Short answer: AI is increasing the scale and sophistication of cyber threats, while gaps in governance, access controls, and employee practices leave organizations exposed. Recent data highlights rising AI-related losses, ransomware, software vulnerabilities, and the growing role of automation in phishing and cyberattacks.

The figures below come from primary sources published between April 2024 and September 2026. Each figure describes a specific population, noted in the table, and should not be read as the probability that any given business will experience the same outcome. Numbers in brackets refer to the reference list at the end of this playbook.

Short answer: Bay Area organizations face growing risks from vendor fraud, ransomware, and system disruptions, while California’s evolving privacy laws add strict breach notification deadlines and new compliance obligations. Proactive cybersecurity and clear AI governance help organizations protect sensitive data and prepare for these risks.

Bay Area organizations combine early AI adoption, valuable data, and dense vendor relationships. Employees here tend to try new AI tools quickly. Firms in legal, finance, manufacturing, and the nonprofit sector hold exactly the data and payment flows attackers want. And organizations in the region are already being hit.

Recent local incidents

• City of Pittsburg (incident February 12, 2026; publicly disclosed August 5, 2026): An email impersonating a known city vendor led to an unauthorized ACH payment of $913,839, discovered five days later. Police froze the receiving account and recovered about $696,000; the city is pursuing the remainder through insurance [19][20].
• Foster City (March 19, 2026): A ransomware attack forced the San Mateo County city to suspend non-emergency services and declare a local emergency [21].
• Suisun City (August 7, 2026): Malware disrupted city systems, including 911 routing, which was temporarily redirected to Solano County dispatch. City departments did not fully reopen to the public until September 22, and a federal investigation is ongoing [22][23].

These incidents involved public agencies rather than private companies, and public reports have not attributed any of them to AI. They matter to private organizations because vendor impersonation, ransomware, and credential theft are exactly the techniques AI is making cheaper to run against everyone.

California Rules Raise the Stakes

California’s breach notification law now sets a 30-day clock. Since January 1, 2026, a person or business that owns or licenses computerized data containing defined categories of unencrypted personal information must notify affected California residents within 30 calendar days of discovering or being notified of a qualifying breach [17]. Key details:

• Permitted delays are narrow. The deadline can accommodate the legitimate needs of law enforcement and the measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
• Service providers have their own duty. A business that maintains covered data on behalf of another organization must notify the owner or licensee immediately following discovery.
• The Attorney General gets a copy. When notice goes to more than 500 California residents, a sample copy must be submitted to the Attorney General within 15 calendar days of notifying affected consumers.

New California privacy regulations add further obligations for businesses covered by the California Consumer Privacy Act (CCPA) [18]:

• Risk assessments: Requirements took effect January 1, 2026, for covered processing activities. Assessments for activities that began before 2026 and continue must be completed by December 31, 2027, with the first attestations due April 1, 2028.
• Automated decision-making technology (ADMT): Businesses that use technology to replace or substantially replace human decision-making for significant decisions about consumers, such as employment, lending, housing, education, or health care, must comply with notice, opt-out, and related requirements beginning January 1, 2027.
• Cybersecurity audits: Annual independent audits apply to CCPA-covered businesses whose processing presents significant security risk under the regulation’s criteria. For businesses that meet those criteria, revenue determines the first due date: April 1, 2029 (over $100 million), April 1, 2029 ($50 to $100 million), or April 1, 2030 (under $50 million).

Whether and how these rules apply depends on the organization, its data, and its activities. Review them with qualified counsel.

AI risk reaches an organization from three directions at once. Treating AI security as a single problem leaves blind spots. Treating it as three connected fronts makes it manageable.

This structure aligns with the draft Cyber AI Profile released by the National Institute of Standards and Technology (NIST) in December 2025, which organizes AI security around securing AI systems, using AI for defense, and thwarting AI-enabled attacks [13].

