AI Is Making Cybercrime Cheaper. Why Are Businesses Still Cutting Security Budgets?
Partly because the cost of attacking has fallen faster than most budgets have noticed. A criminal chatbot such as WormGPT 4 has been sold for US$50 a month or US$220 for life, according to Palo Alto Networks research; a phishing kit that bypasses multi-factor authentication rented for US$120 for ten days; and Anthropic documented AI-built ransomware sold for US$400 to US$1,200. Meanwhile, the IANS Research and Artico Search 2025 benchmark found security budget growth slowed to 4%, the slowest in five years, with more than half of security chiefs reporting flat or shrinking budgets. Gartner still forecasts global security spending reaching US$240 billion in 2026, but that headline growth has not reached every security team. For SMEs, the answer is not matching attackers dollar for dollar but spending the first dollars where they close the most doors. A Fortinet FortiGate 50G with five years of Unified Threat Protection costs S$3,798 at SourceIT, about S$63 a month (listed 30 Oct 2026).
What does cybercrime cost to buy now?
| Tool or service | Advertised price | Source |
|---|---|---|
| WormGPT 4 criminal chatbot | US$50 a month, or US$220 lifetime with source code | Palo Alto Networks Unit 42, via The Register, Nov 2025 |
| KawaiiGPT | Free on GitHub | Unit 42, Nov 2025 |
| FraudGPT | US$200 a month or US$1,700 a year | Netenrich, via The Hacker News, Jul 2023 |
| Xanthorox | US$300 a month; testers found it fell short of its claims | Trend Micro, Nov 2025 |
| AI-built "no-code" ransomware | US$400 to US$1,200 | Anthropic, Aug 2025 |
| Tycoon 2FA phishing kit (MFA bypass) | US$120 for 10 days or US$350 a month, before a Europol-led takedown in Mar 2026 | The Hacker News, citing Microsoft and Europol, Mar 2026 |
Advertised prices reported by the named researchers; criminal claims are often exaggerated.
Stolen access is cheap too. FortiGuard Labs counted 1.7 billion stolen credential records circulating on underground forums in its 2025 report, and a further 79% rise in infostealer logs in 2026. AI does not need to invent new attacks to change the economics. It makes old ones cheap enough to aim at everyone.
Why are security budgets not keeping pace?
- Security competes with everything else. IANS found security's share of IT spending fell to 10.9% in 2025, from 11.9%.
- Small firms spend least. CrowdStrike's 2025 survey of small businesses found only 6.5% believed their cybersecurity budget was truly sufficient, and 67% put affordability first when choosing a security product.
- Nothing bad has happened yet. CSA's October 2026 health report found 46% of Singapore businesses still see themselves as unlikely targets.
- The benefit is invisible. A successful defence looks like a quiet month.
Attackers now pay tens of dollars a month for their tools. The question for a business is not whether it can afford defence, but which defence it can least afford to skip.
Where should a limited budget go first?
| Priority | Control | Typical cost | Why first |
|---|---|---|---|
| 1 | MFA on email, VPN and admin accounts | Often included in existing Microsoft 365 or Google plans | Stops most use of stolen passwords |
| 2 | Patching routine, including the firewall | Staff or provider time | Exploited vulnerabilities were the top technical root cause of ransomware in Sophos's 2025 survey |
| 3 | Isolated, tested backups | A NAS or cloud backup | Turns ransomware from fatal to recoverable |
| 4 | Business firewall with security subscription | From about S$525 a year (FortiGate 30G, 5-year UTP) | Blocks exploits, phishing sites and malware for every device |
| 5 | Endpoint detection on PCs and laptops | Microsoft Defender for Endpoint P1, S$46 a year as listed | Catches what users run themselves |
| 6 | Staff awareness and a payment-verification rule | Mostly time | Phishing and deepfake payment scams target people |
SourceIT prices listed 30 Oct 2026. Steps 1 to 6 together address many of CSA's Cyber Essentials requirements.
Does spending on AI-driven defence pay off?
For larger organisations, IBM's 2025 Cost of a Data Breach Report found extensive use of AI and automation in security cut average breach costs by US$1.9 million and shortened the breach lifecycle by 80 days. SMEs rarely buy AI security tools directly, but they get the same benefit through services such as FortiGuard, where machine learning across millions of devices turns into updates on a small office firewall. See AI vs AI: Can FortiGate Fight Hackers Using Artificial Intelligence?
How do you make the case internally?
- Show the attacker's costs: tens of dollars a month for tools.
- Show your downtime cost per day, and multiply by a week.
- Show the five-year cost of the baseline above, per month.
- Add available funding: CSA's CISO-as-a-Service offers eligible SMEs up to 70% co-funding, and pre-approved cybersecurity solutions may qualify for the Productivity Solutions Grant.
The full cost comparison is in A Cyberattack Could Cost More Than Your Entire IT Budget, and the hidden running costs of IT in The Hidden Costs of Owning an AI Workstation.
Buying in Singapore
SourceIT supplies a cost-effective baseline: FortiGate 30G (S$2,626.80 with 5-year UTP), FortiGate 50G (S$3,798) and FortiGate 70G (S$5,623.20), Microsoft Defender for Endpoint P1, Microsoft 365 for Business and Synology backup systems, with local warranty and a GST invoice. Prices listed 30 Oct 2026. For a quotation, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Is AI making cyberattacks cheaper? Yes. Researchers have documented criminal AI tools for around US$50 a month, AI-built ransomware for US$400 to US$1,200, and MFA-bypassing phishing kits for US$120 for ten days.
Are security budgets growing? Slowly. Gartner forecasts US$240 billion in global security spending in 2026, but IANS found budget growth slowed to 4% in 2025, the slowest in five years.
What should a small business spend on first? MFA, patching and isolated backups, then a business firewall with a security subscription and endpoint detection.
How much does a FortiGate cost per month? At SourceIT on 30 Oct 2026, a FortiGate 50G with 5-year UTP is S$3,798, about S$63 a month.
Is there funding for SME cybersecurity in Singapore? CSA's CISO-as-a-Service offers eligible SMEs up to 70% co-funding, and pre-approved cybersecurity solutions may qualify for the Productivity Solutions Grant.
