming changes to supplier bank details
• Using contact details already held on file
• Requiring dual approval for new payees or significant payments
• Limiting financial and administrative access by role
• Reviewing external contractor access
• Removing accounts and permissions promptly
• Providing a clear process for reporting suspicious requests
• Ensuring employees are supported when they pause to verify something

A familiar name or voice should not be treated as sufficient proof. The identity and the instruction should both be validated.

Many organisations know they need to improve security but don’t know where to begin.

Arrow can provide a practical review covering areas such as:

• Microsoft 365 security configuration
• Microsoft Secure Score
• Identity and mailbox risks
• Multi-Factor Authentication and access policies
• Endpoint protection and response coverage
• Device patching and compliance
• Backup and recovery readiness
• Essential Eight alignment
• Security awareness and phishing testing
• 24/7 monitoring and response
• Reporting, cyber insurance and compliance requirements

Arrow’s Business Essentials packages combine managed support, security, Microsoft 365 optimisation, backup, training and reporting. Arrow also guarantees a Microsoft Secure Score exceeding 70% within the first 90 days across its managed service packages.

The goal is confidence—not fear. Artificial Intelligence is making scams more convincing, but businesses are not powerless.

The strongest response is a layered one:

1. Secure the identity
2. Monitor the endpoint
3. Manage and patch the device
4. Train the employee
5. Strengthen the approval process
6. Respond quickly when something looks wrong

The aim is not to expect every employee to become a cybersecurity expert. It is to create an environment where technology detects more, staff recognise more, and the business responds faster.