Short answer: AI enables attackers to create convincing phishing messages, impersonate executives with deepfake voices and video, exploit software vulnerabilities faster, and automate attacks at scale. Defenses should prioritize phishing-resistant MFA, independent payment verification, rapid patching, continuous monitoring, and realistic employee training.

Attackers use AI to do the same jobs they have always done, only faster and with fewer tell-tale mistakes. Four patterns stand out.

1. Phishing that no longer looks like phishing

Employees have long been trained to spot bad grammar, odd formatting, and generic greetings. AI removes all three. In a peer-reviewed experiment co-authored by security researcher Bruce Schneier, an AI tool researched each participant from public information and wrote a personalized email with no human help. Those emails drew a 54% click rate, matching emails written by human experts, versus 12% for a generic phishing email [4].

The study had clear limits: 101 participants across four experimental groups, and it measured clicks rather than stolen passwords or compromised businesses. The takeaway is not that 54% of your staff will fall for an attack. The takeaway is that automated, personalized phishing can be as persuasive as a skilled human attacker, and authors estimate it can make large campaigns far more profitable to run [4]. Tailored attacks once reserved for large enterprises are becoming economical against smaller organizations.

Verizon’s 2026 report adds a mobile dimension: in phishing simulations, mobile-based lures drew about 40% higher engagement than email [3]. Many employees read work messages on personal phones that company filters do not reach.

2. Deepfake voices and video in payment fraud

Voice cloning requires only a short sample of someone’s speech, which is easy to find in webinars, podcasts, and social media videos. In a widely reported 2024 case, an employee at the engineering firm Arup transferred about $25 million after a video call in which the “CFO” and several “colleagues” were deepfakes [6]. In September 2026, Reuters reported, citing two sources, that fraudsters diverted €95 million (about $108 million) from Fideuram, the private banking arm of Italy’s Intesa Sanpaolo. The scheme reportedly began with a message impersonating the group’s CEO, followed by a phone call using an AI-cloned voice of a senior law-firm partner to make the request seem legitimate. More than half of the money was recovered [7].

Smaller organizations face the same play at smaller scale: a cloned voice of the owner asking the bookkeeper for an urgent wire, or an AI-written email from a “vendor” announcing new bank details. The FBI recorded more than $30 million in business email compromise losses involving AI in 2025 [1]. The real figure is likely higher, because victims often cannot tell whether AI was involved.

3. Faster exploitation of unpatched systems

Exploitation of a known software flaw overtook stolen credentials as the leading way attackers got in, accounting for 31% of breaches in Verizon’s 2026 report [3]. Verizon identified 15 attack techniques that generative AI is now enhancing, from finding weaknesses to developing malware [3]. The gap between a flaw becoming public and attackers using it keeps shrinking.

4. Attacks that run themselves

In November 2025, AI company Anthropic disclosed that a state-sponsored group had used its AI coding tool to run a cyber-espionage campaign against about 30 organizations, with AI performing an estimated 80% to 90% of the work [5]. Nation-state operations are not the typical threat to a 60-person accounting firm, but the lesson carries down: as the labor cost of attacking falls, more organizations become worth attacking.

How to defend Front 1

• Adopt phishing-resistant MFA, starting with privileged accounts. Phishing-resistant MFA means FIDO2/WebAuthn passkeys or hardware security keys. Put it first on administrator, email, finance, remote-access, and IT provider accounts, then extend it to everyone.
• Use number matching as an interim step only. Authenticator app number matching blocks “approval fatigue” attacks and is far better than text-message codes, but CISA describes it as an interim mitigation for organizations not yet able to deploy phishing-resistant MFA, not a replacement for it [14].
• Verify every payment change out of band. Any request to send money, change bank details, or buy gift cards is confirmed by calling a phone number already on file from a prior, trusted record, never one supplied in the request. Require a second person to approve new payees and bank-account charges.
• Treat code words as optional backup, not a control. A shared phrase between executives and finance staff can add friction for an impersonator, but code words can be overheard, stolen, or socially engineered. Callback verification and dual approval remain the controls that matter.
• Lock down email authentication. SPF, DKIM, and enforced DMARC policy make it much harder for attackers to send email that appears to come from your domain.
• Prioritize patching by real-world risk. Fix vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog and flaws in internet-facing systems (firewalls, VPNs, remote access, web applications) first and fastest, typically within days [15]. Handle other critical updates on a defined, shorter cycle than routine patches.
• Monitor around the clock. Attacks rarely start at 10a.m. on a Tuesday. Continuous monitoring and alerting on endpoints, email, and cloud accounts catch activity outside business hours.
• Train with realistic simulations, including text-message and voice scenarios. Teach employees to verify the request through a trusted channel rather than judge the writing or the voice.

