An email from the wholesaler

An example, pieced together from what has happened elsewhere this year. On a Tuesday afternoon the accounts department receives an email from the regular wholesaler: from 1 November there is a new bank account, and could the outstanding invoices please be paid into it. The tone is right, the contact person is right, and the email refers to an order that really was placed last week. Two weeks later the wholesaler rings about overdue payments. In the meantime, a rule in the accounts mailbox had been quietly moving every email from the real wholesaler into a forgotten folder.

Show the differences

The example is invented; the tools behind it are real. Between July and September a single attacker broke into the Microsoft 365 mailboxes of 79 organisations using stolen sign-in sessions, without ever needing a password, and used mail rules to hide part of the post from the owners themselves. For a service company, whose accounts department handles invoices from wholesalers, subcontractors and staffing agencies every day, this is the scenario closest to home.

What AI does to the arithmetic

AI changes the nature of attacks less than is often suggested, and their cost and credibility all the more.

To begin with, deception is becoming more convincing. According to Microsoft, a phishing email written by AI is clicked more than four times as often as a hand-written one: 54 against 12 per cent, in its report covering 2025. That removes the warning signs staff have been trained to spot for years, such as clumsy sentences, an odd greeting and spelling mistakes, and leaves a tidy email in flawless Dutch.

Breaking in has also become dirt cheap. At the end of September a Chinese-speaking hacker set AI agents to work with an instruction of fewer than a hundred characters. According to researcher Snorre Fagerland of the security firm NorForge, those agents tried more than twelve hundred websites, mostly online shops in the United States, Canada, Australia and Japan, and got into more than a hundred companies, at roughly fifty dollars per successful break-in. At that price an attacker no longer has to choose whom to try. Anyone who believes the company is too small to be interesting is still working with yesterday's prices.

And a flaw is exploited faster. When two flaws in PHP, the software behind a large share of all websites, were made public in October after being found with the help of AI, and the Dutch government login service DigiD went offline as a precaution, it turned out that attackers had been trying them four days earlier.

The figures closer to home show that this is far from a distant problem. In the first half of 2026 the Netherlands ranked ninth in Europe among countries where Microsoft customers were most often hit by cyberattacks, and the Dutch police and Public Prosecution Service describe AI in their Cybercrime Report 2026 as a catalyst that increases the pace and scale of attacks. In early October the Dutch justice minister, David van Weel, warned boards that unfounded optimism and naivety can prove expensive. The National Coordinator for Security and Counterterrorism had earlier added a sober caveat that belongs in every conversation on the subject: existing security measures still work.

The accounts department and the mailbox

For a technical service company three places deserve attention, and in our assessment the accounts department is by far the most likely place for things to go wrong. That is where money comes in and goes out again, and that is where deception is aimed: the email about a changed bank account, the subcontractor's invoice that looks slightly different, or a phone call from a voice that sounds like the managing director, asking from a building site for an urgent payment. AI can now imitate such voices convincingly.

Two-step verification makes life considerably harder for intruders, although the 79 organisations show that a stolen sign-in session gets around it. That makes the cheapest measure here the strongest one as well: a standing agreement that a new bank account or an unusual payment request is always confirmed by phone, on a number that was already known. The agreement works even when the email is perfect, and these days a flawless email is precisely the reason to pick up the phone.

Shared logins and the tablet in the van

The second place lies in the company's own systems. The further a service company takes its automation, the more a single stolen login is worth. Where a password once opened a calendar, in a well-connected setup it opens the planning board, the customer history, the codes for key safes and the invoicing all at once. Where engineers still share an account for the job sheet app or the planning board, a second problem follows. A shared login is a key nobody can withdraw without locking everyone out, so it keeps working long after an engineer has left.

Field service adds to this. An engineer's tablet or phone holds the job sheet app, the email and often the app used to read installations remotely, and it spends much of the day in a van parked on the street. We therefore take the view that an integration is only finished once it is settled who manages the key and how it is withdrawn. That belongs to the maintenance discussed earlier in this Logbook, and it deserves the same attention as the question of whether the integration works.

