In the AI era, phishing remains the top attack vector in both use (17% of breaches) and breach costs (averaging at $5.29 per breach) according to the IBM Cost of a Data Breach Report 2026. AI creates more personalized content for phishing with higher success rates. At the same time, AI can identify vulnerabilities, use the phished entry point and elevate privileges for lateral movement at greater speed.
None of this is new – cyberattacks haven’t changed with AI. “It just allows attackers to do the same familiar things much faster and at greater scale than ever before. The pressure comes from minimizing the time for defenders to respond,” says Steve Wallin, director of core integration and R&D labs leader at IBM UK.
For now, AI-generated attacks are still in the minority – little more than 20% of all attacks. But the writing (written by AI) is on the wall, and it is incumbent on enterprises to improve their security defenses now before the tsunami arrives in full.
SecurityWeek talked to Wallin on how enterprises should respond to this growing AI threat. Again, it is nothing new – it must just be done better.
It starts with a basic maxim that is as old as the ancient Delphic Oracle: ‘know thyself’. “Organizations must understand their existing security posture. The key to defending against this increasing volume of attacks and decreasing time to respond is again nothing new. It means focusing on proactive rather than reactive defense. It is security by design from the ground up rather than a bolt-on reaction,” said Wallin.
Proactive cyberdefense is a combination of understanding how attacks work, understanding the enterprise infrastructure and business, and being prepared for all possibilities.
“Zero trust is fundamental to stay in control of credentials, access, and enterprise data. You can no longer build a moat or wall around the infrastructure, so zero trust security by design must be built into the infrastructure, the applications, the API entry points, and the data management,” said Wallin. “This can only be achieved with a full understanding of what is important to the business.”