Seeing Squarespace lay off people, including in infrastructure security, is a real-world example of the tightrope every tech company is walking. We have to build strong defenses against cyber threats that are constantly changing, particularly now that AI is being used in both offensive and defensive tools. For organizations in a growth phase, this creates a serious tension between the pressure to cut costs and the absolute necessity of protecting their digital assets and customer data.

1. Conduct a Complete Security Infrastructure Audit with a Focus on AI Vulnerabilities

Before you make any big organizational changes or staff cuts, you have to conduct a detailed audit of your security infrastructure. This is non-negotiable. You’re looking for weak points, obviously, but you also need to understand exactly how you stack up against threats that are being amplified by artificial intelligence. Start by getting a complete map of all your network assets, including everything on-prem and in the cloud. Then, use an enterprise vulnerability scanner like Tenable.io or InsightVM by Rapid7 and point it at all your servers, apps, and network gear. You should have these scans running daily or weekly, and they should be kicking out reports that let you zero in on critical and high-severity problems.

You also have to specifically look at how your systems defend against AI-driven attacks. Can your web application firewalls (WAFs) actually spot advanced bot attacks that look like human users? Does your intrusion detection system (IDS) use behavioral analytics to find anomalous activity generated by AI, or is it still stuck on old-school signature matching? A practical step is to check your WAF rulesets to see if they have protections against credential stuffing, which is often done with AI to be more effective. Go through your logs and hunt for any weird access patterns that might point to an AI doing reconnaissance on your network.

Pro Tip: Automated scans are a good start, but they won’t find everything. You should bring in an independent third-party firm that specializes in AI security to run a pen test. Have them specifically target your AI models and how they’re integrated. They’ll uncover blind spots your internal team might be conditioned to miss, like prompt injection vulnerabilities in your public-facing AI tools or data poisoning risks in the datasets you use for training. When hiring, look for firms whose people hold certs like the CISSP or GPEN to ensure you’re getting real expertise.

Common Mistakes: The biggest mistake I see is teams relying 100% on automated scans without doing any manual verification. These tools are great, but they throw false positives and can completely miss a clever, multi-stage attack. Another classic error is forgetting about the people. Even the most advanced security stack can be bypassed with a good social engineering attack, and AI is making those phishing emails and pretexting calls alarmingly convincing.

2. Prioritize and Automate Critical Security Functions

Once your audit is done, you have to triage. Remediate vulnerabilities based on the actual risk they pose to your data’s integrity, confidentiality, and availability. That means critical vulnerabilities on any system that touches the internet get patched immediately, think a 24 to 48-hour window. Set up an automated patch management system like Ivanti Patch Management or Microsoft Defender Vulnerability Management so your OSes and apps are always getting updated without someone having to do it by hand.

Automate every security task you can to lighten the load on what might be a smaller team. This means getting your logs into a Security Information and Event Management (SIEM) system like Splunk Enterprise Security or IBM QRadar and letting it do the analysis. You should configure these systems to send automatic alerts for specific suspicious events, like a storm of failed logins from a strange country or a massive data transfer happening at 2 AM on a Sunday. There’s a reason for this: a 2025 Gartner report found that companies who fully used SIEM automation cut their mean time to detect (MTTD) incidents by 30%.

You should also look at Security Orchestration, Automation, and Response (SOAR) platforms, like Palo Alto Networks Cortex XSOAR. These tools can run entire incident response playbooks on their own. They can do everything from isolating an infected laptop to blocking a malicious IP at the firewall, which frees up your analysts to do actual threat hunting instead of just clicking buttons. Think about a reported phishing email: a SOAR platform can scan every inbox for that same email, pull it out, and block the sender’s domain across the whole company in minutes, without a human touching a keyboard.

