Why stronger software security should matter to your business

You may not be thinking about government hacking tools when you run a shop, clinic, workshop, agency, or trading company. You are probably more concerned with keeping customer records accurate, processing orders, replying to messages, and making sure your team can work without interruption.

However, the same security trend affecting governments and technology companies will eventually affect your business: artificial intelligence is becoming better at finding software weaknesses. That can help defenders identify problems earlier, but it can also help attackers discover weaknesses before you do. The key lesson is not that your business needs to become a cybersecurity laboratory. It is that you should rely less on hidden weaknesses and more on strong everyday controls.

TL;DR: AI may help software makers find and fix bugs faster, making some traditional hacking methods less reliable. For Malaysian SMEs, this makes secure software updates, strong account controls, backups, and careful supplier selection more important than ever.

Do not wait for a major incident before reviewing how your business protects information. A basic, repeatable security routine can reduce the damage caused by stolen passwords, outdated applications, and compromised devices.

What This Means

The source article discusses a debate among cybersecurity experts. Matthew Green, a cryptography professor, argued that AI could make software so much better at finding vulnerabilities that governments may eventually struggle to access devices through previously unknown security flaws, commonly called zero-days. The concern is that authorities could respond by requesting backdoors, which are built-in ways to bypass normal security.

Strong encryption is designed to prevent unauthorised people from reading data. End-to-end encryption means that messages are protected so only the intended participants can read them. A backdoor would weaken that protection for a selected party, but any deliberate weakness could potentially be discovered or misused by others.

The article also presents a less certain view. Some offensive-security experts believe AI will find simple bugs more easily while leaving complicated weaknesses available. Others argue that modern devices already include stronger protections, and that the bigger problem is not finding vulnerabilities but ensuring that companies actually patch them quickly and correctly.

Security development	Possible effect	What you should do
AI finds software bugs faster	Attackers may discover weaknesses sooner	Apply updates promptly and monitor supplier notices
More secure phones and laptops	Direct device attacks may become harder	Protect accounts, recovery methods, and business data
AI-assisted development	New applications may contain unnoticed flaws	Ask vendors about testing, updates, and incident response
Pressure for exceptional access	Weakening encryption could increase wider risk	Prefer secure platforms without unnecessary backdoors

The practical message for you is simple: security is moving from a one-time installation to an ongoing process. A firewall or antivirus application alone cannot protect a business if an employee reuses a password, an old laptop remains unpatched, or a former staff member still has access to shared files.

Key insight: As AI makes both attacks and defence faster, your advantage comes from reducing avoidable weaknesses before somebody else finds them.

How This Applies to Malaysian SMEs

Imagine you operate a Malaysian retail business with a point-of-sale system, an online store, a customer messaging account, and cloud-based bookkeeping. Your business may depend on several suppliers that you do not control directly. If one application has a newly discovered weakness, you may not know about it until the vendor issues an update. A practical response is to keep an inventory of every important system, including who supplies it, who administers it, and how updates are handled.

For a professional services firm, the risk may centre on client documents, email, shared drives, and staff laptops. A compromised email account can expose quotations, contracts, identification documents, and payment instructions. You should enable multi-factor authentication wherever available, especially for email, cloud storage, accounting systems, and administrator accounts. Multi-factor authentication requires an additional proof of identity beyond a password, such as an authentication app or security key.

For a clinic, tuition centre, recruitment agency, or property business, personal information deserves extra care. You may hold names, phone numbers, identification details, health-related information, or employment records. Limit access based on each person’s role instead of giving everyone access to the same folders. Review access when someone changes responsibilities and remove it immediately when they leave.

Malaysian SMEs also commonly rely on WhatsApp, social media accounts, delivery platforms, payment services, and outsourced IT support. These connected services can improve operations, but they create more entry points. If your Facebook, Google, Microsoft, or marketplace account is taken over, an attacker may impersonate your company or redirect conversations. Keep recovery email addresses and phone numbers up to date, and ensure that more than one trusted manager knows how to regain control.

AI-assisted software development creates another concern. A freelancer or supplier may use AI tools to create an internal dashboard, booking form, automation, or customer portal. That does not automatically make the system unsafe, but you should ask how the application was tested, where data is stored, how access is controlled, and how security defects will be fixed. Do not assume that a polished interface means the underlying system is secure.

Practical Takeaways

• List your critical systems: Record your email, accounting, payroll, customer database, website, cloud storage, payment, and messaging platforms.
• Assign an owner: Every system should have a named person responsible for access reviews, updates, and supplier communication.
• Turn on multi-factor authentication: Start with administrator, email, finance, and cloud-storage accounts.
• Use separate accounts: Do not let staff share one administrator login. Individual accounts make access easier to control and review.
• Patch on a schedule: Check operating systems, routers, browsers, plugins, phones, and business applications regularly.
• Back up important data: Keep backups separate from ordinary user access and test whether you can restore files.
• Reduce unnecessary access: Remove old staff accounts, unused applications, and permissions that no longer match a person’s role.
• Train staff with realistic examples: Teach them to verify urgent payment requests, unexpected links, and messages asking for passwords or verification codes.
• Ask vendors direct questions: Find out how they report vulnerabilities, issue updates, protect customer data, and handle incidents.
• Prepare a response plan: Write down who should disconnect devices, contact the supplier, preserve evidence, inform management, and communicate with affected customers.

You can begin with a short internal review. Ask: Which systems would stop the business if unavailable? Which accounts can access sensitive information? Which applications are no longer supported? Who receives security updates? When did you last test your backup? These questions often reveal more useful actions than buying another tool.

The Bigger Picture

The long-term direction is a faster contest between people building software and people trying to break it. AI may help developers identify weaknesses earlier, but it may also help attackers search across large numbers of systems. Security teams will increasingly need automated monitoring, continuous testing, and faster response processes.

That does not mean every SME must employ a full-time security specialist. It does mean you should choose suppliers that take updates and incident handling seriously. When comparing business software, ask about security support in the same way you ask about reliability, integration, and customer service.

The debate about government access and backdoors also carries a lesson for business owners. A shortcut created for one trusted party can become a weakness for everyone if it is exposed or abused. You should be cautious about products that promise convenient access by weakening encryption or sharing broad administrator control.

As software becomes more secure, criminals may focus more heavily on people and business processes. Phishing, social engineering, stolen recovery codes, fake invoices, and impersonation do not require a rare technical vulnerability. Your strongest protection is therefore a combination of secure technology and disciplined habits.

Review your most important accounts this week, enable stronger sign-in protection, and confirm that your backups work. These steps will not eliminate every risk, but they will make your business a harder and less attractive target as AI changes the security landscape.

Source: TechCrunch, “How AI could make it harder for governments to use hacking tools.”

Ready to Streamline Your Operations?

Your business should run itself. AutoRunBiz deploys AI agents to automate your daily operations — WhatsApp orders, invoicing, customer follow-ups, and accounting. Book a free 15-min ops audit to see where automation fits your business →