Cybersecurity · Artificial Intelligence · Global Threats
AI-Powered Cyberattacks Are Now Mainstream: What Security Teams Are Doing About It
The same AI capabilities transforming software development, customer service, and research are now being deployed by criminal organizations and state-sponsored actors to attack infrastructure at a scale and speed that traditional security tools were not designed to handle. The threat landscape has changed. Most organizations have not changed with it.
In March 2026, a mid-sized logistics company in the Netherlands received a video call from what appeared to be its chief financial officer. The person on screen looked right, sounded right, and was calling from an account that had been linked to the CFO's contact details. The caller requested an urgent wire transfer to a supplier account, citing a deal that required same-day settlement.
The transfer was made. The caller was a deepfake, and the 18 million euro transfer was gone before the real CFO was reached.
This incident, one of dozens of documented deepfake fraud cases in Europe in the first quarter of 2026 alone, represents one vector in a broader pattern. AI-assisted cyberattacks are not a future threat category. They are the current threat category, and they are operating at a scale and sophistication level that the security industry is still racing to address.
The Attack Surface in 2026
4,500+
AI-assisted cyberattacks per day globally (2026 estimate)
312%
Increase in AI-generated phishing emails since 2024
$8.4T
Projected global cybercrime cost by 2028
68%
Organizations reporting AI-enhanced attack attempts in 2026
The categories of AI-assisted attack that security teams are now encountering most frequently fall into four primary types.
AI-Generated Phishing
Large language models now generate personalized phishing emails at industrial scale, using public LinkedIn data, company websites, and social media to craft messages indistinguishable from legitimate communications. Detection rates with standard email security have dropped significantly.
Automated Vulnerability Discovery
AI agents are being used to scan codebases and network configurations for exploitable vulnerabilities faster than human security researchers can patch them. Criminal groups have moved from manual exploitation to automated pipelines that identify, prioritize, and exploit at machine speed.
Deepfake Social Engineering
Real-time voice and video deepfakes have enabled a new category of fraud. In documented cases in 2025 and 2026, attackers impersonated executives in video calls to authorize wire transfers and override security protocols. Several incidents resulted in losses exceeding 25 million dollars.
AI-Assisted Ransomware
Ransomware groups now use AI to identify the most valuable data to encrypt, determine optimal timing for attacks, and negotiate ransom payments. The operational sophistication of ransomware has increased substantially, with AI reducing the technical skill required to deploy an effective attack.
Which Industries Are Most Exposed
Financial services, healthcare, and critical infrastructure remain the highest-value targets, and the concentration of attacks in these sectors has intensified as AI has lowered the cost of sophisticated targeting. A criminal group that previously needed specialized knowledge to conduct a convincing attack on a hospital's patient records system can now use AI tools to automate the reconnaissance, identify the vulnerability, craft the social engineering campaign, and execute the attack.
What has changed most significantly is the democratization of attack capability. High-sophistication attacks were once the province of state actors and highly organized criminal groups with substantial technical resources. AI has changed that equation. The FBI's Cyber Division documented a 40 percent increase in the number of distinct criminal groups conducting AI-assisted intrusion campaigns between 2024 and 2025. The capability is spreading faster than the defenses.
What Defenses Are Working
The security industry's response has been, predictably, to deploy AI against AI. Behavioral analytics systems that establish baselines for normal user and network behavior are catching anomalies that signature-based tools miss. AI-powered email security that evaluates not just content but the contextual plausibility of a message, including whether the sender's writing style matches their history, is detecting AI-generated phishing at higher rates than previous generations of filters.
But the most effective interventions are not technical. They are procedural. Organizations that have implemented multi-party authorization requirements for financial transactions above specified thresholds, regardless of the requesting channel, have reduced deepfake fraud losses dramatically. The logistics company mentioned at the opening of this article did not have that requirement. After the incident, it implemented one. It has not been successfully defrauded since.
The lesson is not that AI security tools are inadequate, though many are. It is that the human and procedural layers of security are the most reliable defense against attacks that have learned to manipulate human judgment at scale. AI attacks are fundamentally social engineering attacks. Social engineering defenses, verification procedures, multi-party authorization, human override requirements, are still the most effective countermeasure.
Three Actions Every Organization Should Take Now
- 1.Implement mandatory multi-party verification for all financial transfers above a defined threshold, regardless of the channel or the identity of the requester.
- 2.Audit your email security for AI-generated phishing detection capability. Most tools deployed before 2025 were not designed for this threat.
- 3.Establish a code-word or out-of-band verification protocol for executive communications involving sensitive decisions. Deepfakes cannot replicate a pre-shared verbal passphrase.
Related Editorial
Daniel Simao
Editor in Chief, TechGlobal.news
Daniel Simao covers cybersecurity, AI threats, and the global technology landscape. He founded TechGlobal.news to provide technology readers with a more deliberate, signal-first news experience.