AI increasingly used in cyberattacks

Artificial intelligence is becoming an increasingly significant tool in the arsenal of cybercriminals. According to a new IBM study, one in four malicious cyber incidents resulting in data breaches now involves the use of AI. Further details are provided below.

Over the past year, the number of such incidents has increased by 56%. The financial impact of AI-enabled attacks has also proven to be greater than that of conventional data breaches, as threat actors employ more sophisticated techniques to circumvent cybersecurity controls.

Most Prevalent Threats

Deepfakes and identity impersonation accounted for the largest share of AI-enabled cyberattacks, representing 45% of all such incidents. This makes them the most common method of exploiting artificial intelligence for cybercriminal purposes.

In addition, threat actors are increasingly leveraging AI to develop malicious software and automate the generation of phishing messages. Artificial intelligence systems themselves—including AI models and applications—are also becoming frequent targets, with attackers seeking unauthorized access to corporate data and internal services through these platforms.

Financial Losses Continue to Increase

The global average cost of a data breach has reached USD 4.99 million. Incidents involving artificial intelligence are even more costly, with average losses exceeding this figure by approximately USD 1 million.

According to the study, inadequate protection of AI systems remains a significant challenge. Survey findings indicate that 92% of organizations affected by AI-related attacks had not implemented adequate access controls for their AI models and applications.

Incident Response and Recovery Require Months

On average, organizations require 247 days to detect a data breach and fully remediate its consequences. Investigations are particularly prolonged in cases involving supply chain attacks and the use of removable media.

The study also demonstrates that the deployment of artificial intelligence within Security Operations Centers (SOCs) enhances the timely detection of cyber threats and helps reduce the overall impact of security incidents. Nevertheless, these capabilities have not yet been widely implemented across all organizations, although the majority of surveyed companies have indicated their intention to increase investment in protection against emerging cyber threats.