Short answer: Shadow AI can expose sensitive client data, credentials, and confidential business information when employees use unapproved tools or personal accounts. Organizations can reduce these risks with clear AI usage policies, approved business tools, technical controls, and practical employee training.

Shadow AI is the use of AI tools at work without the organization’s knowledge or approval. Employees are usually trying to write the proposal faster, summarize the contract, or fix the spreadsheet forum

What the data shows

• In a May 2026 survey of 1,005 U.S. workers at companies with 500 or more employees that provide paid AI tools, 79% had entered sensitive information into AI tools, and 31% had entered login credentials or API keys [8].
• Half of these workers had found ways around their employer’s AI restrictions [8].
• A 2026 enterprise study by data-security firm Cyberhaven found that about 40% of AI interactions involved sensitive data, with a substantial share of AI use running through personal rather than corporate accounts [9].
• Among breached organizations in IBM’s 2026 study, 43% reported incidents involving shadow AI and 68% lacked AI governance policies [2].

Short answer: Connecting AI to business systems can introduce new paths for data exposure, prompt injection, compromised integrations, and unauthorized actions. Organizations should limit AI access, secure connectors and networks, validate outputs, require human approval for high-risk actions, and maintain clear monitoring and incident response procedures.

The third front opens when an organization connects AI to its own data, applications, and network. AI assistants that read email and files, website chatbots, and AI agents that send messages or update records create new ways in and new ways for mistakes to spread. IN IBM’s 2026 study, more than 20% of breached organizations reported a breach targeting AI models or applications, and the most common causes were weaknesses in the surrounding systems: compromised APIs, applications, or plug-ins (27%) and cloud misconfigurations affecting AI workloads (27%) [2].

Three ways an AI platform can become the path into your business

Risk 1: AI assistants that see too much

Business AI agents generally respect the file permissions an organization already has. That sounds safe until those permissions are examined. Years of “share with everyone” links, old project folders, and inherited access mean many employees can technically open files they should never see, such as payroll spreadsheets, HR investigations, or partner compensation. Before AI, those files were hard to find. With an AI assistant, anyone can simply ask for them. Cleaning up permissions before rolling out an AI assistant is one of the most important steps on this front.

Risk 2: Prompt injection and manipulated AI tools

Prompt injection is an attack in which hidden or crafted instructions cause an AI tool to ignore its intended rules. The instructions can be typed into a chatbot or hidden inside a document, email, or web page the AI reads. The OWASP GenAI Security Project ranks prompt injection as the number one risk in its 2026 Top 10 for LLM applications, followed by sensitive information disclosure and excessive agency [10]. OWASP also states that it is unclear whether any fool-proof prevention exists [11].

The practical response is containment. Assume an AI tool can be fooled, and design the system so that a fooled AI cannot reach much or do much. Permission limits enforced by the application (not by instructions to the model), human approval for high-risk actions, and validation of AI output before it is used all reduce the consequences [11].

Risk 3: AI agents with too much power

AI agents go beyond answering questions. They send emails, move files, update the CRM, or run code. OWASP’s Top 10 for Agentic Applications, published in December 2025, is led by agent goal hijacking, tool misuse, and identity and privilege abuse [12]. An agent with administrator-level access that gets manipulated can do administrator-level damage.

