An attacker can use AI to draft a convincing message in minutes, while a security team may need hours to investigate one. AI is changing the economics and speed of cyberattacks by reducing effort in some routine tasks. It doesn’t make every attacker more skilled or every attack autonomous. But it can leave your organisation less time to spot trouble and act. The key test is whether your people, processes and controls can respond before an intruder reaches their goal.

How AI is changing the economics of cyberattacks

Routine tasks take less time

Generative AI can help attackers review public information, translate messages and write tailored emails. It can also produce basic scripts or adapt existing text for different targets. These tools speed up familiar tasks; they don’t prove that an attacker can run a complete operation without human input.

A fluent message may seem more plausible, especially when it uses details about a person or company. But good writing alone won’t bypass email filters or persuade every recipient. The result depends on the tool, the operator and the target.

Expertise still matters

AI assistance with common tasks is different from gaining access to a network or keeping it. Attackers still need to choose targets, work around defences and achieve a goal, such as stealing data or disrupting services. Those steps call for skills and judgement that a text generator can’t guarantee.

Tools also vary in quality, and operators may use them badly. A weak plan remains weak even when an AI tool helps draft its messages. Lower effort in one part of an attack doesn’t remove the other barriers.

Crime still depends on results

Saving time on research or message writing could improve an attacker’s return on effort. Yet that return still depends on whether someone clicks, whether access can be kept, and whether stolen data or funds can be turned into a gain. Detection can also cut an operation short.

There’s no sound basis for assigning a fixed saving to attackers across all cases. A faster start may help, but it doesn’t guarantee a successful attack or a profit.

Why AI can make cyberattacks faster

Reconnaissance and social engineering can speed up

AI tools can help sort through public material and shape messages for a particular person or team. That can shorten preparation time and make a request sound familiar. It doesn’t ensure that the message will get past technical checks or seem genuine to its recipient.

Attackers can also change wording quickly when an approach fails. For defenders, this makes it harder to rely on spotting one repeated phrase or format. Identity checks and reporting routes matter more than trying to predict every version of a message.

Slow reviews give intruders more time

High alert volumes, manual approvals and unclear escalation paths can delay a response. If a stolen account remains active while staff decide who owns the alert, an intruder has more time to act. A tool can raise a warning, but people still need a clear way to assess and contain it.

Measure the time between an alert and triage, then track how long it takes to isolate a device or disable a compromised account. These intervals show where your response stalls. They also give teams a practical way to test whether changes improve performance.

Familiar attack methods remain central

AI is an accelerator, not a new category of attack. Credential theft, software flaws and social engineering remain common ways into organisations. Controls against these methods still deserve attention.

The Verizon 2024 Data Breach Investigations Report found that exploitation of vulnerabilities as an initial access vector rose by 180% compared with the prior year. That finding is useful context for patching and exposure management; it is not evidence that AI caused the increase.

What real-world evidence says about AI attacks

AI tools have supported threat actors

OpenAI reported disrupting activity by state-affiliated groups that had used its tools for tasks such as research, translation, coding support and drafting. The report found no evidence that this use created significant new capabilities. It points to practical assistance, rather than proof of a major shift in what those groups could do.

This distinction matters for security planning. AI may help with parts of an operation without changing the attacker’s overall skill or success rate. Treat reported use as a reason to review controls, not as proof that every attack has become more advanced.

Deepfakes can make impersonation harder to spot

Hong Kong police reported a 2024 case in which an employee transferred about HK$200 million after a video call involving deepfake versions of colleagues. The incident shows the risk of trusting a face or voice as proof of identity. It doesn’t mean that AI is involved in every impersonation scam.

For sensitive requests, confirm the person through a separate, trusted channel. A familiar voice or live video should not replace approval steps for payments or changes to access.

Forecasts warn of growing pressure

The UK National Cyber Security Centre assessed that AI was likely to increase the volume and heighten the impact of cyberattacks over the following two years. This is an expert forecast, not a promise that every organisation will face a more severe incident. It does point to a need for teams to prepare for more activity and less time to review it.

How security controls can keep pace with cyberattacks

Strengthen identity and verification

Use phishing-resistant multifactor authentication where possible, and give staff only the access their roles require. Monitor for unusual sign-ins, such as unexpected locations or devices. These steps can limit what an attacker can do with a stolen password.

Set an independent check for payment requests and changes to bank or access details. Use a second channel and established approval rules, rather than trusting a voice or video call alone. Make sure staff know how to raise concerns quickly.

Close common entry points

Prioritise timely fixes for known vulnerabilities, especially on internet-facing systems. Secure configuration, email protections and endpoint monitoring can also reduce exposure or help spot suspicious activity. The Verizon DBIR finding on vulnerability exploitation reinforces the value of this work, regardless of whether AI played any role.

Test backups before an incident, and check that teams can restore critical services from them. A backup that hasn’t been tested may not help when a system is down. Keep recovery steps clear and assign responsibility in advance.

Measure detection and response times

Track how quickly your team detects suspicious activity, contains it and revokes compromised credentials. Measure recovery time for critical services as well. These figures show whether controls work together, not just whether each product is switched on.

Run realistic exercises that include a convincing impersonation or AI-assisted phishing attempt. Check when staff report it, how alerts reach the right team and how quickly accounts or devices can be secured. Use the delays you find to update your playbooks.

Use AI defensively, with clear limits

Automate repeatable work with oversight

Defensive tools can enrich alerts, group related events and summarise an investigation. Automation may also support routine response actions, such as opening a case or collecting relevant logs. Human review remains important when an action could lock out a user or disrupt a service.

Keep a record of automated decisions and review errors as well as successes. That gives your team a way to spot poor results and adjust the process. Don’t give a tool wider access than its job requires.

Set rules for approved AI use

Tell employees which AI tools they may use and what data they must keep out of them. Sensitive customer, staff or company information should only go into tools approved for that purpose. Set rules for checking generated code before it reaches production.

Staff also need a clear way to report suspicious messages or synthetic media. Simple guidance can help them pause, check the request through a trusted channel and report concerns without delay.

Rehearse the full response

Tabletop and technical exercises should test reporting, escalation, account lockout and device isolation. Include payment checks and service recovery, not only the first alert. A response plan is useful only if people can follow it under pressure.

After each exercise, record where time was lost and who needs to act next. Update the playbook, then test it again. Rehearsal turns assumptions about response speed into evidence.

Conclusion: Security speed matters as much as coverage

AI can make some attack tasks faster and easier to scale, but it doesn’t remove the need for skill or guarantee success. Familiar methods such as credential theft, vulnerability exploitation and impersonation still call for strong controls. Identity checks, timely patching, monitoring and tested recovery all reduce the chance that an attacker can act unchecked.

The real question is how quickly your organisation can respond when a request looks convincing and time matters. Test your people and controls, find the delays, and fix them before an incident forces the issue.