3. Implement AI-Driven Threat Detection and Response Systems

Since attackers are using AI, you have to use AI in your defenses. It’s that simple. Your old signature-based antivirus and firewalls just aren’t good enough anymore against polymorphic malware and zero-day exploits, especially since many are now generated by other AIs. You need to invest in AI-driven threat detection systems that use machine learning to spot anomalies and predict where an attack might be coming from. Products like Darktrace’s AI Analyst build a baseline “pattern of life” for every single user and device on the network using unsupervised machine learning. The moment something deviates from that baseline, it triggers an alert, catching threats that blow right past traditional tools. For example, if an account in the sales department that only ever touches sales data suddenly starts trying to query HR databases at 3 AM from a new IP, Darktrace flags that immediately.

Endpoint Detection and Response (EDR) solutions that have AI built-in, such as CrowdStrike Falcon Insight, are also critical. These tools watch what’s happening on laptops and servers in real-time, analyzing running processes, network connections, and file changes for anything that looks suspicious. They can contain a threat automatically by kicking an infected machine off the network or killing a malicious process, which dramatically slows down an attack’s spread. This is especially important when you’re up against advanced persistent threats (APTs) that try to get a quiet foothold and then move laterally through your network.

Pro Tip: Buying an AI security product is the easy part. The real work is integrating it properly into your security operations center (SOC) workflows. The power of AI in security is how it augments your human analysts. You have to train your team on how to read the AI-generated alerts and what to do with the insights it provides. A good AI system will slash alert fatigue, which lets your people stop chasing ghosts and focus on the handful of incidents that actually matter.

4. Strengthen Access Controls and Identity Management

So much of security comes back to access control, and its importance is only growing as AI tools make it harder to be sure who you’re talking to. Put a solid Identity and Access Management (IAM) system in place to centralize how you handle user authentication and authorization. Multi-factor authentication (MFA) is a fundamental requirement for all accounts, and it’s absolutely mandatory for any account with admin rights. For your most critical systems, you should be using hardware security keys (like a YubiKey) or biometric auth, because they are far more resistant to phishing and credential theft attacks than getting a code via SMS.

You have to live by the principle of least privilege which just means people should only have access to the specific data and systems they absolutely need to do their jobs, and nothing more. This requires you to regularly review user permissions, paying special attention when people change roles or leave the company. Using automated provisioning and de-provisioning tools makes this much easier by ensuring access is granted or revoked right away. For example, when someone moves from marketing to engineering, their access to the marketing drive should be cut off automatically as their new engineering permissions are granted. This drastically shrinks your attack surface and can stop an attacker from gaining access even if they manage to compromise an account.

Common Mistakes: The most common failure points are getting lazy with password policies or letting people turn off MFA because it’s “inconvenient.” Another trap is not auditing dormant accounts or those with high-level privileges. Those forgotten accounts are gold mines for attackers who find them.

5. Develop and Practice a Strong Incident Response Plan

Even with the best defenses, you will probably get hit. A well-defined and, more importantly, a well-practiced incident response plan is what determines if a breach is a minor event or a full-blown catastrophe. This plan has to be a living guide, not just a document that sits on a shelf. It must clearly spell out who does what, how you communicate, and the exact technical steps for detection, containment, eradication, and recovery.

Make sure your plan includes specific playbooks for AI-driven attacks. What does the team do if they detect a data exfiltration being run by an AI botnet? How do you respond to a denial-of-service attack that’s using AI to constantly change its signature to evade your filters? You have to test these scenarios with tabletop exercises and full-scale simulations at least twice a year. And don’t just involve the IT and security teams. You need legal, PR, and the C-suite in the room, because they all have a role to play. The NIST Cybersecurity Framework is a great starting point for building out these capabilities, since its Identify, Protect, Detect, Respond, and Recover structure gives you a solid methodology.

The communication strategy is a critical piece of incident response that often gets overlooked until it’s too late. Who tells customers their data was stolen? What do you say, and when? Having pre-vetted statements and a clear command chain for PR can be the difference between maintaining customer trust and causing a panic. A data breach is a technical disaster and a PR nightmare rolled into one. As proof, a 2024 study by IBM Security calculated the average global cost of a data breach at $4.45 million, with a huge chunk of that cost coming from lost business and damage to the company’s reputation.

Protecting your infrastructure against smarter AI threats, especially when your workforce size is in flux, demands a proactive, layered defense that leans heavily on automation, intelligent detection, and being constantly prepared for a fight.