Risk 4: Internal networks and applications

AI tools increasingly sit inside the network: coding assistants on developer laptops, agents with access to file servers, and integrations that connect cloud AI services to internal databases. Joint guidance from the NSA, CISA, FBI, and international partners on deploying AI systems securely emphasizes controlled API access, segregation of sensitive environments, and incident management planning [16]. For most small and mid-sized organizations, that translates into the controls below.

AI integration and application control table

The OWASP AI risk lists in plain English

Short answer: AI-era cyber risks vary by industry: manufacturers face costly downtime, legal and accounting firms must protect client confidentiality, and nonprofits need to preserve donor and community trust. Each can reduce exposure through stronger access controls, clear AI policies, verified payment procedures, and recovery planning tailored to its operations.

Manufacturing and logistics

For manufacturers, the costliest AI-era risk is downtime. Ransomware that reaches production systems stops shipments, and faster exploitation of unpatched equipment and remote-access tools makes that more likely. Vendor-impersonation and deepfake fraud also target purchasing and accounts payable teams that handle frequent supplied payments. Priorities: segment operational systems from the office network, patch internet-facing and remote-access systems first, verify every bank-detail change by callback, and set and test recovery time objectives for production systems.

Legal and accounting firms

For professional services firms, the core AI-era risk is confidentiality. A client matter pasted into a personal AI account can raise professional-responsibility questions. Wire fraud aimed at settlements, closings, and tax refunds is a natural fit for AI-written emails and cloned voices. Priorities: a firm-controlled AI tool with defined permitted uses, a clear rule against client data in personal AI accounts, permission cleanup before AI assistants go live, and dual approval with callback verification for every wire.

Nonprofits

For nonprofits, the AI-era risk is donor and community trust. Nonprofits hold donor payment information, beneficiary records, and grant data, often with lean staff and volunteers who use personal devices and free tools. AI-written emails impersonating an executive director or a funder are hard to spot. Priorities: phishing-resistant MFA for administrators and finance staff, MFA for everyone with system access including volunteers, a short tiered AI policy, and clear rules for donor and client data.

Short answer: A practical 90-day roadmap helps organizations reduce immediate cyber risks, gain visibility into AI use, and build long-term resilience. Prioritize payment safeguards, MFA, and tested backups first, then strengthen AI governance, access controls, monitoring, and incident response with clear owners and documented results.

The roadmap below is sequenced for an organization of 20 to 250 people starting with limited AI controls. Response and recovery come first, because no organization should wait three months to learn whether its backups restore. Assign every action an owner and record evidence when its complete.

Days 1-30: Reduce the biggest risks and prepare to respond

Days 31-60: Get visibility and control AI use

Days 61-90: Build resilience

This checklist is an informal discussion tool, not a scored assessment. Answer each question Yes, No, or Not applicable. Any “No” on an item marked Critical is a priority gap regardless of how many other items are complete. Use the results to start a conversation with leadership and your IT provider.

Front 1: Outside attackers

Front 2: Employees and shadow AI

Front 3: AI platforms, integrations, and internal systems

Adopt the following template to your organization. Review it with legal counsel and your IT provider before adopting it.

PC Professional has supported Bay Area businesses and nonprofits since 1981. The fundamentals that protected organizations through the arrival of the PC, the internet, and the cloud now protect them against AI-related threats. What has changed is how quickly those fundamentals need to be in place.

• AI security readiness reviews that map your exposure across all three fronts and turn this playbook into a prioritized plan with owners and dates.
• Managed cybersecurity including MFA rollout, email authentication, prioritized patch management, and 24/7 monitoring.
• AI policy and safe adoption consulting to select approved tools, clean up permissions before AI assistants go live, scope integrations, and train your team.
• Backup and disaster recovery with defined recovery objectives and regular restore testing. Backups speed recovery from ransomware; preventing and responding to data theft requires the other controls in this playbook.
• Hybrid support from a local team, remote and on-site, with a real PC Professional team member picking up the phone within 15 minutes and flexible agreements without long-term lock-ins.