Invisible by Default: The Five Vulnerability Classes SMBs Don't Realize They Have

In the AI era, a breach no longer arrives as a single account of what happened. It arrives as competing narratives: the narrow set of facts the victim confirms, and the leverage-optimized inventories the attacker publishes — increasingly machine-generated, often mutually inconsistent, and engineered to look forensic. The recurring analytical failure is to collapse these into one incident description, which renders the uncertainty invisible and lets attacker precision launder into analyst authority. This paper sets out an epistemic discipline for reading such breaches: separate the source classes, tag every claim on three independent axes (source, status, and type), treat specificity as persuasion rather than evidence, raise the burden of proof when narratives are AI-generated, demand falsifiability, and keep uncertainty visible. It then demonstrates the discipline on the June 2026 Novo Nordisk incident, in which victim-confirmed clinical-trial data coexists with at least two non-identical attacker-claimed inventories surfacing through different channels. The conclusion is that in the AI era the breach is also the narrative — and the only defense against narrative compromise is disciplined epistemology applied before, not after, the story sets.