AI has changed the math on cybercrime. Our playbook hasn’t caught up.
This October marks the 23rd year of Cybersecurity Awareness Month. What began in the United States as a national campaign has grown into a global effort to help organizations, businesses, and individuals become safer online.
The Cyber Readiness Institute joined that effort nine years ago to support one of the world’s largest and most vulnerable business segments: small and medium-sized businesses (SMBs). Our work is grounded in a simple belief: cybersecurity is as much a human challenge as a technology challenge. Tools matter, but so do the everyday behaviors and decisions that determine whether those protections succeed.
After nearly a quarter-century of cybersecurity awareness, however, we need to confront an uncomfortable truth. We no longer have an awareness problem alone. We have an action and accountability problem, and artificial intelligence is making the consequences of inaction far greater.
We have made significant progress. People are more aware of cyber risks, and organizations have access to more sophisticated security technologies than ever before. Yet the overall trajectory of cybercrime continues to move in the wrong direction. Small businesses, critical infrastructure providers, and global supply chains remain exposed while attacks become faster, more scalable, and increasingly convincing.
The question is no longer whether people understand cyber risk. It is whether we are creating the right incentives, expectations, and partnerships to turn that understanding into sustained action.
The numbers tell a sobering story.
In 2001, the FBI’s Internet Crime Complaint Center received roughly 49,700 complaints representing reported losses of $17.8 million. By 2025, complaints had surpassed one million, with reported losses reaching $20.9 billion.
Other indicators point in the same direction. The global cost of cybercrime has grown into the trillions of dollars. Verizon’s latest Data Breach Investigations Report analyzed more than 31,000 security incidents and 22,000 confirmed breaches across 145 countries. IBM and the Ponemon Institute found that the average global cost of a data breach reached a record $4.99 million in 2026, while the U.S. average climbed to a record $11.5 million.
Better reporting and detection account for some of this increase. But they do not explain the scale of the economic damage. Despite greater awareness, stronger technology, and decades of investment, cyber losses continue to rise.
This does not mean awareness efforts have failed. It means awareness alone is not enough.
That reality is especially important for SMBs. These businesses are essential to the economy and to the supply chains of larger enterprises, yet many lack dedicated cybersecurity staff, sophisticated tools, or the resources to navigate an increasingly complex landscape of requirements.
Over nearly a decade of working with SMBs, we have learned that knowledge rarely drives lasting behavioral change by itself. Organizations are far more likely to improve when expectations are clear, support is accessible, progress can be demonstrated, and good cyber practices deliver real business value.
AI is making that gap between awareness and action increasingly dangerous.
AI does not simply make attacks more sophisticated. It lowers the cost, expertise, and effort needed to launch them. Phishing emails that once contained obvious errors can now be personalized, grammatically flawless, and tailored at scale. AI can help attackers identify vulnerabilities, automate reconnaissance, and accelerate intrusion efforts faster than human teams could previously manage.
The result is a growing asymmetry. Attackers increasingly operate at machine speed while defenders continue to operate on training schedules, budget cycles, and patch-management timelines.
Traditional awareness campaigns were designed for a world where many threats were easier to recognize. Advice such as “stop and think before you click” still matters, but it is no longer sufficient on its own. Organizations must assume some attacks will succeed and focus equally on readiness, rapid response, and resilience.
For SMBs, that does not mean adopting another complex framework or expensive technical mandate. It means implementing a manageable set of essential practices that can be reinforced through training, coaching, and verification. For larger enterprises and public institutions, it means recognizing that supplier cyber readiness is a shared responsibility, not simply a requirement pushed downstream.
We do not need an entirely new regulatory architecture to drive change. Many of the tools already exist through procurement, licensing, insurance, financing, and public-private partnerships. The challenge is using them more effectively to make good cyber behavior easier, more valuable, and, where appropriate, expected.
Four practical steps can help.
Establish minimum standards across supply chains. Large organizations should require suppliers to meet clear, risk-based cybersecurity practices, with stronger requirements for the most critical vendors. But requirements alone will not work. Enterprises should pair them with practical tools, coaching, reasonable implementation time, and incentives such as preferred-vendor status. When cyber readiness improves access to business rather than merely adding cost, it becomes a competitive advantage.
Use existing licensing and oversight mechanisms. Regulators and licensing bodies should incorporate cyber readiness into the systems they already use, particularly in critical infrastructure sectors. New York State’s decision to recognize cybersecurity training within its water and wastewater operator framework offers one example of how existing mechanisms can encourage action. Similar approaches should be considered in energy, healthcare, transportation, and other essential sectors.
Create a cyber trust mark for businesses, not only products. The United States has established a federal cyber trust mark for consumer products. Businesses particularly SMBs would also benefit from a credible, recognizable way to demonstrate that they follow essential cyber practices. States could pilot voluntary business-level trust marks or verified-readiness programs, connect them to training and licensing processes, and test which incentives meaningfully increase participation before considering broader requirements.
Rebuild public-private partnerships around measurable outcomes. Threat intelligence sharing is valuable, but it is not the same as changing behavior. Public-private partnerships should define the practices they want organizations to adopt, provide the support needed to adopt them, and measure whether participation leads to verified action and greater resilience. The central question should be straightforward: what will actually move organizations from knowing to doing?
These recommendations reflect a basic reality: cybersecurity is interconnected an interconnected challenge. The cyber readiness of a small supplier, healthcare practice, water utility, or municipal organization can affect customers, communities, and entire supply chains. We cannot continue treating organizations as isolated actors while expecting the least-resourced among them to shoulder the burden alone.
For nearly a quarter-century, we have asked people and businesses to become more aware of cyber risk. Awareness still matters. But in the age of AI, awareness without action and accountability is no longer enough.
The next chapter of cybersecurity must focus on making good cyber behavior easier, more valuable, and, where the stakes warrant it, expected. We already know many of the levers that can drive change.
It is time to start pulling them.
