What Is an Agentic Cyberattack?

Until recently, a cyberattack required a person sitting at a keyboard. Someone had to research the target, craft the phishing email, identify a vulnerability, and decide how to proceed once they gained access. Every single step was handled by a human, and it was a slow process. Because of this, attackers had to be strategic about their targets. Big companies with deep pockets were the prime targets, while small businesses often flew under the radar. Not because they were safe, but simply because they didn't seem worth the effort.

That's all changed now.

The term "agentic" refers to something that operates independently. An agentic cyberattack is AI software taking the reins, handling everything from identifying targets to breaching systems and stealing data, often with little to no human intervention. The attacker sets a goal, and the AI figures out how to achieve it.

This isn't some futuristic scenario or a plot twist from a movie; it's happening right now, and it's reshaping the landscape for every business, including the smaller ones.

Just look at how quickly things are moving now

In 2024, the average time it took for an attacker to navigate through a company's network was 48 minutes. By 2025, that time plummeted to just 29 minutes, with some reported cases taking a mere 27 seconds.

(CrowdStrike 2026 Global Threat Report, February 2026)

That kind of speed isn't human. Humans don't operate at machine speed. Software does.

The shift in phishing is equally striking. AI-generated phishing attacks skyrocketed from less than 5% of all detected phishing attempts to 56% by December 2025. This wasn't a gradual increase; it was like flipping a switch.

(Hoxhunt Phishing Trends Report 2026)

An IBM research team found that a fully targeted phishing campaign can now be built in just five minutes using AI, a task that used to take attackers around sixteen hours.

(IBM X-Force research, 2025)

So, what do these agentic attacks look like?

There are three main types, each of which used to require skilled individuals. Thanks to AI, all three have evolved.

AI phishing that actually works

We used to watch for bad spelling, awkward grammar, and generic greetings in order to catch phishing emails. That advice is outdated. Now, AI writes better than most people. It scrapes LinkedIn, company websites, and press releases to address you by name, reference your projects, and mimic the writing style of someone you know.

The statistics are eye-opening. AI-generated phishing emails boast a 54% click rate, while those crafted by humans only manage 12%. That's a 4.5 times difference.

(Microsoft Digital Defense Report, October 2025)

When it comes to credential phishing, where your login details are at risk, there was a shocking 703% increase in just the second half of 2024.

(SlashNext 2024 Phishing Intelligence Report)

On the dark web, criminal AI tools like WormGPT and FraudGPT are readily available for about $200 a month. These tools come without the safety features of commercial AI and are specifically designed to churn out phishing emails, malware code, and fake websites on a massive scale.

(Netenrich and Rapid7 threat research)

Voice cloning and deepfakes

In January 2024, a finance officer at Arup, a major UK engineering firm, joined a video call. The CFO was in attendance. Everyone looked and sounded legitimate. They discussed a financial transaction, and the finance officer went ahead and authorized the wire transfer.

What the finance officer didn't realize was that every other participant on that call was an AI-generated deepfake. The company ended up losing an astounding $25.6 million.

(Hong Kong Police disclosure, reported by Fortune, May 2024)

While that incident involved a large corporation, the technology behind it doesn't discriminate by company size. Researchers have demonstrated that just three seconds of publicly available audio, like a podcast snippet, a conference talk, or a social media video, can be enough to clone a voice with 85% accuracy.

(SecurityToday, April 2026, citing security research bodies)

Voice phishing, or "vishing," saw a dramatic 442% increase between the first and second halves of 2024.

(CrowdStrike 2025 Global Threat Report)

Autonomous attack chains

Autonomous attack chains are emerging as one of the most alarming threats we face today. In late 2025, a lone attacker leveraged a commercial AI tool to infiltrate nine Mexican government agencies and a financial institution. This AI took charge of reconnaissance, identified and exploited at least 20 vulnerabilities, navigated through various systems, gathered credentials, and ultimately exfiltrated around 150 gigabytes of sensitive information including tax records and civil registry files. Just one person. One AI tool. Nine agencies.

(SecurityWeek, March 1, 2026; Gambit Security threat intelligence)

In another incident, autonomous AI agents efficiently mapped out 21 interconnected Taiwanese government systems, compromised 85 accounts, and extracted over 2,500 personnel records in just about four days, all with minimal human oversight.

(Security Boulevard, August 2026)

Anthropic, the company behind Claude AI, released a threat intelligence report in September 2026 that detailed several instances where their own tool was utilized for autonomous attacks on government agencies, including by state-sponsored groups.

