Category: Newsletter

NewsletterXDR

The OODA Loop And AI: How Orientation Affects Fairness

The OODA Loop And AI: How Orientation Affects Fairness

Contents

Artificial intelligence is rapidly becoming an inherent and permanent part of our lives. At this critical inflection point, it is vital to ensure that human rights and agency remain the guiding force for this powerful technology.

To understand what this means for fairness, we can turn to the OODA Loop, a decision cycle developed by military strategist John Boyd, representing four iterative phases:

  • Observe
  • Orient
  • Decide
  • Act

Secure Your LLMs

PromptShield™ is the first AI-powered firewall and defense platform that protects enterprises against the most critical AI prompt risks.

Beyond The Battlefield: The Versatility Of The OODA Loop

While originally designed for combat scenarios, the OODA Loop has found applications far beyond the battlefield in business, cybersecurity, law enforcement, and even litigation.

In fact, Jamie Dimon, CEO of JPMorgan Chase, credits the OODA Loop with helping him evaluate complex scenarios under uncertainty.

So, what exactly are these phases?

  • Observe: This is about gathering information about unfolding circumstances and external factors.
  • Orient: In this crucial phase, you analyze observations through the filters of culture, heritage, experience, and new data.
  • Decide: Based on your orientation, you form a hypothesis or a plan of action.
  • Act: Finally, you implement your decision, effectively testing your hypothesis in the real world.

Together, these create the acronym OODA. Importantly, feedback loops connect all phases, enabling continuous adaptation.

$35/MO PER DEVICE

Enterprise Security Built For Small Business

Defy your attackers with Defiance XDR™, a fully managed security solution delivered in one affordable subscription plan.

The Pivotal Role Of Orientation

Among the four phases, Orientation is the most crucial and complex, and it is often the least understood. To effectively orient a decision, you need to interpret the observed data through five key contextual lenses:

  • Cultural traditions: Our upbringing’s values, norms, and beliefs act as a filter, shaping what we consider “normal” and influencing how we judge situations and what decisions seem appropriate.
  • Genetic heritage: Our inherent traits and instincts, like fight-or-flight responses or risk tolerance, influence how we react to stimuli and process information, subtly guiding our decision-making.
  • Past experiences: Previous successes, failures, and lessons learned form a mental backdrop, helping us quickly interpret new situations but also potentially introducing bias if we assume new scenarios are identical to old ones.
  • Analytical synthesis: This is our ability to reason, break down information, and recombine it into a meaningful understanding. Strong analytical skills help us filter noise and connect facts, leading to clearer orientation and sounder decisions.
  • New information: The continuous influx of fresh data and changing circumstances constantly reshapes our understanding. Effectively integrating this ensures our decisions reflect the latest reality, preventing us from acting on outdated perceptions.
The OODA Loop And AI

Each of these lenses influences how we orient to our observations, filtering and framing the raw data. Together, they shape our perception of situations and directly impact the quality and speed of our decisions within the OODA Loop.

Recognizing that each person or organization may orient differently based on these factors highlights why refining our orientation by broadening experiences, challenging biases, and staying open to new information leads to better decision-making over time.

How Orientation Manifests In AI

In AI systems, orientation parallels the data, algorithms, and design principles shaping model behavior. Since AI reflects the contexts encoded in its training data and design choices, orientation inherently carries biases

Think of it this way:

Just as our human orientation is built from our experiences and beliefs, an AI’s “orientation” is constructed from the information it’s trained on and the rules it’s given. Because AI inherently reflects the contexts embedded in its training data and the choices made during its design, this “orientation” naturally carries biases.

These aren’t just technical biases, like imbalances in the data, but also fairness and cultural biases that were present in the human-generated information it learned from, whether intentional or not.

Because of the massive amounts of data learning that feeds AI, it is extremely challenging to evaluate the neutrality or bias of the data going into training the models. This is why it is important to address it after learning, but before going to market with these tools.

The Complexity Of Fairness Across Different Orientations

Fairness isn’t a fixed concept; its perception often varies significantly depending on one’s orientation. For example:

  • Cultural Orientation: Facial recognition systems trained primarily on Western faces often perform poorly on individuals from non-Western ethnicities, leading to higher misidentification rates. This reflects a cultural orientation bias in the training data and assumptions about “normal” features. What may be considered accurate and fair in one cultural context ends up discriminatory in another.
  • Historical Orientation: In credit scoring, AI models that rely on historical financial data may unintentionally perpetuate systemic disadvantages faced by marginalized communities. To address this, some fairness approaches involve adjusting scores or granting “credit boosts” to historically underserved groups to counteract prior exclusion and discrimination.
  • Socio-Economic Orientation: Online education platforms using AI to personalize learning may assume students have reliable internet access and modern devices. This assumption biases the system against learners in rural or low-income areas with limited connectivity, resulting in unequal learning opportunities. The AI’s orientation, shaped by a resource-rich environment, misses this digital divide.

Therefore, true fairness in AI is inseparable from whose orientation the system reflects, and whose it overlooks

Critiques And Considerations On The OODA Loop’s Usefulness

Not everyone agrees on the OODA Loop’s uniqueness or depth.

For example, aviation historian Michael Hankins cautioned that the loop’s flexibility can dilute its meaning, making it a generalized model rather than a profound insight. It’s one of many ways to describe intuitive decision-making.

While the OODA Loop effectively highlights the criticality of “orientation,” other well-known frameworks also contribute to understanding decision-making and continuous improvement.

These include the PDCA (Plan-Do-Check-Act) cycle, often used for quality management, and Design Thinking, which emphasizes empathetic problem-solving and iterative prototyping.

