If you own a small business in Tulsa, you have probably heard that criminals are now using AI to break into companies. You may have wondered whether that changes anything for a ten-person office in Broken Arrow or a clinic in Owasso. It does, though not in the way the headlines suggest. Whether you have a local IT provider in Tulsa or you handle things yourself, it helps to know what has actually changed and what hasn’t.
The worry is not just coming from owners. A WatchGuard survey found that 91% of the IT and security people asked fear AI-driven attacks, and 54% said they can’t watch their systems around the clock. These are the people whose job is security, and most of them are uneasy.
NIST has also been drawing attention to AI agents. So this is a good time to go through what AI means for a small office, where the real gaps are, and what to do about them.
What the survey numbers are really telling you
The 91% figure gets the attention, but we think the 54% figure matters more for small businesses. Fear of a new kind of attack is reasonable. Not being able to see what’s happening on your own network at 2 a.m. on a Saturday is a practical problem you can fix.
Think about who said this. These are people at organizations big enough to have IT and security staff, and about half of them still can’t keep watch all the time. A typical small business in Jenks or Sapulpa has no security staff at all. Often the “IT person” is the office manager, or a relative who knows computers. If larger teams struggle to keep watch, a small office without help is almost certainly not watching.
How AI changes the attacks small offices see
AI hasn’t given criminals a new kind of magic. What it has done is make the old attacks cheaper, faster and more convincing. That matters, because the old attacks already worked well.
Better phishing emails
For years, a lot of scam emails gave themselves away with odd grammar, strange greetings or obvious spelling mistakes. AI writing tools have mostly fixed that for attackers. A fake invoice from your “supplier” can now read exactly like a real one, mention the right kind of product, and match the tone of someone you deal with every week. Training staff to look for typos doesn’t help much anymore. Good phishing awareness now means checking where a request came from and confirming payment changes over the phone, using a number you already have.
Fake voices and urgent requests
Voice cloning tools can copy a voice from a short recording. The old scam where the “owner” calls the bookkeeper and asks for an urgent wire transfer is easier to pull off when the voice on the line sounds right. The fix is not technical. It’s a simple office rule: money moves only after a second person confirms it through a separate channel.
Faster scanning for weak spots
Attackers also use automation to look for unpatched software, exposed remote access and reused passwords across thousands of businesses at once. You don’t have to be a target for anyone in particular. You only have to be one of the businesses that left a door open.
AI agents and the login problem
This is the part NIST has been highlighting, and it affects more small businesses than you might expect. An AI agent is software that doesn’t just answer questions. It acts for you. It might read your email and draft replies, move files between cloud apps, update records in your accounting software, or book appointments.
To do any of that, the agent needs access. Usually that means someone connects it to a Microsoft 365 or Google account and clicks “allow.” Several outlets have warned that these agents can end up working outside the identity and login controls a business depends on. In plain terms:
- The agent may keep access long after the employee who set it up has left.
- It may get much broader permissions than its job needs, such as access to every mailbox instead of one calendar.
- It may not go through multi-factor authentication the way a person logging in would.
- Its activity may not show up anywhere anyone actually checks.
Here’s what that looks like in an ordinary office. A staff member at a small accounting firm connects a free AI assistant to their work email to help with client replies. Nobody else knows. Months later, that connection is still live, can read everything in that inbox, and no one would think to check it if something went wrong. No one broke in. The access was simply granted and then forgotten.
The answer is not to ban AI tools. It’s to treat them like a new employee: decide what they’re allowed to touch, write it down, and review it regularly.
The around-the-clock gap
Back to the 54%. Attacks don’t stick to business hours. A compromised account used on a Friday evening can mean a weekend of forwarding rules quietly copying email, or files being encrypted before anyone comes in Monday morning. AI-assisted attacks can move faster once they’re inside, which makes those hours count for more.
Most small businesses can’t hire someone to watch screens overnight, and they shouldn’t try. What they need is monitoring tools that flag unusual activity, such as a login from another country, a sudden burst of file changes, or a new mail forwarding rule, plus someone who is actually alerted and responds. Monitoring that sends alerts to an inbox nobody reads until Monday doesn’t really count.
What a local IT provider in Tulsa should be doing for you
If you already pay for managed IT services, this month is a fair time to ask some direct questions. If you don’t, these are the things to look for. A good provider should be able to tell you clearly:
- Who watches your systems after hours, and what happens when something is flagged. You want a specific answer, not “we have monitoring.”
- Whether multi-factor authentication is turned on for every account, including the shared ones and the owner’s own login, which is often the one left out.
- Which third-party apps and AI tools are connected to your email and files, and when that list was last reviewed.
- How quickly security updates get installed on computers, servers, firewalls and the equipment people tend to forget, such as your business Wi-Fi access points.
- Whether your backups are kept separate from your main systems and whether anyone has actually tested restoring from them.
Being local matters here in practical ways. When something goes wrong in a Bixby office on a Tuesday morning, a provider who can be on site that day, and who already knows your setup and your people, makes a real difference. Remote tools handle most of the work, but not all of it.
No one can promise that AI-driven attacks won’t reach your business. What you can do is make them much less likely to succeed and much more likely to be caught early.
Steps worth taking this month
None of these need a big budget:
- Review connected apps. In Microsoft 365 or Google Workspace, look at which apps have been granted access to company accounts. Remove anything nobody recognizes or uses.
- Write a short AI tools policy. One page is enough. Which tools are approved, what data must never go into them, and who must approve connecting one to company accounts.
- Set a money rule. Any request to change bank details or send an urgent payment gets confirmed by phone, using a number already on file, by a second person.
- Close old accounts. Disable logins for former employees and remove any tools they connected.
- Give staff a fifteen-minute talk. Explain that scam emails and calls now look and sound real, and that checking twice is always fine.
The worry in that survey is reasonable. But most of the defense against AI-driven attacks is the same steady work that has always mattered: tight logins, current updates, tested backups, careful staff, and someone actually watching. The new piece is keeping track of the AI tools inside your own business, and that’s easier to handle now, before they spread further.
Frequently asked questions
Are AI-driven cyberattacks really a risk for a small Tulsa business?
Yes. AI mostly makes familiar attacks like phishing emails, fake invoices and voice scams more convincing and cheaper to run, so small offices are affected as much as large ones. The good news is that basic defenses like multi-factor authentication, payment confirmation rules and monitoring still work.
Should we stop employees from using AI tools at work?
Banning them usually just drives use underground. A better approach is a short policy listing approved tools, what data can't go into them, and who has to approve connecting a tool to company email or files.
Do we need 24/7 monitoring if we're only open business hours?
Attacks often happen at night or on weekends, when nobody is around to notice. You don't need overnight staff, but you do want monitoring that flags unusual activity and a provider who will actually respond when it does.
Talk to a local IT team
Kamadeyle Solutions provides managed IT services to businesses in Tulsa, Broken Arrow, Owasso, Jenks, Bixby and across the Tulsa metro. Our technicians are local, so you get someone who can be on site when remote support is not enough.