AI-Powered Cyberattacks Are Changing Managed IT Services in Spokane

Cyberattacks across the Inland Northwest have already shown how ransomware, stolen credentials and compromised systems can disrupt governments, healthcare organizations and businesses. Now, a new development is changing that threat environment again as artificial intelligence gives attackers the ability to identify vulnerabilities, create convincing social engineering campaigns and execute parts of an intrusion at a speed that would have required far more human effort only a few years ago.

For local businesses, that change is beginning to redefine what they should expect from managed IT service providers in Spokane. Keeping computers, networks and cloud applications operational remains important, but the growing use of AI in cyberattacks means IT providers increasingly have to detect and respond to threats that can adapt and scale much faster than traditional attacks.

AI Is Moving From Cybersecurity Tool to Cyberattack Operator

The idea of hackers using artificial intelligence is not new. Cybercriminals have used generative AI for several years to write phishing emails, generate malicious code, research potential targets and translate scams into languages they may not speak fluently.

What has changed is the level of autonomy AI systems are beginning to demonstrate. Instead of simply helping a human attacker write an email or piece of malware, newer AI agents can potentially analyze an environment, decide what action to take next and execute multiple steps of an attack with relatively little human intervention.

One of the clearest examples emerged in September 2026, when Spain’s data protection authority disclosed what it described as the first reported personal data breach associated with an AI agent. According to Reuters, the AI system identified vulnerabilities, accessed a system, modified personal information and viewed billing records while operating with limited human involvement.

The incident remains under investigation, and it would be premature to treat one case as evidence that autonomous AI attacks have become commonplace. Its significance is that a scenario cybersecurity researchers had been warning about is beginning to move from controlled demonstrations into real-world incidents.

An AI-Orchestrated Espionage Campaign Showed What Is Possible

Another major warning came from Anthropic in November 2025. The AI company said it had disrupted what it described as the first reported cyber espionage campaign in which artificial intelligence was used not merely as an adviser, but to execute substantial portions of attacks.

According to Anthropic, the attackers used the agentic capabilities of Claude Code to conduct reconnaissance, identify vulnerabilities, exploit systems and perform other tasks across the attack chain. Anthropic later reported that the campaign successfully compromised government and critical infrastructure targets in multiple countries.

What made the campaign particularly important was not the invention of completely new hacking techniques. The attackers instead connected familiar cybersecurity tools and techniques to an AI system capable of reasoning through the environment and determining what to do next.

That distinction matters for businesses because AI does not necessarily need to create a revolutionary new cyberattack to change cybersecurity. It can make existing attacks cheaper, faster and easier to scale, allowing attackers to conduct more reconnaissance, probe more systems and pursue more potential victims simultaneously.

Google Has Seen AI-Enabled Malware Enter Active Operations

Google Threat Intelligence Group has documented a similar progression. In 2025, Google reported that adversaries were moving beyond using artificial intelligence primarily for productivity and beginning to deploy AI-enabled malware in active operations.

Some of those tools were capable of changing their behavior while running rather than following only a predetermined set of instructions. Google described the development as a new operational phase in the misuse of AI, with government-backed attackers and cybercriminals experimenting with the technology throughout different stages of the attack lifecycle.

By February 2026, Google’s threat researchers said attackers were increasingly integrating AI into reconnaissance, social engineering and malware development. The broader pattern suggests that AI is becoming another layer of the existing cybercrime ecosystem rather than a separate category of attack.

For defenders, that can make attribution and detection more difficult. A phishing message, malware infection or vulnerability exploit may look familiar while the automation behind it allows attackers to operate at a scale that was previously impractical.

The 2026 Verizon DBIR Shows AI Entering the Attack Lifecycle

The 2026 Verizon Data Breach Investigations Report provides broader evidence that AI is becoming part of real-world cyber operations. Verizon found that the median threat actor it studied used AI assistance across 15 documented attack techniques, with some actors applying it to 40 or 50 techniques.

Importantly, Verizon found that most AI-assisted techniques were not completely new forms of hacking. Attackers were primarily using AI to improve or accelerate techniques that cybersecurity professionals already understand, including phishing, vulnerability exploitation and malware development.

The same report found that 31% of breaches began with exploitation of software vulnerabilities, making vulnerability exploitation the leading initial entry point in Verizon’s 2026 analysis. Ransomware was involved in 48% of breaches, while the human element remained present in 62% of incidents.

These numbers reinforce an important point for small and midsized businesses. Artificial intelligence does not make traditional cybersecurity controls irrelevant, but it can punish organizations that are slow to patch systems, monitor accounts or investigate suspicious activity.

AI Makes Phishing Faster and More Convincing

Social engineering is one of the areas where AI can have an immediate impact on businesses. Generative AI allows attackers to create polished emails, text messages and scripts without the spelling mistakes, unusual phrasing and other warning signs employees were once taught to associate with phishing attempts.

Microsoft’s 2025 Digital Defense Report found that attackers were already using AI to automate phishing, generate synthetic content and accelerate malware development. Microsoft also reported research showing AI-automated phishing emails achieving substantially higher click-through rates than conventional attempts, highlighting the potential advantage attackers gain when personalization can be automated.

AI can also make targeted attacks more economical. Instead of manually researching a company’s executives, employees, vendors and communication style, an attacker can use automated tools to collect public information and generate individualized messages at scale.

For Spokane businesses, that makes email filtering alone an incomplete defense. Employees still need training, but businesses also need controls around identity, access, multi-factor authentication and unusual login activity in case an employee eventually clicks a convincing message.

