Thailand's National Cyber Security Agency says existing AI tools already let attackers scan public software code for weaknesses, so a pause by AI developers would not remove the risk. For a small firm, the practical steps are: keep a current inventory of software and its dependencies, know which systems are critical before any automated response, and decide who must approve actions that could stop business or affect money or customer data. The article is general advice from an official, with no new rules or deadlines for SMEs.