This week, customers of GoDaddy’s website builder began receiving an email they did not expect. An attacker had accessed their contact and profile information. GoDaddy called it “the first known AI-driven cyberattack against our company.”

I have spent more than 30 years in technology, and much of the last several years helping organizations recover from ransomware and cyber attacks. That sentence from GoDaddy stopped me. Not because the damage was large. GoDaddy says no passwords were taken, no websites were changed, and the intruder was caught within a day. It stopped me because of who was attacked, and how.

GoDaddy is not an easy target. It runs one of the largest web platforms in the world and has far more security resources than a typical business. Yet investigators found artificial intelligence attack tools, on the servers that the attacker used, in China and Singapore. In plain terms, software did much of the work that once required a team of skilled Threat Actors and Criminals.

This is not an isolated case. In October, the security firm CrowdStrike reported four previously unknown criminal groups using AI to break into hospitals, government agencies, and software companies, and counted three times as many of these attacks in the second half of this year as in the first. Over the past six months, my team and I have seen the same change in the attacks we respond to, noting mere months ago, the first AI-Driven cyber attack that we were tasked with responding to for a client.

Here is the part that worries me most. The software that criminals need is already available. Public archives of ransomware packages and code are on websites such as VX-Underground. Sites like this were created so researchers can study malicious software. These sites have hosted the code of a well-known ransomware family for years. Until recently, turning that old code into a working attack still took real skill. Now a person can ask an AI agent to do it. Today, almost anyone who wants to attack a business can.

I track every United States organization posted on ransomware extortion sites, which is only a fraction of the attacks that occur. From the end of June through October 28, there were 1,199 of them: dental practices, law firms, school districts, town halls, credit unions, and manufacturers. Most had no full-time security staff.

Most will never make the news, but every one of them faced the same questions: what was taken, whose information was it, and whom must we tell.

What happens next is not hard to predict. When attacks become cheaper, there are more of them. AI lets one criminal try thousands of organizations at once and spend real effort only on the ones that respond. CrowdStrike expects these attacks to “almost certainly increase in volume and sophistication” over the next year, and small and mid-sized organizations will absorb most of the damage.

The encouraging news is that the most important defenses are decisions, not technology. Every leader should know, before an attack, how long the business could operate with its systems locked, who calls the lawyer, who calls the insurer, and which outside services, including the AI tools employees already use, hold customer information. Those answers take an afternoon to find. During an attack, they can take weeks.

GoDaddy found its intruder in a day. The question for every leader reading this is how long it would take you.

Jay Longley is a Certified Chief Information Security Officer and Breach Coach who advises governments, schools, and businesses on ransomware and breach response.