Your Business Is a Target — And AI Is Finally Fighting on Your Side

You run a Malaysian SME. Your day is filled with customers, inventory, payroll, and a thousand other fires. Cybersecurity feels like a luxury — something for big corporations with in-house IT teams. You outsource some support, maybe have a part-time tech person, but you know deep down that if a determined attacker targeted you, you’d likely not spot it until it was too late.

Hackers count on that. They target small and medium businesses precisely because the defenses are weaker. A single breach can steal customer data, freeze your systems, or damage your reputation in ways a small team can’t easily recover from.

But a new kind of AI is emerging that flips the equation. It’s not just a chatbot that answers questions — it’s an orchestration model that coordinates multiple AI “agents” to work on complex security tasks, from finding vulnerabilities in code to writing detection rules based on the latest threat reports. And its recent scores show it’s achieving results that used to require a small team of security analysts.

TL;DR: Sakana AI’s Fugu-Cyber is a cybersecurity orchestration system that can autonomously find software flaws and turn threat intelligence into actionable detection rules. For your SME, this means advanced security capabilities are becoming accessible at a price point that’s making traditional security tools rethink their business models. However, access is currently gated and requires manual approval, so the immediate path is indirect — it signals that the era of AI-powered security for SMEs is officially starting.

What This Means in Plain Language

You’ve used AI for writing emails or summarising documents. But those models are passive — they answer what you ask. Fugu-Cyber works more like a project manager who assembles a team of specialists. It takes a high-level goal — “find and verify a vulnerability in this login module” — and assigns sub-tasks: one AI reads the code, another tries to exploit it, a third checks the exploit is correct. The orchestrator decides who does what, when, and whether the result passes quality checks.

According to Sakana AI’s announcement, Fugu-Cyber achieved 86.9% on CyberGym, a UC Berkeley benchmark where the AI must write a proof-of-concept exploit that crashes an unpatched software build but not the fixed version. It also scored 72.1% on Microsoft’s CTI-REALM, which tests the ability to read a threat report, map its tactics to the MITRE ATT&CK framework, and produce working detection rules (KQL queries, Sigma rules). These tasks previously required a senior analyst hours or days to complete.

These numbers don’t mean your business is suddenly bulletproof. But they do mean the technology is crossing a threshold where it can reliably handle security work that was once the exclusive domain of well-staffed security teams.

How This Applies to Malaysian SMEs

Let’s make it concrete. Many Malaysian SMEs run on third-party software — cloud accounting systems, e-commerce platforms, customer databases. You rarely get to audit the security of these tools. You trust the vendor. But if a vulnerability inside that software goes unpatched, your data is the one at risk. In the near future, you could use an AI orchestration service to scan the software dependencies of your online store or accounting system, flag known vulnerabilities, and even verify that patches work correctly. That’s a job that today would require hiring a penetration tester — something most SMEs skip because of cost and complexity.

Another angle: threat detection. If you use any cloud infrastructure (Azure, AWS, Google Cloud), you likely have limited monitoring in place. An orchestration model like Fugu-Cyber can continuously review cloud telemetry, correlate it with emerging threat intelligence, and generate precise detection rules — alerting you to suspicious behaviour without overwhelming you with false positives. For a small team that can’t staff a 24/7 security operations centre, this kind of AI-assisted monitoring could be what turns a potential breach into a minor alert you handle in minutes.

Even compliance gets easier. Malaysian businesses that work with government or larger corporate clients often need to demonstrate security controls (e.g., ISO 27001). AI orchestration can help you gather evidence: audit logs, patch status, vulnerability scans. It won’t replace a certification body, but it can dramatically reduce the manual effort of preparing for an audit. The same tool that finds an SQL injection in your internal web app can also document that you identified and remediated it — giving you a cleaner paper trail.

Access is currently limited — Fugu-Cyber requires manual approval through an application form, and it’s not available in the EU/EEA (though Malaysia isn’t affected by that restriction). But the direction is unmistakable. Within 18 months, similar capabilities will be embedded into the security tools you already use or can afford. The practical step for you today is to start building the foundation: know your assets, understand your current security gaps, and have a conversation with your IT provider about how they plan to incorporate AI into your defences.

“Sakana’s own position is that a capable API along with human security expertise beats the API alone.” — Fugu-Cyber announcement

What the Numbers Actually Tell You

Benchmark	What It Measures	Best Prior Score	Fugu-Cyber Score
CyberGym (UC Berkeley)	Writing a proof-of-concept exploit that breaks unpatched build, not patched build	85.6% (GPT-5.5-Cyber)	86.9%
CTI-REALM (Microsoft)	Mapping threat reports to MITRE ATT&CK and generating validated detection rules	68.5% (Claude top config)	72.1%

Note: All results are self-reported and haven’t been independently replicated. CyberGym is pass/fail based on crashing difference; CTI-REALM uses a trajectory reward between 0 and 1 — Sakana reports it as a percentage success rate.

Practical Takeaways You Can Use This Week

• Take inventory of your digital assets. List every piece of software, cloud service, and IT system you use. You can’t defend what you don’t know you have. This inventory is your starting map.
• Ask your IT provider about AI-enhanced security features. Many managed service providers are beginning to experiment with orchestration tools. Ask them directly: “Are you using any AI that helps monitor our systems for threats automatically?” Their answer will tell you how prepared they are for the coming shift.
• Train your team on the basics. No AI can stop a phishing email if an employee clicks a malicious link and enters credentials. Basic security awareness — spot the scam, report it, don’t reuse passwords — remains your highest-return investment.
• Keep an eye on tools like Microsoft Security Copilot or AWS GuardDuty. Large platforms are integrating orchestration capabilities into their existing product suites. You likely already use some of them. Enabling these features (where available) can give you a taste of AI-driven security without applying for a separate API key.
• Don’t wait for the perfect solution. Even if you never touch Fugu-Cyber, the trend it represents will affect every SME. Use the next six months to patch what you have, enable multi-factor authentication, and test your backup recovery process. Strong basics + incoming AI tools = genuine protection.

The Bigger Picture: Security Is About to Become Democratic

What Fugu-Cyber reveals is that the cost of high-level cybersecurity analysis is dropping exponentially. The same technology that lets a large language model write a marketing email can now independently probe software for vulnerabilities and design defences. For Malaysian SMEs, this is a leveller. A two-person shop using AI-assisted security can have monitoring capabilities that, five years ago, would have cost a six-figure salary for a team of analysts.

But there’s a serious note. Attackers also have access to these tools. They can use orchestration models to find zero-day vulnerabilities or craft more convincing social engineering attacks. The arms race is accelerating. The businesses that will get hurt are the ones that ignore this shift — that assume their small size makes them invisible. It doesn’t. What makes you invisible is having defenses that are sophisticated enough to deter automated attacks. AI-powered security is becoming the baseline.

Your role as a business owner isn’t to become a security expert. It’s to understand that the tools are maturing, and to start integrating them into your operations before you become a cautionary example. Talk to your tech partners. Ask the hard questions. And remember: the combination of a capable AI and a knowledgeable human beats either alone. Invest in both.

Ready to Streamline Your Operations?

Your business should run itself. AutoRunBiz deploys AI agents to automate your daily operations — WhatsApp orders, invoicing, customer follow-ups, and accounting. Book a free 15-min ops audit to see where automation fits your business →