More recently, comprehensive AI ethics frameworks like the NIST AI Risk Management Framework or principles outlined in the EU AI Act provide detailed guidelines for responsible AI development.

Yet, it is the OODA Loop’s simplicity and adaptability that make it a particularly valuable tool for framing AI fairness challenges in an era where cultures and new information are constantly factoring into the decision loop.

Ethical Blind Spots In AI and Orientation

AI’s rapid emergence as the fastest-growing market in history is pushing us into uncharted territory, confronting us not only with technical advancements but also with unprecedented ethical, cultural, and anthropological challenges.

Given the central role of orientation, we must constantly discuss and ask ourselves crucial questions about its impact on fairness.

Some pressing ethical questions remain underexplored:

  • Whose cultural and historical contexts are encoded in AI systems, and who is excluded?
  • How might AI perpetuate “epistemic injustice” by privileging certain worldviews?
  • Are current fairness metrics too narrow, overlooking nuanced social impacts?
  • How transparent are AI decisions to users from diverse backgrounds?
  • What long-term societal consequences might arise from deploying AI without fully understanding these orientations?

Toward Fairer AI: Embracing Orientation

To create AI that is genuinely fair, practitioners must:

  • Engage Diverse Communities: Implement participatory design workshops, user co-creation sessions, and ongoing feedback loops with individuals from varied backgrounds to deeply understand their notions and expectations of fairness.
  • Incorporate Interdisciplinary Insights: Build diverse development teams that include ethicists, social scientists (e.g., anthropologists, sociologists), and humanities scholars alongside engineers to bring a holistic perspective to AI design.
  • Develop Fairness Metrics Sensitive To Contexts: Move beyond simple aggregated metrics by employing subgroup analysis, intersectional fairness assessments, and context-specific impact evaluations that account for the unique experiences of different populations.
  • Prioritize Transparency And Explainability: Create clear documentation of training data sources and characteristics (e.g., “model cards”), provide user-friendly explanations for AI decisions, and develop mechanisms for users to challenge or provide feedback on outputs.
  • Treat Orientation As A Foundational Design Principle: Integrate ethical considerations and fairness assessments from the very inception of AI projects, ensuring they are core to the system’s architecture and development lifecycle, rather than a separate audit or afterthought.

The Breach Report

PurpleSec’s security researchers provide expert analysis on the latest cyber attacks.

Firewall that's on fire

Conclusion

Understanding how to properly orient your observations is a critical piece of ensuring that your decision-making is based on accurate and fair reasoning, allowing you to identify potential pitfalls and gaps in the information you possess.

The OODA Loop serves as a powerful reminder that fairness is deeply rooted in how we orient ourselves within a complex and ever-changing world. AI systems inherit these orientations, thereby both reflecting and shaping societal values.

The framework succeeds in demonstrating that AI fairness isn’t just about technical metrics but about whose worldview gets encoded into systems.

Recognizing this profound connection and committing to treat orientation as a foundational design principle rather than a mere technical afterthought can guide the development of AI that is more inclusive, just, and truly aware of its ethical responsibilities, ensuring human rights remain the steering wheel for this transformative technology.

Remember, feedback is key to this loop, as it’s the continuous feedback that transforms it from a simple decision line into a dynamic, adaptive cycle.

Clearly, we have much to consider as this technology not only surpasses our own capabilities, but gains more and more control over daily events in our lives.

Picture of Joshua Selvidge
Joshua Selvidge
Joshua is cybersecurity professional with over a decade of industry experience previously working for the Department of Defense. He currently serves as the CTO at PurpleSec.

Share This Article

Recent Newsletters

NewsletterXDR

How Generative AI Is Powering The Next Wave Of Social Engineering Attacks

How Generative AI Is Powering The Next Wave Of Social Engineering Attacks

Contents

Picture this: Your CFO calls an emergency video meeting about a critical acquisition.

The voice is unmistakable, the mannerisms perfect, even that familiar habit of adjusting glasses while speaking. Thirty minutes later, you’ve authorized a wire transfer for millions.

The problem?

Your CFO was never in that meeting – you just fell victim to the most sophisticated social engineering attack in history.

This isn’t science fiction. Generative AI has fundamentally transformed the social engineering threat landscape, creating the most significant evolution in cybercrime since email phishing.

Traditional fraud prevention methods are proving woefully inadequate against these new AI-powered threats.

Secure Your LLMs

PromptShield™ is the first AI-powered firewall and defense platform that protects enterprises against the most critical AI prompt risks.

The Technical Revolution Behind the Crisis

Generative AI has democratized sophisticated attack capabilities that were once exclusive to elite threat actors.

Modern AI tools can create convincing deepfakes using consumer-grade hardware in under an hour, while voice cloning requires just seconds of audio to achieve remarkably convincing results.

The technical barriers that once protected organizations have collapsed.

A man in a jacket sitting in front of three monitors

What makes these attacks particularly dangerous is their multi-modal sophistication. Cybercriminals orchestrate comprehensive impersonation campaigns that combine deepfake video, voice cloning, and personalized text messaging – all generated by AI systems that learn and adapt in real-time.

Criminal organizations now deploy specialized tools like WormGPT and FraudGPT, subscription-based services that generate undetectable malware and sophisticated social engineering campaigns for affordable monthly fees.

Recent high-profile incidents demonstrate this evolution.

Business executives in a conference room attending a virtual meeting with multiple screens

The Arup finance team fell victim to a coordinated deepfake video conference featuring multiple fake executives, while North Korean operatives successfully used AI-enhanced identities to pass video interviews at major corporations.

These aren’t simple scams, they’re comprehensive identity fabrication operations that exploit our fundamental trust in audio-visual communication.