The customers' keys

The third place is the least visible and therefore the most awkward. Building management systems, climate controllers, access control, inverters and routers are installed and commissioned by a service company and then often maintained remotely. Access to them sits with the service company, in the form of a password in the planning software, a connection on the work planner's laptop or an app on the engineer's phone. Together those access routes form a key ring for buildings that do not belong to the company, and when something goes wrong there, the damage lands on the customer.

Here too, AI shortens the time between a flaw becoming known and its exploitation, and these devices are precisely the ones that are slow to update. According to CSO Online, the PHP flaw from October also sits in the management screens of building management panels and operator panels of technical installations, where owners cannot update the software themselves and have to wait for the manufacturer. Manufacturer Delta Controls has already released an update for its building management platform, while the accompanying climate and room controllers were still waiting for new firmware at the end of October.

That raises a question a service contract does not always answer: who updates the box? The manufacturer supplies the update, the customer owns the device and the service company holds the maintenance contract and the remote connection. Between those three parties a flaw can sit for years, because each of them reasonably assumes someone else will deal with it. A box nobody knows exists will never be updated.

Customers will start asking

Since 15 August the Cyberbeveiligingswet, the Dutch implementation of the European NIS2 directive, has been in force. Some eight thousand organisations in sectors such as healthcare, drinking water, energy and food must report serious incidents within 24 hours and take appropriate measures, and their directors can be held personally accountable. In October the supermarket chain Albert Heijn was among the first to report a major hack under the new law.

For an installation company the significance lies in the supply chain. Suppliers take on no obligations under the law themselves. Organisations that do fall under it must, however, map the risks of the companies they do business with, and may attach requirements to that. A hospital whose building management is maintained remotely by an installer therefore has to factor that installer into its own risk assessment. Law firm CMS expects this to find its way into contracts, with agreements on security standards, incident reporting and cooperation with audits.

Many of those questions have yet to arrive. The day before the law took effect, only 2,942 organisations were listed in the register of the National Cyber Security Centre, against an estimated eight to ten thousand that fall under it. A company that can answer those questions with an overview of its own access routes and a few clear agreements will stand out from the competitor that first has to work out which boxes it actually manages.

Should a service company be worried?

The picture of an AI that cracks any system on its own initiative is overblown. In the first major attack campaign in which AI did most of the work, last autumn, the model regularly invented results, so the people behind it had to check everything. What does change is less spectacular and more dangerous for it: deception becomes credible, trying a break-in costs next to nothing, and with that the protection a small company drew from being inconspicuous disappears. The weak spots themselves are old acquaintances. Putting them in order removes most of the risk, and that requires no special software with AI in it.

Seven steps for a company with around ten engineers

None of these steps calls for an in-house IT department or a large budget. What they mainly need is someone who sees them through.

1. Appoint one owner on the management team. The Cyberbeveiligingswet puts the subject in the boardroom at customers, and that is where it belongs at their suppliers too. One name, and a fixed slot on the agenda once a month.
2. Introduce a call-back rule. Every payment to a new bank account, every unusual payment request and every request for remote access is confirmed on a phone number that was already known, even when the managing director appears to be calling.
3. Scrap shared logins. Personal accounts with two-step verification for job sheet, planning and email software, and accounts of engineers who have left and unused supplier accounts removed straight away.
4. Have the mail rules checked. Whoever manages the email checks regularly which rules in the mailboxes forward or move mail, and sets up an alert whenever a new one appears.
5. Manage tablets and phones centrally. Updates install automatically, a lost device can be wiped remotely, and the job sheet app runs only on devices the company knows.
6. Make the key ring visible. A list of every remote access route to customers' installations, with the manufacturer of each device, who logs in and who handles updates. Start with customers in healthcare and energy, remove default passwords and record the agreements on updates in the maintenance contract.
7. Prepare for bad news. A backup kept separate from the network, a call list for when things go wrong and a few ready answers for the questionnaire customers will send. The Basisscan Cyberweerbaarheid, a cyber resilience check from the Dutch Digital Trust Center, is a reasonable starting point.