iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
AI is helping criminals carry out familiar cyberattacks faster, at greater scale, and with more convincing messages—not replacing every attack with a new, autonomous threat. INTERPOL’s global chief information security officer Bjorn R. Watne described it as “an evolution and not a revolution” in remarks reported on October 2, 2026. For companies, the practical response is to protect the assets most important to their operations, strengthen identity checks, and prepare to detect and contain suspicious activity quickly.
How AI is changing cyberattacks
AI can lower the effort needed to research targets, produce persuasive messages, translate them, and adapt scripts or other tools. That can let attackers approach more people or organizations at once and make scams harder for employees to recognize. Watne said AI is increasing the “speed and scale” of existing techniques.
The distinction matters: a credible-sounding message is not proof of a wholly new attack method, and AI does not make every intrusion autonomous. The UK National Cyber Security Centre (NCSC) has described uneven capability gains across threat actors, including improvements to reconnaissance and social engineering, while also noting AI’s potential defensive uses in detection and triage. Its published near-term forecasts refer to a horizon beginning in 2023 and include projections for 2025; they should be read as historical analysis, not as a fresh 2026 forecast.
Recommended Free Tools
More convincing social engineering
Attackers can use AI-assisted translation and content generation to make fraudulent messages feel more natural or better suited to their recipients. INTERPOL’s reporting also describes digital identities that are more difficult to distinguish from genuine interactions. As a result, spotting typos or awkward wording is a weaker safeguard on its own. Fraudulent requests still need to be checked against established approval and verification procedures.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 3 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
More efficient targeting and intrusion work
Palo Alto Networks’ Unit 42 says that, in its 2025 incident-response engagements, attackers used AI to reduce friction in reconnaissance, social engineering, scripting, troubleshooting, and extortion. These uses can help criminals work more efficiently without proving that AI independently planned or executed an entire attack.
Once inside, attackers may rely on stolen passwords, session tokens, or excessive access rather than conspicuous malware. They may also abuse trusted SaaS integrations, third-party tools, or an organization’s own AI assistants. Activity carried out through valid accounts or familiar services can resemble routine work, making identity and permission monitoring as important as scanning for unusual files.
What the reported figures do—and do not—show
The available figures point to risks worth examining, but they measure different things and should not be treated as universal rates for companies or incidents.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsRank #2
- Enterprise-grade prevention, detection, correlation and response from the perimeter to the endpoint with our Total Security Suite.
- Gain critical insights about network security, from anywhere and at any time, with WatchGuard Cloud.
- Built-in compliance reports, including PCI and HIPAA, mean one-click access to the data you need to ensure compliance requirements are met.
- Up to 18 Gbps firewall throughput. Turn on all additional security services and still see up to 2.4 Gbps throughput.
| Reported finding | Scope and interpretation |
|---|---|
| 55% of reported cybercrimes were described as enabled by AI | INTERPOL’s 2026 African Cyberthreat Assessment Report, drawing on survey data from 36 African member countries. This is a regional finding, not a global share of cybercrime. |
| Cybercrime-related losses rose from USD 192 million to USD 484 million since 2024 | INTERPOL’s August 2026 announcement refers to losses in Africa and says they more than doubled. It is not a worldwide company-loss estimate. |
| 87% of intrusions involved activity across multiple attack surfaces | Unit 42’s finding from more than 750 incident-response engagements it handled in 2025. |
| Nearly 90% of investigations had material identity weaknesses; identity-based techniques drove 65% of initial access | Both figures describe Unit 42’s investigations and case data, not all companies or breaches. |
| 99% of more than 680,000 cloud identities examined had excessive permissions; some had gone unused for at least 60 days | Unit 42’s report analysis. It does not establish that the examined identities were a representative sample of cloud identities generally. |
INTERPOL’s Africa assessment also describes region-specific patterns: mobile-money fraud and infrastructure-targeted ransomware in East Africa; business email compromise and romance scams in Central and West Africa; and high connectivity attracting threat actors in Southern Africa. It reports deepfake-facilitated sextortion and synthetic identities that combine real personal data with fabricated details. These examples help explain the regional assessment; they should not be presented as a prevalence ranking for every market.
What companies should watch for
Focus monitoring on behaviors that could signal account misuse, fraud, or an attacker moving between systems. No single signal proves an AI-assisted attack, and routine activity can have legitimate explanations; the goal is to spot combinations that deserve investigation.
- Unexpected identity activity: unusual sign-ins, suspicious use of valid accounts or tokens, and changes to privileged access—especially when followed by activity across email, cloud, endpoints, or business applications.
- Requests that bypass normal process: urgent payment instructions, credential resets, remote-hiring requests, or other sensitive actions that arrive through a familiar channel but ask for an exception.
- Unexpected permissions or integrations: new or expanded access for users, service accounts, applications, or third-party tools, including permissions that are no longer needed.