$35/MO PER DEVICE

Enterprise Security Built For Small Business

Defy your attackers with Defiance XDR™, a fully managed security solution delivered in one affordable subscription plan.

Global Impact Across Industries

The threat spans continents and industries, with financial services bearing the heaviest burden.

The Asia-Pacific region has experienced dramatic increases in deepfake incidents, while European authorities report growing concerns about AI-enhanced romance scams and business email compromise attacks.

A woman with long brown hair smiling while looking at a phone screen

Perhaps most concerning is the documented infiltration of major corporations by threat actors using AI-enhanced false identities.

These operations establish persistent network access while generating substantial revenue for criminal organizations and state-sponsored programs.

Romance scams have evolved similarly, with criminal networks deploying AI-generated personas that maintain convincing relationships across platforms for extended periods.

The Failure of Traditional Defenses

Legacy fraud detection systems are fundamentally incompatible with AI-powered threats.

Traditional indicators – poor grammar, spelling errors, obvious impersonation attempts – have become obsolete as AI generates perfect, localized content that passes conventional screening while adapting to defensive measures in real-time.

A man with his hands over his eyes as the word safe flashes in red

Current deepfake detection tools demonstrate alarming limitations in real-world scenarios.

While these systems may perform well in laboratory conditions, their accuracy drops significantly against sophisticated deepfakes in actual attacks.

The challenge extends beyond technical detection-behavioral analysis struggles when AI can perfectly mimic legitimate communication patterns and trusted relationships.

Speed compounds the defensive challenge.

While traditional phishing required extensive human planning, AI generates equally effective attacks in minutes.

Security teams cannot process the volume and sophistication of AI-enabled attacks, creating a fundamental capacity mismatch between attackers and defenders.

The Emerging Threat Landscape

Industry experts predict fully autonomous attack campaigns requiring minimal human oversight. Advanced AI systems are gaining the capability to research targets, develop strategies, and execute multi-step attacks independently.

The democratization effect is accelerating, enabling historically less capable threat actors to conduct sophisticated attacks and creating a new class of “citizen social engineers.”

Future threat campaigns will seamlessly combine deepfake video, voice cloning, and personalized text in comprehensive operations designed to overwhelm defenses.

Advanced threat actors are developing AI agents capable of maintaining fake personas across platforms for months, building trust before executing high-value attacks.

A digital AI face in the clouds shooting lightening bolts at a city

Strategic Defense Imperatives

Organizations must fundamentally reimagine their approach to social engineering defense.

Traditional security awareness training becomes insufficient when employees face AI-generated content indistinguishable from legitimate communications.

While zero-trust architectures and multi-factor authentication provide partial protection, comprehensive defense requires AI-native security platforms.

Industry leaders recommend behavior-based detection systems that analyze interaction patterns rather than content alone, combined with robust out-of-band verification processes for high-risk transactions.

The most successful organizations deploy hybrid human-AI defense strategies that leverage machine learning for scale while maintaining human oversight for complex decisions.

Organizational culture plays a crucial role.

Companies that foster environments where employees feel comfortable questioning unusual requests—even from apparent senior executives – demonstrate greater resilience against social engineering attacks.

This cultural shift requires leadership commitment and ongoing reinforcement.

The window for effective preparation continues narrowing as AI capabilities advance. Organizations that act decisively to implement AI-powered defenses while maintaining strong human oversight will be best positioned to navigate this transformation.

Those who delay face exponentially increasing risks as threat actors continue refining their techniques.

The convergence of AI technology with criminal innovation has created a perfect storm in social engineering attacks.

The question is no longer whether your organization will be targeted, but whether you’ll be adequately prepared when sophisticated AI-powered attacks inevitably arrive.

The Breach Report

PurpleSec’s security researchers provide expert analysis on the latest cyber attacks.

Firewall that's on fire
Picture of Tom Vazdar
Tom Vazdar
Tom is an expert in AI and cybersecurity with over two decades of experience. He leads the development of advanced cybersecurity strategies, enhancing data protection and compliance. Tom currently serves as the Chief Artificial Intelligence Officer at PurpleSec.

Share This Article

Recent Newsletters

NewsletterXDR

Why Small Businesses Need XDR In 2025

Why Small Businesses Need XDR In 2025

Contents

Small businesses today face a growing number of cyber threats targeting their devices, networks, and cloud systems. Traditional security tools, such as antivirus or Endpoint Detection and Response (EDR), offer some protection but often fall short against modern, sophisticated attacks.

Extended Detection and Response (XDR) is a unified, efficient solution that has become a must-have for small businesses. It combines multiple security layers into one platform, delivering powerful protection without overwhelming limited resources.

This newsletter explains why XDR is critical for small businesses, highlighting its benefits and how it addresses their unique challenges.

$35/MO PER DEVICE

Enterprise Security Built For Small Business

Defy your attackers with Defiance XDR™, a fully managed security solution delivered in one affordable subscription plan.

What Is XDR?

XDR is a cybersecurity technology that integrates data from endpoints (like laptops), networks, email, and cloud services to detect and respond to threats.

What is extended detection and response XDR

Unlike standalone tools, XDR provides a complete view of a business’s security, using automation and machine learning to spot risks quickly and act on them. For small businesses, this means stronger protection with less effort and cost.

Cybercriminals often target small businesses because they assume limited budgets and expertise make them easy prey. XDR levels the playing field, offering enterprise-grade security that’s simple to manage and affordable.

How XDR Helps Small Businesses Stay Secure

XDR operates by collecting and analyzing data from every corner of your digital environment, ensuring nothing slips through the cracks. It monitors everything from computers and servers to networks and cloud applications, providing a comprehensive picture of what’s happening across the entire system.

