For most of the internet's history, the front door has been a password. The data shows we've known for years that it isn't enough.
The great 2FA experiment
In 2018, a Google engineer revealed that fewer than 1 in 10 active Google accounts had two-step verification turned on. A decade of awareness campaigns, reminder emails, and nag screens had moved almost nobody.
Then the industry stopped asking. When GitHub made 2FA mandatory for code contributors, about 95% opted in, & account recovery support tickets actually fell by 54%.
The lesson wasn't that people don't care about security. It's that security can't be a choice you have to remember to make. It has to be the default.
Enter passkeys: defaults at scale
If 2FA taught the industry that defaults beat persuasion, passkeys are the industry acting on it:
The pattern holds: make it the default, & people follow.
“Security can't be a choice you have to remember to make. It has to be the default.”
Why this matters more now: the attackers got AI too
While the industry was fixing the front door, attackers picked up the same AI tools everyone else has. Phishing emails no longer need broken English to give them away, and automated bots can try stolen passwords against login pages without rest.
The threat isn't a teenager in a hoodie anymore. It's automation: patient, tireless, and increasingly intelligent. A password you reuse, a second factor you never enabled, an unpatched plugin on your website: that's all it takes, & the machines never sleep.
The defense has to grow up too
You cannot fight automation with attention. No human team, & certainly no small business owner, can watch every login, every plugin, every traffic spike around the clock. That's precisely why AI cybersecurity isn't a buzzword; it's the only math that works: intelligent defense against intelligent attack.
Modern AI security doesn't wait for you to notice something wrong. It watches behavior, not just passwords, flagging the login that doesn't look like you, the traffic pattern that doesn't look human, the vulnerability before it's exploited. It turns the lesson of the 2FA era up to eleven: protection that doesn't depend on you remembering to do anything.
The question isn't whether you can afford it
The data tells a clean story. Voluntary security failed. Default security worked. Passwordless is winning. & AI now powers both the break-ins & the defense, which means standing still is the same as moving backward.
So the question was never whether an SMB can afford cybersecurity. It's whether it can afford to be the low-hanging fruit.
Sources
- Cybersecurity
- AI Security
- Passkeys
- 2FA
- Thanos Labs