- Unusual internal AI use: unexpected model or API activity, suspicious access to AI assistants, sensitive prompts, or abnormal use of the tokens and service accounts connected to those systems.
- Exposure that gives attackers an easy route in: critical vulnerabilities on internet-facing systems that remain unpatched, particularly when alerts are not reaching the team responsible for remediation.
How to prioritize defenses
Start with the systems and information whose loss or disruption would most affect operations. Then consider which criminals or other threat actors would have a reason to target them and what capabilities those actors are likely to use. Watne cautioned that “there is no need for everyone to try and protect against everything all at once when they’re not being targeted by it.” Threat intelligence can help a company focus on relevant tactics rather than buying controls without a clear risk case.
Rank #3
- Entry-Level Privacy Gateway: Designed for users who want simple online privacy protection at an affordable level—ideal for basic home networking and daily internet use.
- Secure Browsing for Everyday Needs: Perfect for email, social media, online shopping, and standard streaming—protecting your connection while keeping setup and operation easy.
- Lightweight Protection Against Common Online Threats: Helps reduce exposure to unwanted ads, trackers, and risky websites, improving online safety for your household.
- Simple Setup, No Technical Skills Required: Plug it in, follow the quick steps, and start using—an excellent choice for beginners who don’t want complicated network configurations.
- Decentralized VPN (DPN) Included – No Monthly Payments: Get built-in decentralized VPN access with lifetime free usage, helping you stay private without paying recurring subscription fees
Protect high-impact accounts and permissions
Use phishing-resistant multifactor authentication for high-value roles such as administrators, executives, and developers. Unit 42 recommends FIDO2/WebAuthn hardware security keys or passkeys. Before deploying keys, confirm that the organization’s identity provider and critical services support the chosen method, and define a secure recovery process for lost or replaced devices. Reduce standing administrator access, review excessive permissions, and manage machine identities and tokens as carefully as employee accounts.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Make sensitive requests independently verifiable
Require out-of-band verification for high-impact actions such as wire transfers and credential resets. Use a known, separately established contact method or an approval workflow—not the phone number, reply address, or link contained in the request. Apply the same principle to remote-hiring and other processes where an apparently genuine digital identity could influence access or payment decisions.
Shorten the path from exposure to containment
Prioritize rapid patching of critical vulnerabilities on internet-facing systems. Make sure teams can correlate identity, endpoint, network, cloud, SaaS, and third-party access signals, then rehearse how to disable a compromised account or token and limit its reach. Unit 42 recommends improving visibility and preparing to contain incidents quickly; these steps reduce response friction but cannot guarantee that an attack will be prevented.
Rank #4
- Single appliance with integrated firewalling, SD-WAN and Wi-Fi controller reduces complexity of WLAN management. Its zero-touch deployment helps optimize your onboarding experience.
- Built on a patented secure processor, this compact network firewall delivers the highest level of security and performance in its class – 800 Mbps IPS | 500 Mbps threat protection.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact and fanless design equipped with 4 GE RJ45 ports (1 WAN port and 3 internal ports) provide essential connectivity and flexibility for various network configurations in a small-scale environment.
- Including award-winning FortiGate hardware and 3-year FortiGuard AI-powered UTP security services. Services cover IPS, Advanced Malware Protection, Application Control, URL, DNS & Video Filtering, Antispam Service, and FortiCare Premium customer support.
Govern AI assistants and connected services
Inventory internal AI tools and the data, APIs, permissions, and service accounts they can reach. Monitor for unusual model and API activity, sensitive prompts, token use, and unexpected changes in access. An assistant with access to internal operational context can become a route to exposure if it is compromised or misused; restrict that access to what the task requires and review it as systems and workflows change.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why agentic AI raises a separate concern
AI that takes actions, rather than only generating information, can create consequences beyond a misleading answer if it acts incorrectly or is misdirected. Watne specifically raised concern about incorrect actions in physical settings, citing the growing use of AI in vehicles and self-driving vehicles. This is a warning about potential consequences, not evidence that a particular cyberattack has caused physical harm through such a system.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Organizations using AI to trigger consequential actions should make permissions, approval points, monitoring, and human intervention proportionate to the possible harm. The more consequential the action, the less appropriate it is to rely on an unchecked model output or a single automated decision.
What the evidence can establish
INTERPOL’s figures and examples concern Africa. Unit 42’s statistics come from the vendor’s own investigations and incident-response engagements; they are useful signals about cases it handled, not representative estimates for every organization. The NCSC’s forecast language is dated, while its analysis still helps explain how AI can enhance existing tactics and support defensive work. These sources offer complementary perspectives, not directly comparable datasets.
Taken together, they support a practical conclusion: companies should not assume that every attack is AI-driven, but they should account for attackers who can produce more convincing approaches and exploit identity, permissions, and trusted services at greater speed. Prioritize based on the assets at risk, and make it harder for a single deceptive interaction or compromised account to lead to a high-impact action.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