Fragmented tools and lack of data integration slows response times

This unified visibility into your infrastructure is crucial for small businesses, which often lack the resources to manage multiple tools or hire dedicated IT staff.

XDR also delivers real-time notifications that highlight potential risks, such as unusual login attempts or malware, while its automation capabilities handle basic fixes—like isolating a compromised device—without requiring constant oversight.

In addition, XDR’s built-in threat intelligence uses advanced analytics to spot new and hidden dangers, such as zero-day attacks or stealthy breaches, that traditional tools might miss.

  • For non-technical staff, XDR simplifies management with a single, intuitive dashboard that replaces the need for multiple logins and complex interfaces, making it easy to understand and act on security alerts.
  • For small businesses, this streamlined approach reduces stress, builds confidence in their defenses, and ensures they can focus on growth without worrying about cyber threats derailing their operations.

Free Security Policy Templates

Get a step ahead of your cybersecurity goals with our comprehensive templates.

IT Security Policy Templates

Why XDR Stands Out For Small Businesses

When compared to other security options, XDR is uniquely tailored to meet the needs of small businesses by offering comprehensive protection without the complexity or high costs of alternative solutions.

For instance, Endpoint Detection and Response (EDR) focuses solely on protecting devices like laptops and servers, leaving networks and cloud environments vulnerable to attacks that exploit those gaps.

XDR, on the other hand, covers all these areas, providing broader security that ensures no part of the business’s digital footprint is left exposed.

xdr vs mdr vs edr

Managed Detection and Response (MDR) relies on external teams to monitor and respond to threats, which can become expensive over time and may not align with a small business’s budget constraints; XDR delivers similar benefits in-house, allowing businesses to maintain control while keeping costs manageable.

Traditional antivirus software, while useful for stopping known threats, often fails to detect unknown or emerging risks, whereas XDR uses smarter, behavior-based detection to catch these sophisticated attacks before they cause harm.

By combining these capabilities into an all-in-one solution, XDR reduces both complexity and expense, making it an ideal choice for small businesses with limited resources that still need robust protection to safeguard their operations and customer trust.

The Breach Report

PurpleSec’s security researchers provide expert analysis on the latest cyber attacks.

Firewall that's on fire

XDR Simplifies Enterprise-Grade Cybersecurity

XDR provides a set of powerful features that directly address the pain points small businesses face: tight budgets, small teams, and growing compliance demands.

Here’s why XDR is the solution they need:

  1. Comprehensive Protection With Less Complexity: Small businesses can’t afford to juggle multiple security tools. XDR pulls everything—endpoint monitoring, network security, and cloud protection—into one platform. This eliminates blind spots and reduces the time spent managing separate systems. For a small team, this simplicity is a game-changer, letting them focus on running the business instead of wrestling with tech.
  2. Cost-Effective Security: Hiring a full security team or buying several tools isn’t feasible for most small businesses. XDR delivers high-level protection at a fraction of the cost by consolidating features into one solution. It cuts the need for extra staff or software, making it a smart investment that fits tight budgets.
  3. Faster Threat Detection And Response: Cyberattacks can cripple a small business in minutes. XDR uses automation to detect threats—like malware or unusual activity—across all systems and respond instantly, such as isolating a hacked device. This speed limits damage and downtime, which small businesses can’t afford to lose.
  4. Scalability For Growth: As a small business expands—adding employees, devices, or cloud services—its security needs grow too. XDR scales effortlessly, adapting to new demands without requiring a major overhaul. It’s a future-proof choice that supports growth without breaking the bank.
  5. Simplified Compliance: Many small businesses must follow industry rules, like data protection laws, which demand monitoring and incident response. XDR meets these requirements in one platform, storing data and generating reports to keep regulators happy. This saves time and avoids costly penalties.

Getting Started With XDR

To make XDR work effectively for small businesses, a thoughtful approach ensures it delivers maximum value without causing disruptions.

The first step is understanding where current security measures fall short, such as identifying gaps in device protection or cloud monitoring, so the business can set clear goals for what XDR needs to achieve.

Choosing the right provider is crucial, and small businesses should look for one that offers easy setup, reliable support, and features tailored to their industry and size, ensuring a smooth implementation process.

Connecting all systems—endpoints, networks, and cloud applications—is essential for maximum coverage, as this allows XDR to monitor and protect every part of the digital environment comprehensively.

Training staff on the basics of using XDR, such as understanding alerts and dashboards, empowers everyone to contribute to security efforts, even if they’re not tech experts.

Finally, businesses should commit to ongoing improvement, regularly tweaking settings and response plans to adapt to new threats or changes in their operations, ensuring XDR remains effective over time. These steps help small businesses integrate XDR seamlessly, providing robust protection without adding unnecessary complexity to their daily routines.

Defy Your Attackers With Defiance XDR™

Defiance XDR™ by PurpleSec is built for small businesses, offering managed security with expert support. It includes virtual CISO services to guide you, letting you focus on growth while staying secure. It’s a hassle-free and affordable way to access enterprise-grade security.

Picture of Joshua Selvidge
Joshua Selvidge
Joshua is cybersecurity professional with over a decade of industry experience previously working for the Department of Defense. He currently serves as the CTO at PurpleSec.

Share This Article

Recent Newsletters

Newsletter

How Cybercriminals Are Shifting Their Attacks In 2025

How Cybercriminals Are Shifting Their Attacks In 2025

Contents

Ransomware and phishing grab headlines, but the real dangers for small businesses often stem from:

  • Poor infrastructure visibility.
  • No strategic guidance.
  • Unpatched vulnerabilities.
  • Weak incident response planning.

