The dependency divide: how frontier AI redistributes cyber risk across the SME ecosystem

Abstract

Frontier artificial intelligence is fundamentally altering the cybersecurity landscape by compressing defensive windows and lowering the threshold for offensive skills. While current policy discourse predominantly treats frontier AI security as a concern for large enterprises and critical national infrastructure, small and medium enterprises (SMEs) are systemically exposed. Drawing upon the Dynamic Capabilities View, this paper challenges the prevailing logic that AI will act as a universal equalizer. Instead, it argues that SMEs face a severe “capability shock” because they lack the internal absorptive capacity required to synchronize human-paced governance with machine-paced exploitation cycles. The paper introduces the “dependency divide” to demonstrate how frontier AI creates simultaneous defensive uplift and structural asymmetry. SMEs receive an “inherited defence” dividend when embedded in hyperscale commercial platforms, but face “persistent exposure” in bespoke, “long-tail” niche software. These niche applications often lack the Software Bill of Materials and code transparency required for automated AI remediation, making them highly attractive targets for automated exploitation. Because compromised SMEs act as transmission points for rapid supply-chain propagation, their cyber resilience must be treated as a systemic merit-good. To prevent permanent cyber inequity, policymakers must move beyond generic advice and couple “Secure by Design” mandates with targeted technical enablers—such as open-source AI security agents—to protect the vulnerable long tail of the digital economy.