AI: The Biggest Risk for SMEs is not Technology, but Using AI Without a Framework
Montréal, October 1, 2026 – As part of Cybersecurity Awareness Month, VARS, the Cybersecurity division of Raymond Chabot Grant Thornton (RCGT), would like to remind SME leaders of the importance of urgently enhancing their cybersecurity practices. While artificial intelligence (AI) is rapidly transforming our work processes, it also offers criminals highly effective cyberattack methods.
AI has become a powerful tool that offers organizations increased productivity, operational efficiency and innovation, but it’s also a significant risk vector. Indeed, AI is regularly exploited by malicious parties to automate attacks, perfect phishing campaigns, generate credible fake content and carry out increasingly sophisticated fraud.
“We’re currently witnessing a digital arms race. On the one hand, AI allows organizations to better detect threats and respond faster to incidents. On the other hand, it gives cybercriminals the ability to act with unprecedented speed and on an unprecedented scale,” states Guillaume Caron, Partner at RCGT and VARS Co-Founder and CEO.
Unsupervised AI use is the greatest risk
Contrary to popular belief, the primary AI-related risk is not that it will replace employees. The risk lies in the uncontrolled use of AI tools within organizations.
An increasing number of employees are using generative AI platforms to write texts, analyze data and draft documents. In several cases, confidential information, client data, financial information and strategic documents are uploaded to tools that have not been approved by the organization.
“Within SMEs, we often see a very rapid adoption of AI with little governance, data control and visibility regarding which tools are being used on a daily basis. When an employee or AI agent shares sensitive information with an external platform without appropriate supervision, they’re unintentionally creating a significant risk for their organization,” explains Maxime Boutin, Co-founder and Operational Technology Leader at VARS.
Increasingly credible deepfakes and fraud
The emergence of deepfakes is also a growing concern for business leaders. Thanks to AI, fraudsters can now convincingly reproduce the voice of a manager, colleague or supplier in order to obtain sensitive information or trigger fraudulent payments. In this context, validation mechanisms, employee awareness campaigns and controls related to digital identities have become essential.
“We’re no longer dealing with fraudulent emails peppered with spelling errors. Today’s attacks are much more credible and personalized. An AI-generated video or phone call can seem truly authentic. Business leaders must adapt their verification processes to this new reality,” adds Mr. Caron.
The five main AI-related risks for SMEs
According to the experts at VARS, the five most crucial risks that SMEs are currently facing are:
- Confidential information leaked to unsupervised AI tools;
- Cyberattacks enhanced by artificial intelligence;
- Shadow AI, which is the use of AI tools which were not approved by the organization;
- Decision-making based on incorrect content or AI hallucinations;
- A lack of AI usage governance, policies and accountability.
Focus on cyber-resilience rather than invulnerability
The VARS team believes that business leaders must also recognize that cyber-risk cannot be completely eliminated. Instead, the challenge lies in managing risk based on the level the organization is willing to accept, and bolstering its cyber-resilience. This is essentially an organization’s ability to prevent incidents, detect them quickly, mitigate the consequences and effectively restore operations.
Experts recommend that SME leaders:
- Adopt a company-wide policy on the use of artificial intelligence;
- Clearly define which tools have been authorized within the organization;
- Strengthen mechanisms for identity and access management, including agent identities;
- Deploy multifactor authentication for critical systems and restrict access to autonomous AI agents;
- Make employees aware of new risks on a regular basis;
- Periodically assess risks related to AI and cybersecurity;
- Always keep a human in the loop when making decisions that could impact confidentiality, integrity or availability.
The mitigation measures and solutions offered by VARS can reduce risks and allow organizations to navigate AI in a more effective and secure manner.
“The most common topic of discussion in cybersecurity is that AI has become both our closest ally and our new adversary. The organizations that will thrive are those that adopt AI while introducing strong governance, robust controls and a high level of resilience,” concludes Mr. Boutin.
About VARS and Raymond Chabot Grant Thornton
VARS, a division of Raymond Chabot Grant Thornton, selects and manages innovative cybersecurity solutions for corporations of all sizes across North America and internationally. At the forefront of the information security industry, it offers an integrated and tailored approach to protect an organization against data theft and increasingly sophisticated cyberattacks. Since 2022, VARS has been the exclusive supplier of the Fédération québécoise des municipalités (FQM) and provides support through its range of cybersecurity services.
Raymond Chabot Grant Thornton is a professional services firm dedicated to the success of organizations and their leaders since 1948. The firm’s advisors are committed to helping clients thrive by obtaining a deep understanding of what is important to them, their business and their industry. This knowledge, combined with a team of motivated and talented professionals, helps accelerate growth. A Quebec and Canadian leader in the areas of assurance, tax, advisory services and business recovery and reorganization, Raymond Chabot Grant Thornton boasts more than 3,200 professionals, including approximately 250 partners, working in some 90 offices across the province of Quebec and in the Ottawa and Edmundston regions.
Together with Doane Grant Thornton, another Canadian firm, and the global Grant Thornton organization, our footprint spans across more than 150 countries, with 80,000 employees who provide real insight, a fresh perspective and agility to keep clients moving ahead.
Information :
Gaëlle Fontaine
Conseillère – Communications et affaires publiques
Raymond Chabot Grant Thornton
Téléphone : 438 349-0842
Courriel : fontaine.gaelle@rcgt.com