A California Cyberattack Shows How Quickly IT Problems Can Become Operational Problems

A recent cyberattack in California provides a clear example of how quickly a compromised IT environment can affect critical operations. In August 2026, Suisun City declared a state of emergency after malicious software compromised municipal systems supporting 911 routing, police and fire dispatch, records and other city services. Officials responded by shutting down the city’s IT network while emergency calls were rerouted through the Solano County dispatch center.

The incident is notable because the disruption extended far beyond ordinary computer problems. Systems supporting emergency communications were affected, forcing the city to rely on contingency procedures while cybersecurity specialists investigated the attack and worked to restore normal operations.

According to Karim Karawia, CEO of Tech Kooks, a managed IT service provider in LA, incidents like the Suisun City attack demonstrate why cybersecurity and IT operations can no longer be treated as separate responsibilities. When communications, cloud platforms, networks and other critical systems are interconnected, a cybersecurity incident can quickly become an operational disruption.

The same lesson applies to businesses in Spokane. Most companies are not operating 911 systems, but they increasingly depend on technology for communications, customer records, financial systems and everyday operations. As attackers gain more powerful automation tools, organizations need to think not only about preventing an intrusion, but also about how quickly they can detect, contain and recover from one.

Managed IT Can No Longer Be Primarily Reactive

For decades, managed IT was often organized around a simple model: something stops working, an employee creates a ticket and a technician fixes the problem. That model remains useful for ordinary technical problems, but it is poorly suited to cybersecurity threats that may cause significant damage before an employee even realizes something is wrong.

AI-assisted attacks increase that mismatch. If attackers can automate reconnaissance, vulnerability discovery and portions of the attack process, defenders cannot rely exclusively on waiting for users to report problems.

“AI changes the speed of the problem,” says Josh Smith, owner of BCA, a managed IT and cybersecurity provider based in Spokane. “If an attacker can automate parts of an intrusion, businesses need security systems and people watching for unusual activity before that activity becomes a major incident.”

That approach shifts managed IT toward continuous visibility. BCA monitors business technology, BCA manages security controls, and BCA helps Spokane organizations respond when technical activity indicates a potential security problem.

Identity Is Becoming a Critical Security Boundary

One consequence of cloud computing is that attackers do not always need to compromise an office network. If they obtain the credentials for Microsoft 365, Google Workspace, a cloud accounting platform or another critical application, they may be able to access significant amounts of business information remotely.

AI can make obtaining those credentials easier through more convincing phishing, automated reconnaissance and personalized social engineering. That makes identity and access management one of the most important areas where managed IT and cybersecurity increasingly overlap.

BCA manages user accounts for Spokane businesses, BCA helps protect employee access, and BCA incorporates identity controls into broader IT management. Those relationships matter because creating, modifying and disabling accounts are no longer simply administrative IT tasks when compromised identities can become an attacker’s entry point.

Strong authentication, compromised-password monitoring and carefully managed administrative privileges can limit what attackers can do even when one layer of security fails. The objective is to create enough barriers that a single mistake does not automatically become a company-wide incident.

Faster Attacks Require Faster Detection

The broader implication of AI-powered cybercrime is not that humans will disappear from cyberattacks. It is that a single attacker may be able to accomplish more work in less time by delegating repetitive or technically demanding parts of an intrusion to AI systems.

That creates pressure on defenders to shorten their own response times. Detecting suspicious behavior days after it occurs becomes increasingly dangerous when the attacker on the other side can conduct reconnaissance, test vulnerabilities and analyze stolen information in minutes or hours.

“Businesses need to start thinking about cybersecurity as an ongoing process rather than a collection of products,” Smith says. “Antivirus, backups and firewalls are important, but somebody also needs to understand how those systems work together and what happens when one of them detects something unusual.”

This is where managed IT providers may play a larger cybersecurity role. The provider already responsible for endpoints, networks, cloud accounts and backups often has the visibility needed to recognize when activity across those systems does not match normal business behavior.

AI Is Also Giving Defenders New Tools

Artificial intelligence is not exclusively benefiting attackers. Microsoft, Google and other cybersecurity vendors are also incorporating AI into security platforms to help defenders analyze large quantities of activity, identify suspicious behavior and prioritize alerts that would otherwise require significant manual investigation.

For MSPs, that creates an opportunity to use automation against automation. AI-assisted monitoring can help security teams process more information, but those tools still need experienced professionals who can determine whether an alert represents a real attack and decide how the organization should respond.

BCA uses technology to manage and protect business environments, while its technicians provide the human judgment required when security tools identify potential problems. That combination of automation and professional oversight is likely to become increasingly important as both sides of cybersecurity adopt more capable AI systems.

What AI-Powered Cyberattacks Mean for Spokane Businesses

The most important change created by artificial intelligence may ultimately be speed rather than novelty. Cybercriminals are still stealing credentials, exploiting vulnerabilities, delivering malware and manipulating employees, but they increasingly have tools that can help them perform those activities faster and across more potential targets.

For Spokane businesses, that raises the standard for managed IT services. An MSP can no longer focus only on whether computers are functioning today because the same devices, accounts and cloud applications also represent possible pathways into the organization.

The emerging model combines IT management with identity security, endpoint protection, vulnerability management, phishing defenses, backups, monitoring and incident response. Businesses do not necessarily need separate providers for every one of those responsibilities, but they do need someone accountable for understanding how the pieces work together.

Recent AI-enabled cyber incidents provide an early glimpse of where cybersecurity may be headed. As attackers increasingly automate their work, the managed IT providers responsible for protecting Spokane businesses will face growing pressure to become equally proactive, integrated and fast.