$35/MO PER DEVICE

Enterprise Security Built For Small Business

Defy your attackers with Defiance XDR™, a fully managed security solution delivered in one affordable subscription plan.

1. Poor Infrastructure Visibility

Attackers are moving beyond traditional endpoints, such as laptops and desktops, which are now harder to compromise due to improved security tools.

Instead, cloud environments like Google Workspace, Microsoft 365, and AWS are becoming prime targets for attackers, with a 95% increase in cloud breaches in 2022 compared to 2021.

Cyber Criminals Are Shifting Their Attack Strategies

Meanwhile, a recent study reveals that one in three breaches involves an IoT device, such as a printer or smart camera.

These overlooked entry points are a goldmine for threat actors.

In November 2024, a malicious actor named “Matrix” exploited unpatched IoT devices to create a global botnet, using the Mirai malware to launch DDoS attacks.

Traditional security tools like endpoint detection and response (EDR) and Security Information and Event Management (SIEM) were designed for simpler times.

EDR focuses on endpoints, such as laptops and servers, while SIEM aggregates logs but often relies on reactive, rule-based detection.

xdr vs mdr vs edr

These tools operate in silos, failing to provide a unified view of today’s complex IT environments, which include remote workforces, cloud platforms, and connected devices.

The 2025 Enterprise Data Security Confidence Index surveyed 530 cybersecurity leaders on data security, uncovering troubling gaps in visibility, security, and AI readiness.

A staggering 82% of security teams struggle to identify and classify sensitive data. In addition, 53% of these teams lack real-time visibility, resulting in delays of days or even weeks to locate sensitive data assets.

a business man at a computer looking frustrated

2. Lack Of Strategic Guidance

The rise of “DIY” security tools has made it tempting for SMBs to cobble together low-cost solutions on their own. But without expert guidance, these efforts often fall short.

Firstly, valuable time is diverted from essential business functions, such as growth, operations, and R&D. Secondly, DIY security poses risks due to a lack of expertise and insight into what to watch for or consider. This expertise can only be gained by individuals with prior experience in CISO positions.

That’s why it’s unsurprising to learn that only 14% of small businesses have a cybersecurity plan. Patching together lightweight software or relying on your IT provider’s basic security suite leaves gaps that attackers exploit.

Beginning your security journey?

Start with the CIS-18 framework, which is tactical, attack-centric, and requires no new technology, just time to implement.

Pairing this with straightforward questions about network devices and penetration tests, and potentially a virtual CISO, provides a practical and digestible approach to efficiently reducing risks.

PurpleSec’s crosswalk mapping (e.g. NIST CSF, CIS-18, PCI) simplifies compliance overlap— check one box, hit three goals.

Free Security Policy Templates

Get a step ahead of your cybersecurity goals with our comprehensive templates.

IT Security Policy Templates

3. Inconsistent Patching

Unpatched systems present a prime target for hackers.

That’s because 60% of breaches involve vulnerabilities with available patches that weren’t applied. With AI accelerating attacks, the time to compromise a system has now dropped to under 6 minutes.

This means traditional monthly patching schedules can’t keep up. Worse, prioritizing patches solely by CVSS scores ignores real-world attack risks, exposing critical systems.

A continuous vulnerability management program is the solution. This means daily scanning and patching, with remediation prioritized by severity and exploitability.

For SMBs, Defiance XDR™ automates patch management, reducing the mean time to remediate from 60–150 days to hours. Our security experts analyze threats to ensure patches address the most pressing risks first, keeping your business secure without disrupting operations.

What is incident response

4. Weak Incident Response Planning

When a cyberattack hits, your incident response plan—the structured process for detecting, containing, and recovering from a security breach—can make or break your small business.

Without a robust plan, even a minor security incident can spiral into a major crisis, leaving you grappling with prolonged downtime, skyrocketing costs, and a tarnished reputation.

Data paints a stark picture:

On average, it takes organizations 204 days to identify a breach and an additional 73 days to contain that breach. Further, 47% of SMBs do not have an incident response plan.

This gap in preparation is a critical vulnerability that attackers exploit.

The good news?

You don’t need a big budget or a dedicated IT team to build a solid defense. Here are a few actionable steps tailored for SMBs:

  • Define Roles Upfront: Identify who’s responsible for each phase—detection, containment, eradication, and recovery. Assign a point person for each, even if it’s just your office manager or a trusted employee.
  • Spot Threats Early: Use free cybersecurity tools like network monitoring software to catch anomalies before they escalate.
  • Map Out Communication: Create a one-page guide for whom to call—staff, customers, law enforcement—and what to say.
  • Practice Makes Progress: Test your plan yearly with a simple tabletop exercise. It’s low-cost and reveals weaknesses fast.
The cost of ransomware on the rise

4. Ransomware Attacks

Ransomware remains a top threat, with the average cost of ransomware increasing by 574% from 2019 to 2024 ($761,106 to $5.13M).

52% of global organizations reported ransomware hitting their supply chains in 2023, putting partners and vendors at risk.

Why?

  • First, it’s easier to target smaller organizations with fewer resources to dedicate to security. Attackers will compromise a partner or vendor to gain access to their primary target.
  • Second, attackers can buy malicious code cheaply through Ransomware-as-a-Service (RaaS). New affiliate models have emerged as a new way to expand their business model.
  • Third, AI-driven code development has made malware more sophisticated and faster to produce.
  • Fourth, ransomware gangs are forming strategic alliances, pooling resources to launch coordinated attacks.

The result? Average ransom demands hit $1.54M in 2023.

