Menu
SUBSCRIBE
SUBSCRIBE
Menu

AI-Driven Attacks

Abstract digital network representing organizations working together on a collective cyber defense effort.

More Than 150 Organizations Call for AI Cyber Defense Surge

, , , , , , , , ,

The coalition says hospitals, water utilities, local governments, and other essential services should receive AI security tools, funding, and hands-on support first.

 

More than 150 organizations called for a global surge in cyber defense, warning that they expect AI-driven attacks to become more widespread and sophisticated within months.

The open letter’s signatories include OpenAI, Anthropic, Google, Microsoft, Amazon Web Services, major cybersecurity companies, banks, technology providers, and consulting firms.

The letter outlines a broad, shared responsibility for businesses, governments, cybersecurity companies, technology partners, and major AI developers. It does not specify funding amounts, deadlines, or how much support individual organizations will provide.

The signatories did not cite evidence supporting their prediction that AI-powered attacks will become much more capable and widespread within months. They said existing security weaknesses, such as unpatched software and weak access controls, leave businesses and public services exposed as AI gives attackers more powerful tools.

Essential services would receive help first

The coalition called for hospitals, water utilities, local governments, and other essential services with limited security budgets to receive early support.

They call for governments to fund cyber defense for these organizations and expand programs that permit trusted security providers to test their systems. Governments should also coordinate the sharing of information about attacks and help organizations respond and recover.

The letter called on major AI companies to provide access to powerful models, funding, training, and hands-on assistance. Cybersecurity companies and technology providers should help essential-service operators deploy AI security tools, repair weaknesses, and verify that the repairs work.

These are proposed actions, not commitments that the signatories have agreed to fund or complete.

Businesses are told to treat cyber defense as urgent

The letter called on every organization to make cyber defense an immediate leadership priority and address its highest-risk weaknesses.

Companies should strengthen security standards for the software they buy, build, and use, including code produced with AI, according to the letter. They should also limit people and software to the access they need, strengthen authentication, and use multiple layers of protection.

The coalition said companies can use lower-cost AI models to check more systems for weaknesses and reserve the most powerful models for harder security problems. When essential systems cannot be patched without interrupting operations, organizations should use other safeguards and verify that those protections work.

Technology providers would share tools and attack information

The letter calls for cybersecurity companies and technology providers to continuously test whether their defenses can withstand attacks using increasingly capable AI models.

They should also share information about attacks, tested response plans, and verified repairs so that work completed by one organization can help protect others.

The letter called on major AI developers to build tools that make AI systems easier to monitor. It also said companies should be able to identify AI agents operating in their systems, review what those agents did, and determine who authorized their actions.

OpenAI is accepting applications from additional organizations that want to add their names to the letter. Submissions require approval, and accepted organizations will be listed by name.

AI-Driven Attacks Add $1 Million to Data Breach Costs

AI-Driven Attacks Add $1 Million to Data Breach Costs

, , , , , , , , ,

IBM found malicious AI-driven attacks increased 56% from last year’s study, with the average breach now costing $6.04 million.

 

Key Takeaways

  • AI-driven attacks added an average of $1.01 million to malicious data breach costs.
  • More than 1 in 4 organizations experienced a malicious AI-driven attack, a 56% increase from last year’s study.
  • 21% of organizations experienced a breach involving an AI model or application.  Of these, 92% did not adequately restrict who could access their AI systems or require an additional identity check.
  • Extensive use of AI and automation in security reduced average breach costs by $1.93 million and shortened incidents by 65 days.

IBM found AI-driven attacks added an average of about $1 million to the cost of a malicious data breach, as attackers increasingly used AI to operate faster and at greater scale.

The average cost of a malicious AI-driven attack was $6.04 million, compared with $5.03 million for malicious attacks that did not involve AI.

The 2026 Cost of a Data Breach Report covered 602 organizations that experienced breaches between March 2025 and February 2026. Ponemon Institute conducted 3,558 interviews with executives, security personnel, and other employees familiar with the incidents.

AI-driven attacks increase

More than 1 in 4 organizations experienced a malicious AI-driven attack. That represents a 56% increase from last year’s study.

Deepfake and impersonation attacks accounted for 45% of these incidents. AI-generated phishing and other fraudulent communications accounted for 19%, as did AI-created or modified malicious software.

Financial services and energy companies accounted for a combined 62% of the AI-driven attacks in the study. Average breach costs reached $6.29 million for financial companies and $5.2 million for energy companies.

IBM said generative AI has reduced the time, cost, and technical expertise needed to create impersonation attacks and other attempts to deceive employees.

Breaches targeting AI systems also rise

The report separately examined breaches where attackers targeted an organization’s AI models or applications.

AI-related breaches affected 21% of the organizations studied, up from 13% last year. Among affected organizations, 92% lacked proper security controls over who could access their AI systems.

In 30% of AI-related breaches, attackers compromised software connected to the AI system rather than the model itself. Problems with cloud security settings accounted for 27%.

68% of breached organizations either lacked policies for managing AI or were still developing them. Only 19% said their AI governance and security teams worked together on the rules and protections for AI systems.

Using AI in cybersecurity reduces costs

When looking at all cyber breaches (both AI- and non-AI-driven), IBM found that organizations extensively using AI and automation in security averaged a breach cost of $4 million. Organizations that did not use the technologies averaged $5.93 million, a difference of $1.93 million.

Those extensively using AI as part of their security protocols identified and contained breaches in 215 days, 65 days faster than organizations that did not use security AI and automation.

However, only 36% of the organizations studied used the technologies extensively. Another 39% reported limited use, while 25% did not use AI at all.