How AI changes cybersecurity attacks and defenses for business

How are attackers using AI in cyberattacks?

Attackers use AI to write phishing emails, clone voices, generate fake video calls and run password attacks at greater scale and speed. According to the FBI Internet Crime Complaint Center's 2025 Internet Crime Report (2026), the FBI received 22,364 complaints containing AI-related information in 2025, with adjusted losses above $893 million. Verizon's 2026 Data Breach Investigations Report Executive Summary (2026) found that AI now plays a role in targeting, initial access and malware development, and that the median threat actor used AI across 15 documented techniques, with some using it in 40 or 50.

What is deepfake payment fraud and how does it work?

Deepfake payment fraud happens when criminals use generated audio or video to pose as a company executive and request a wire payment or access to a system. The FBI's public service announcement on generative AI fraud (I-120324-PSA, 2024) describes criminals generating video for live chats while posing as company leaders, and it advises hanging up and calling back on a known number to confirm the request. The FBI's 2025 Internet Crime Report (2026) found that voice cloning has been used to request wire payments, contributing to more than $30 million in 2025 business email compromise losses involving AI. IBM's Cost of a Data Breach Report 2026 (2026) found that more than 1 in 4 organizations were hit by a malicious AI-driven attack, a 56 percent increase, and that deepfake impersonation made up 45 percent of those attacks.

How does AI make business email compromise harder to spot?

AI tools let criminals write official-sounding emails that copy a CEO's tone and phrasing, so a fake request can look almost identical to a real one. The FBI's 2025 Internet Crime Report (2026) found that chat tools are being used to draft these official-sounding messages. Verizon's 2026 Data Breach Investigations Report (2026) found that phishing simulations sent by voice or text had a median click rate 40 percent higher than email, and that pretexting, often carried out by phone, was present in 6 percent of breaches. The human element appeared in 62 percent of breaches overall, according to the same report.

What is shadow AI and why is it a risk?

Shadow AI is staff use of AI tools that a company has not approved or reviewed, often to get everyday work done faster. Verizon's 2026 Data Breach Investigations Report (2026) found that 45 percent of employees are now regular AI users on work devices, up from 15 percent, and that 67 percent of those users were on non-corporate accounts. Source code was the data type most often submitted to outside AI tools, the report found. IBM's Cost of a Data Breach Report 2026 (2026) found that shadow AI was tied to 43 percent of security incidents, up from 20 percent, and that 68 percent of breached organizations had no AI governance in place to manage AI use or detect shadow AI.

AI-assisted attacks side by side:

How can we verify a payment request that looks like it came from an executive?

Treat any request to change payment details, send money or grant access as unverified until it is confirmed through a second, separate channel. Hang up and call the person back on a known phone number rather than one given in the message, following FBI guidance (2024). Verification steps should sit inside the payment process itself, so staff confirm a request before acting rather than after. FunctionOne sets up verification steps that confirm payment or access requests before anyone acts on them.

What should an AI acceptable use policy include?

An AI acceptable use policy sets clear rules for which AI tools staff can use and what company information may go into them. IBM's Cost of a Data Breach Report 2026 (2026) found that 68 percent of breached organizations had no AI governance in place, which points to the value of a written policy. A policy should cover:

1. Approved AI tools that staff may use for work
2. Company data that must stay out of public AI tools
3. Personal AI accounts on work devices
4. Approval steps before adding a new AI tool
5. Staff training on safe AI use
6. A clear way to report a mistake

FunctionOne helps clients set rules and controls for which AI tools staff may use with company information.

How does AI help security analysts find threats faster?

AI helps analysts by summarizing incidents, flagging unusual behavior and adding context from threat intelligence, while a person decides what happens next. Microsoft's Digital Defense Report 2026 Executive Summary (2026) found that AI is used for summarizing incidents, writing investigation narratives and log hunting queries, triaging and classifying incidents, and surfacing evidence across data sources. Behavior analytics can learn typical user and system activity and highlight changes, such as unusual account behavior, while threat intelligence on malicious addresses, domains and attack methods adds context to an investigation. Findings are confirmed by a person, and action happens only within response rules a client has approved.