The Breach Report

PurpleSec’s security researchers provide expert analysis on the latest cyber attacks.

Firewall that's on fire

Defiance XDR™ proactively detects and responds to ransomware in real time, stopping attacks before they encrypt your data. Pair this with regular backups to reduce your downtime and improve the recovery time of your data.

Learn More: How Does Ransomware Spread?

Social engineering plans and pricing

5. Phishing And Vishing

Business email compromise (BEC) and credential theft via phishing and vishing are skyrocketing, with 74% of data breaches involving the human element.

Attackers no longer rely on generic phishing emails. They craft advanced, tailored campaigns using publicly available data from LinkedIn profiles, corporate websites, or your “About Us” pages.

They’ll scan your network for vulnerabilities, then target specific business units.

For example, your finance team might receive a fake invoice from a “known vendor,” or an employee might get a vishing call from “IT” requesting a password reset.

In advanced cases, attackers will deploy tactics to throw their victims off guard, such as attempting to get them to reply to a phishing email. Or, they will phish the user, leveraging multiple accounts and attack scenarios.

Bottom line:

Annual phishing tests, quizzes, and self-training aren’t enough to stop these sophisticated attacks.

PurpleSec’s social engineering services take a different approach. We design custom phishing and vishing campaigns tailored to your business units and goals, then provide actionable remediation plans to strengthen your defenses.

AI-Powered Attacks Are Happening Now

AI-powered cyber attacks are smarter, faster, and more damaging, enabling cybercriminals to scale operations, evade detection, and strike with precision.

  • Phishing: AI crafts hyper-personalized emails mimicking trusted sources, with a 60% success rate in deceiving victims.
  • Deepfakes: AI generates realistic fake audio/videos to impersonate executives or loved ones, tricking victims into financial or data disclosures.
  • Malware: AI creates adaptive, mutating malware that evades traditional antivirus, persisting to steal data or disrupt systems.
  • Reconnaissance: AI automates rapid network scans and builds detailed victim profiles for targeted social engineering.
  • Scaling/Personalization: AI launches tailored, high-volume attacks, like fake invoices, overwhelming defenses with precision.

Secure Your LLMs

PromptShield™ is the first AI-powered firewall and defense platform that protects enterprises against the most critical AI prompt risks.

Unfortunately, traditional security can’t keep up with AI’s speed and adaptability. This means defenders must integrate transparent AI with existing tools, maintain human oversight, and regularly update systems to counter evolving threats.

AI Vs AI In Cybersecurity

Autonomous AI agents will independently seek weaknesses, poison training data, or tamper with open-source models, embedding backdoors.

These “malware with a brain” attacks are stealthy, fast (compromising systems in under an hour), and disrupt interconnected AI ecosystems, causing chaos like altered medical records or financial market disruptions.

Picture of Jason Firch, MBA
Jason Firch, MBA
Jason is a proven marketing leader, veteran IT operations manager, and cybersecurity expert with over a decade of experience. He is the founder and President of PurpleSec.

Share This Article

Recent Newsletters

Newsletter

Small Business And Cybersecurity Planning

Small Business And Cybersecurity Planning

Contents

Why Small Businesses Need A Cybersecurity Plan

I’m talking to you, small business. Every last one of you – business owners and non-profit executives – needs to be considering cybersecurity.

Implementation will differ based on both where and how your company operates – things such as industry and values – and also the organization’s size and growth plan.

Learn More: The True Cost Of A Data Breach To Small Business

Five truths apply to small organizations, even the super small, or microbusinesses. Single-person businesses still operate websites and sometimes web applications.

Some data, perhaps lots, is likely stored in one or more Software-as-a-Service (SaaS) applications’ data stores.

You manage email and own a domain.

Factor in staff members who operate these things, and you can inspect the moving parts to determine their complexity and your risk.

I define cybersecurity as the people, processes, and technology protecting the confidentiality, availability, and integrity of data. Keep private data private, and enable proper access to each type of data.

So, dig into these 5 truths regarding cybersecurity.

$35/MO PER DEVICE

Enterprise Security Built For Small Business

Defy your attackers with Defiance XDR™, a fully managed security solution delivered in one affordable subscription plan.

1. It Begins With Leadership

Owners and executive leaders have to start (and ultimately own) the effort toward better cybersecurity.

The effort meshes strategy, funding, timing, and alignment with the organization’s risk posture.

Group of business executives huddled around looking concerned

Start with codifying risk posture:

  • Who are you as an organization (what are your values, mission, and vision)?
  • What are you protecting?
  • Growing?
  • What’s coming after you, and how do you handle it?
  • What do you ignore?

Who’s responsible for knowing and acting on these answers?

The leadership in the business. For non-profits, that’s the Executive Director and Board. Small businesses? Usually, this is the ownership and high-level leaders.

Know how you determine and manage risk. Then apply that to technology and securing data and technology.

2. The Early Iterations Of Intentional Cybersecurity

First, understand that you’ll need both behavior change and implementation of key technical changes, such as stronger and more regular backups, if those aren’t in place.

Plug the organization’s immediate threats first. Many of these are indeed behavior-based – cyber hygiene.

Stated another way, address the perils common to all organizations; then, handle those specific to your industry and organization.

At this stage, the doors and windows are locked; now address the skylights, the garage door opening system, and other vulnerable peripherals.

Cybersecurity’s got a significant strategy and business piece to it.

Is a specific form of compliance a concern for your business? If you handle financial, health, or legal information, it may be.

Assess

What do you have – hardware, software, IoT devices? Data. Staff?

Policies, processes, and procedures.

If you brought in a new person today and that person’s job was to become a company operations expert in a month, how would you approach training?

