Two of the most instructive security incidents of the last five years happened to the same company, and neither of them required anything clever. In May 2022 an attacker got into Cisco's corporate network after taking over an employee's personal Google account, which had the employee's work password saved in it, and then ringing that employee repeatedly while firing multi-factor authentication prompts at their phone until one was approved. In May 2024 a German newspaper showed that Webex meeting links belonging to the Bundestag, federal ministries and the armed forces could be found by counting up and down from a known link, which exposed the titles, times and invitees of thousands of meetings, some of them marked confidential. One was a failure of people and process. The other was a failure of product design. Between them they cover almost every way a communications platform can let a business down, and the fixes are specific, cheap and available to a ten person office in Australia today. This is a plain account of both incidents, written for business owners rather than security teams, with the controls ranked by how much effort they take and a list of questions to put to whoever supplies your phones and meetings.

Somebody has probably told you recently that your business needs AI, and there is a reasonable chance they were selling something. That does not make them wrong, but it does mean the question deserves a straighter answer than the one you have been getting. Here is the straight version: no business needs AI. Businesses need calls answered, quotes out the door, notes written, invoices chased, rosters filled and customers who do not have to ring twice. AI is not a goal, it is a means, and in 2026 it has become the cheapest available means for a specific and identifiable set of those jobs, and a genuinely poor means for others. The interesting question is not whether to adopt AI. It is which of your problems are now cheaper to solve than they were eighteen months ago, and whether any of them are costing you enough to bother. That question has an answer, and it is different for a two-person consultancy than for a forty-person clinic group. The Australian evidence is also better than it was: the Bureau of Statistics has measured business adoption, the National AI Centre is tracking it quarterly, and there are now enough real deployments in Australian small businesses that the productivity claims can be checked rather than believed. The numbers do not all agree, and the disagreement turns out to be the most informative part of the whole picture. This is what they say, what they cost, where they do not apply, and what to do first if the answer for you is yes.

Nobody planned the phone part. When teams scattered, the urgent problems were laptops, video meetings and whether people could reach the file server, and all three got solved within a fortnight. The phones were left roughly where they were, because calls still seemed to be happening and nobody was complaining loudly. Three years on, the same businesses have a set of symptoms they have stopped connecting to that decision. Customers say they cannot get anyone. Staff give out their mobile numbers because it is easier than explaining the alternative. Nobody knows who is available without sending a message to ask. A call that used to be handled by someone leaning over a desk now becomes an email thread with four people on it. And when somebody leaves, three years of customer relationships leave with them, sitting in a personal handset that the business never controlled. None of that is a hybrid work problem. It is a phone problem that hybrid work exposed, because the office phone was quietly doing four jobs that nobody had written down: it was the shared front door, it was a live signal of who was around, it was how work got handed between people without ceremony, and it was where the record of a conversation lived, at least in the sense that somebody nearby had overheard it. Take the building away and all four need replacing deliberately. This is what each one becomes, what to give which staff, what actually matters on a home connection, and the two compliance details that catch people out.

In late July 2026 the extortion group ShinyHunters announced that it had taken 623GB of data from RingCentral and demanded payment. RingCentral disclosed the incident the next day, said it had been caused by a sophisticated social engineering campaign, said the core platform was not affected, and declined to pay. The group then published a 280GB archive, and on 13 August the breach notification service Have I Been Pwned loaded 1.6 million unique email addresses from it, along with names, phone numbers and physical addresses. That is the whole of the confirmed story, and on its face it sounds contained: no passwords reported, no payment cards reported, no call recordings, no outage. The problem is what that kind of list is for. A breach at a communications provider does not mainly hurt the provider. It hands attackers an accurate map of who uses which phone platform, who to call, and what to say when they do, and the group responsible has spent the last eighteen months proving that a convincing phone call is the most reliable way into a company. For Australian businesses the incident matters in two ways. Some are RingCentral customers directly or through the Optus Loop migration, and should assume they will be targeted. Everyone else should treat it as the clearest recent demonstration that the phone line has become the front door for serious intrusions, and check whether their own door is locked.

There is a version of this that goes badly and it usually starts with enthusiasm. Somebody sees a demo where an AI answers a call, understands a slightly awkward sentence, looks something up, books an appointment and writes a note, and it is genuinely impressive, because that demo is real and the technology behind it works. So the business buys it, points it at the main number, and switches it on for everything. Three weeks later it is off again. Not because it could not understand people, but because nobody decided what it was allowed to promise, nobody wrote down what should happen when it was unsure, nobody told the team it was coming, and nobody agreed in advance what a good week would look like, so when a customer complained about one call there was no way to weigh that against the ninety it handled properly. That is the failure pattern behind Gartner's estimate that over forty per cent of agentic AI projects will be cancelled by the end of 2027, and the three causes it names are escalating cost, unclear business value and inadequate risk controls. Notice what is not on the list. The models are not the problem. The scoping is. An AI agent is not a feature you enable, it is a job you hand over, and jobs get handed over properly or they get handed back. This is how to hand one over properly: how to choose the first one, what to build around it, how to release it over ninety days without betting the main number on week one, and which five numbers tell you whether it is working.

Nobody sets out to build a bad phone menu. They get built one reasonable decision at a time. Somebody adds an option because accounts kept getting sales calls. Somebody adds a second layer because the first one grew to six options. Somebody records a message about the website because it seemed helpful. Somebody adds a note about a public holiday in 2023 and never takes it out. Two years later a caller with a simple question listens to forty seconds of talking, chooses the option that sounds closest, waits, gets the wrong person, is transferred, explains the whole thing again, and forms a permanent opinion about your business that has nothing to do with what you actually do. The uncomfortable part is that everyone inside the business thinks the menu is fine, because everyone inside the business already knows which option they want and has never once listened past the second one. There is a better way to design this and it is not just a shorter menu. It starts from what people actually ring about, in the proportions they actually ring about them, opens by telling the caller what is going to happen rather than presenting a list, uses a menu only where a menu genuinely earns its place, and defines what happens at every dead end rather than letting the phone ring into nothing. This is that design: the wording for the greeting, the rules for menus and when to skip them entirely, queue and hold settings that people tolerate, overflow, after hours, and seven test calls that will show you exactly what is broken in about fifteen minutes.

Count the software your business pays for. For most Australian businesses between ten and two hundred staff the honest number is somewhere between nine and fourteen, and almost every one of them has added AI features in the last eighteen months. The accounting package can categorise transactions. The CRM can draft an email and score a lead. The job management tool can summarise a site note. The help desk can suggest a reply. Each of these is real and each of them works, and yet the thing that has not improved at all is the moment a customer rings up and says "I ordered a part on Thursday, the invoice looks wrong and nobody has rung me back", because answering that sentence requires four of those systems to be in the room at once and none of them can see each other. That is the actual state of AI in most businesses in 2026: a lot of narrow intelligence distributed across silos, with nothing in the middle holding a view of the customer. The industry data reflects it. Around eighty-eight per cent of contact centres report using AI in some form and only about a quarter say they have integrated it properly, and the remaining three quarters are exactly this: capability bolted onto the side of systems that do not talk. Fixing it does not require replacing anything, and it does not require a data warehouse project. It requires deciding which layer sits in the middle, and there is a defensible answer to that question that most businesses have never considered, because they have always thought of the phone system as an endpoint rather than as a platform.