(Anthropic Threat Intelligence Report, September 2026)

These incidents are not just hypothetical; they are well-documented, sourced, and alarmingly recent.

Why small businesses are vulnerable

There's a widespread belief that attackers primarily target the biggest organizations. While that may have been the case when attacks were manual and costly, AI has shifted the dynamics.

Now, when it costs the same to target ten small businesses as it does to go after one large entity, the pressure to select high-profile targets diminishes. Ransomware is now involved in 88% of small business breaches, compared to just 39% for large enterprises.

(Verizon 2025 Data Breach Investigations Report)

The financial implications are even more troubling. The average cost of a breach for a company with fewer than 500 employees stands at $3.31 million.

(IBM Cost of a Data Breach Report 2025)

A full 55% of small businesses report that a loss of $50,000 would put them out of business. The median ransomware demand is $115,000, which is more than double that threshold.

(VikingCloud SMB Survey 2025; Verizon 2025 DBIR)

In contrast, larger companies have dedicated security operations teams, which helps them better manage these risks.

The Canadian picture

Canada is currently the second most targeted nation in the world for ransomware attacks, just behind the United States. In 2025 alone, 374 Canadian organizations found themselves publicly extorted. Over 17 billion cyberattacks were aimed at Canadian targets, marking a 24% increase from the previous year.

(Fortinet 2026 Global Threat Landscape Report, May 2026)

Over 80% of Canadian organizations faced at least one breach in 2025.

(Fortinet 2026)

The Canadian Centre for Cyber Security laid it out clearly in their Ransomware Threat Outlook for 2025 to 2027: "With the rise of AI, these threats have become cheaper and faster to conduct and harder to detect." They also noted, "All Canadian organizations, regardless of size or sector, are at risk of being targeted by ransomware."

(CCCS Ransomware Threat Outlook 2025-2027, January 2026)

The government anticipates a 26% annual growth in ransomware attacks targeting Canadian organizations through 2027.

(CCCS Ransomware Threat Outlook 2025-2027, January 2026)

Canadian small businesses are facing the same AI-driven threats as their American counterparts, but with fewer resources and less attention from vendors. Many large security firms tend to overlook Canada. While the Canadian Centre for Cyber Security offers valuable resources at cyber.gc.ca, there remains a significant gap between awareness and taking action.

What you can do about it

Don't worry, this isn't meant to freak you out. It's all about keeping you in the loop because when you're informed, you can make smarter choices. Here are five practical steps to significantly cut down your exposure, ranked by how much effort they require:

1. Enable multi-factor authentication everywhere you can, especially for your email and accounting software. This is hands down the most powerful move you can make. According to Microsoft, it blocks a staggering 99.9% of automated account takeover attempts.
2. Treat any request for money or sensitive information as suspicious until you can verify it over the phone. And I mean really verify it. Not by replying to the email or calling a number listed in the email, but by using a number you already have. This simple habit can thwart most AI phishing and deepfake scams, since the attacker still relies on you to act on their fraudulent request, and a quick call to a trusted number disrupts that.
3. Keep your software up to date. Nearly 29% of vulnerabilities in 2025 were exploited on or before the day their fixes were released. Those patches are crucial, and putting them off is riskier than ever.
4. Understand your breach obligations. If you're running a Canadian business that handles personal information, PIPEDA requires you to report certain breaches to the Office of the Privacy Commissioner. The rules aren't as complicated as they might seem, and it's way better to know them before you find yourself in a crisis.
5. Close the operator gap. Having security software is just the first step. You also need someone who knows how to interpret what it's telling you. Most small businesses have the software but lack that crucial understanding. That gap is a significant vulnerability, and it's exactly what AI-driven attacks exploit most effectively.

The bottom line

AI hasn't invented new types of attacks; instead, it has made the existing ones quicker, more affordable, and scalable enough to target businesses that were once considered too small to be worth the effort. The silver lining is that the defenses we have aren't complicated either. Simple measures like multi-factor authentication, good verification habits, timely updates, and having someone keep an eye on alerts can significantly reduce the risks.

Speaking of that last point, that's exactly what we're working on at Sentry North. We're creating endpoint security tailored for small businesses right here in Canada, specifically designed for those who don't have a dedicated security team, and really shouldn't have to. If you're curious about how your setup appears from the outside, our free scan only takes about a minute and doesn't require any installation.

See what your setup looks like from the outside: run the free scan. Or join the waitlist for early access.