Free Security Policy Templates

Get a step ahead of your cybersecurity goals with our comprehensive templates.

IT Security Policy Templates

Fix The Easy And Plan To Fix The Rest

Fast, easy, cheap. Pick one or two, right?

Look for the first changes after learning your risk posture to be all 3 – fast, easy, and cheap.

What can you do fast, easy, and (relatively) cheap?

  • Communicate the focus on information security to the team.
  • Implement basic authentication hygiene, including best practices for managing passwords and using multifactor authentication.
  • Backup your data and test that you can restore it.
  • Consider information security as a business concern.
  • Update your systems when updates are released.
  • Evaluate your antimalware software. Or purchase and implement some.

3. And After That? Make A Plan

Build policies, processes, and procedures relevant to data access.

Consider the principle of least privilege, which means our user accounts only need access to what they work on.

We’re safer if we restrict access this way by default.

Train your staff.

Learn More: How To Implement Social Engineering Awareness Training

Computers and the Internet enable easy fraud, so inform your staff regularly about fraud and crime trends so they’re equipped to handle scams…and ideally motivated to shut them out.

A group of business professionals looking at a table with digital display

4. Planning And Strategy – Maintain And Improve

hat’s an endpoint?

Before assessing what you have and what you need, maybe this was a new word.

Endpoints touch the Internet, and accessing the Internet is where information security becomes cybersecurity.

Beyond the early hygiene work, it’s a program, not a project, to build a more secure organization.

With strategic planning and often the aid of a proven framework, small business owners can determine what, when, and how to act.

Some work can be completed concurrently by separate teams.

A few suggestions:

  • Start with conversations if you haven’t fully documented all of the hardware and software you use. Document the results and discuss some more.
  • Determine what phases of increasing security your company will undertake and the order in which to execute them.
  • Build those policies, processes, and procedures.
  • Classify your data, likely as a fairly early step.
  • Determine the role AI has in your company’s operations.
  • Train your people, and do so regularly. A lot changes in information security/cybersecurity in a year.
  • Reassess your information security as a whole at frequent regular intervals if you’re a growing organization.
  • What staff members and roles do you need to incorporate into the ongoing effort? Do you need to hire or outsource some of the work?

The Breach Report

PurpleSec’s security researchers provide expert analysis on the latest cyber attacks.

Firewall that's on fire

5. Planning And Strategy – Maintain And Improve

What’s an endpoint?

Before assessing what you have and what you need, maybe this was a new word.

Endpoints touch the Internet, and accessing the Internet is where information security becomes cybersecurity.

Beyond the early hygiene work, it’s a program, not a project, to build a more secure organization.

With strategic planning and often the aid of a proven framework, small business owners can determine what, when, and how to act.

Some work can be completed concurrently by separate teams.

A few suggestions:

  • Start with conversations if you haven’t fully documented all of the hardware and software you use. Document the results and discuss some more.
  • Determine what phases of increasing security your company will undertake and the order in which to execute them.
  • Build those policies, processes, and procedures.
  • Classify your data, likely as a fairly early step.
  • Determine the role AI has in your company’s operations.
  • Train your people, and do so regularly. A lot changes in information security/cybersecurity in a year.
  • Reassess your information security as a whole at frequent regular intervals if you’re a growing organization.
  • What staff members and roles do you need to incorporate into the ongoing effort? Do you need to hire or outsource some of the work?

6. Continuous Improvement Builds Maturity

A long-term iterative process of continuous improvement, like any business initiative -includes regular (and sometimes daily) practices.

The work doesn’t end. It becomes more and more effective, though.

Remember your business continuity, incident response, and disaster recovery plans. The smaller you are, the simpler they can be, but they need to be in place and accessible even if no computer systems can be reached or used.

Be strategic, then tactical, and then strategic again.

Consider adhering to the IG1 safeguards of the CIS controls and safeguards as a framework as you mature.

Then, determine whether the IG2 and IG3 safeguards benefit you and the work you do.

It's Worth Doing

Remember, information security, cybersecurity, and compliance work together.

Policies, processes, and procedures help small organizations combat cybercrime and also detect it if cyber attackers strike.

For these reasons alone, improving cybersecurity is worth your time. Start with cyber hygiene, and grow your program from there, across time.

It’s worth doing, especially while you’re small and growing when it’s both simpler and easier.

A foundation of cybersecurity benefits organizations of all sizes and helps them be vigilant and ready to address the technologies of tomorrow.

Picture of Jason Firch, MBA
Jason Firch, MBA
Jason is a proven marketing leader, veteran IT operations manager, and cybersecurity expert with over a decade of experience. He is the founder and President of PurpleSec.

Share This Article

Recent Newsletters

Newsletter

Into The Gray Zone: The Hazards Of AI Without Oversight

Into The Gray Zone: The Hazards Of AI Without Oversight

Contents

From facial recognition to autonomous vehicles, artificial intelligence (AI) and machine learning (ML) technologies are rapidly transforming industries in profound ways. But these powerful innovations come with unforeseen risks.

Behind the scenes, unregulated “shadow” AI/ML systems are being deployed without oversight, accountability, or transparency.

As these opaque models take on real-world decisions affecting human lives, a chorus of concerns has emerged around their potential dangers if developed recklessly.

Without illumination, these shadow systems embed unseen biases and inequities.

As AI proliferates, our society faces a choice: continue down our current path of breakneck deployment, or confront head-on the hazards within these technologies and bring accountability.

Secure Your LLMs

PromptShield™ is the first AI-powered firewall and defense platform that protects enterprises against the most critical AI prompt risks.

What Is Shadow AI/ML?

The term “shadow AI/ML” describes AI and ML systems that operate without sufficient transparency or accountability.

