Guardz Report: 9 Out Of 10 SMBs Have Compromised Users as AI-Driven Attacks Reshape the MSP Threat Landscape

Guardz reports that nine out of ten SMBs in its dataset have at least one compromised user account, attributing a growing share of incidents to AI‑driven phishing, account takeover, and business email compromise campaigns.[2] The release emphasizes how affordable generative AI tooling is being used to automate and personalize attacks at scale, increasing identity, SaaS, and data leakage risks for small businesses and the MSPs that manage them.[2]

The Guardz report finds that roughly 90% of SMBs monitored have at least one compromised user account, with identity-focused attacks such as session hijacking and business email compromise increasingly driven by affordable generative AI tooling.[1][6][8] It highlights how AI is being used to automate and personalize phishing, credential theft, and account takeover at scale, expanding risks across identity, SaaS, and MSP-managed cloud environments.[1][3][8] From a RealGround perspective, this reflects a clear case of malicious AI use: adversaries are weaponizing generative and agentic AI to increase the efficiency and success rate of intrusion campaigns against SMBs and MSPs. Practically, MSPs and SMBs should implement continuous AI-focused red teaming and structured readiness assessments to test identity defenses against AI-enhanced phishing and session hijacking, while AI CISO-level guidance can help align access controls, SaaS protections, and incident response processes to this new AI-driven threat landscape.