These models are deployed for sensitive tasks like:

  • Facial recognition
  • Predictive policing
  • Credit decisions
  • Content moderation
A dimly lit cable infested data center

However, they frequently lack documentation, auditing, or governance over their internal logic.

The proprietary nature of many shadow AI systems prevents ethical scrutiny of their inner workings, even as they take on critical real-world functions.

This opacity around how shadow AI/ML models operate has raised concerns, especially as they become entrenched in high-impact domains.

For one, the lack of transparency and oversight for shadow AI systems raises significant risks around biased or flawed decision-making.

If the training data contains societal biases or discrimination, those can be perpetuated and amplified by the AI algorithms.

For example, facial recognition has exhibited racial and gender bias if models are trained on datasets that lack diversity.

Similarly, predictive policing systems trained on historically biased crime data can disproportionately target specific communities.

Even with unbiased data, algorithms can entrench societal prejudices if developer teams lack diversity and awareness of inclusiveness.

Furthermore, the autonomous nature of shadow AI taking actions without human involvement can lead to harmful outcomes.

If the model makes incorrect predictions or recommendations, there is no failsafe to prevent real-world harm.

For instance, AI screening job applicants could develop biased notions of ideal candidates and discount qualified people unjustly.

The Breach Report

PurpleSec’s security researchers provide expert analysis on the latest cyber attacks.

Firewall that's on fire

Examples Of Shadow AI

  • Recruitment Bias: In 2018, Amazon scrapped an AI resume screening tool that exhibited bias against women. The algorithm penalized resumes containing words like “women’s chess club”, downgrading graduates of all-women’s colleges. This resulted in biased recommendations favoring male applicants.
  • Biased Content Moderation: In 2020, Facebook’s AI mistook Black men’s posts discussing racial justice as violations of policies against hate speech and nudity. The automated moderation suppressed their voices during an important movement.
  • Autonomous Vehicle Accidents: In 2018, an Uber self-driving car struck and killed a woman crossing the street in Arizona. The AI failed to identify the pedestrian at night. In 2016, a Tesla car in autopilot mode fatally crashed into a tractor-trailer that its sensors did not recognize. The accident killed the Tesla driver.
  • Harmful YouTube Recommendations: In 2019, YouTube’s AI recommendation algorithm was found to steer viewers down extremist “rabbit holes”, recommending increasingly radical and divisive content. This amplified harmful misinformation.
  • Racial Profiling In Healthcare: A 2020 study found a widely used healthcare algorithm exhibited racial bias, underestimating black patients’ needs compared to white patients. This could exacerbate health disparities.
  • Toxic Chatbots: In 2016, Microsoft launched Tay, an AI chatbot that began spouting racist, sexist, and offensive views after being targeted by trolls online. This demonstrated risks of uncontrolled machine learning.
  • Discriminatory Hiring Practices: HireVue, an AI recruiting tool, was found to favor certain intonations and speech patterns, potentially disadvantaging minorities during video interviews.

The rapid pace of AI development using complex techniques like deep learning exacerbates these issues with shadow systems.

The rush to deploy before thoroughly evaluating for fairness and safety means potential harms are outpacing governance.

And the black-box nature of deep learning algorithms makes it difficult to audit internal processes, even as they take on sensitive tasks.

Such instances underscore how today’s largely unregulated AI can lead to real ethical perils around bias, censorship, security, and safety.

A group of professionals at a desk looking at a monitor

Steps For Addressing The Risks

To address the risks of shadow AI systems, the AI/ML community needs to prioritize practices and principles that increase accountability, auditability, and transparency.

  1. Thorough documentation and procedures are essential – data provenance should be tracked to evaluate for bias, and every stage of model development needs to be recorded.
  2. Ongoing performance monitoring, especially across different demographic groups, can identify if the model exhibits unfair bias.
  3. Independent 3rd-party auditing of algorithms for discrimination and ethical failures is also critical.
  4. For high-risk AI applications like self-driving vehicles and social moderation, maintaining meaningful human oversight and decision validation is key to preventing harm. Humans must remain “in the loop” for reviewing and approving AI-generated outputs that impact human lives and society.
  5. In some cases, certain sensitive use cases may require restrictions on AI deployment until robust governance is established, rather than rapidly deploying shadow models with unchecked risks.
  6. Adopting standards like the EU’s Ethics Guidelines for Trustworthy AI will also guide the community toward fair, accountable AI development and integration.
  7. Organizations must ensure their AI teams represent diverse perspectives to identify potential harms. Democratically governing these rapidly evolving technologies is crucial to uphold ethics and human rights.

$35/MO PER DEVICE

Enterprise Security Built For Small Business

Defy your attackers with Defiance XDR™, a fully managed security solution delivered in one affordable subscription plan.

Conclusion

Realizing the promise of AI/ML responsibly will require deliberate efforts from all stakeholders.

Policy makers, researchers, developers, and civil society must collaborate to illuminate the processes within shadow systems through increased transparency and accountability measures.

Establishing ethical governance for AI will be crucial for earning public trust amidst rapid technological change.

The path forward demands sustained diligence – continually evaluating AI systems for bias, auditing algorithms, and maintaining human oversight for high-risk applications.

With sound ethical foundations guiding AI innovation and integration into society, these transformative technologies can be developed for the betterment of all.

But an ethical AI future relies on coming together to shed light on shadow systems today.

Picture of Jason Firch, MBA
Jason Firch, MBA
Jason is a proven marketing leader, veteran IT operations manager, and cybersecurity expert with over a decade of experience. He is the founder and President of PurpleSec.

Share This Article

Recent Newsletters