How Cybercriminals Are Weaponising AI: The New Attack Playbook Enterprises Need to Understand

The Threat Is Not Coming — It's Already Here

In 2025, a finance employee at a multinational firm transferred £20 million to fraudsters after taking part in a video call with what appeared to be his CFO and several colleagues. Every person on the call was a deepfake. The employee only discovered the fraud after calling his CFO's real number to confirm a detail. By then, the money was gone.

This was not a sophisticated nation-state operation. The tools used — voice cloning, real-time video deepfaking, AI-assisted social engineering scripts — are commercially available. The attack was scripted, rehearsed, and executed with a level of production quality that would have been the exclusive domain of intelligence agencies three years ago. Today it requires a mid-tier threat actor with a budget and patience.

According to the World Economic Forum's 2026 Global Risk Report, AI-augmented cyber threats now rank among the top five near-term global risks. The FBI reported a 400% year-on-year increase in AI-assisted business email compromise in 2025. CrowdStrike's 2026 threat intelligence data shows the average time from initial access to data exfiltration has compressed from 84 minutes in 2023 to under 20 minutes — a direct result of AI-assisted lateral movement tools available on darknet forums.

The threat is not theoretical. It is in production, at scale, and targeting enterprises of every size and sector.

AI-Generated Phishing: The End of “Spot the Typo” Advice

For years, security awareness training taught employees to look for telltale signs of phishing: broken English, generic salutations, mismatched domains, implausible urgency. These heuristics worked — not because attackers lacked motivation, but because they lacked the language capability to produce convincing, personalised communications at scale.

Generative AI has eliminated that constraint entirely. Modern LLMs can generate perfectly grammatical, contextually appropriate phishing emails in any language, any register, and any voice. More dangerously, they can be combined with data harvested from LinkedIn, company websites, press releases, and social media to produce hyper-personalised spear phishing that references real projects, real colleagues, and real business context.

The personalisation attack that previously required a human analyst to spend hours researching a target can now be scripted and executed at industrial scale. One researcher demonstrated in early 2026 that a £50 API budget could generate 10,000 individually personalised phishing emails, each referencing specific details about the recipient's role, recent activity, and company context. Click-through rates on AI-personalised phishing in controlled studies run 35-45% higher than generic campaigns.

Traditional email security gateways — even those with machine learning components — are struggling to adapt. They were trained on patterns that no longer hold. The signals they relied on (poor grammar, suspicious formatting, generic sender names) have been eliminated by the same LLMs that security teams are adopting for productivity. Defenders and attackers are now running the same playbooks, with the attackers currently ahead on adaptation speed.

Deepfake Fraud: When You Can't Trust Your Own Eyes or Ears

Voice cloning has crossed a quality threshold that makes it genuinely dangerous in enterprise contexts. With as little as three seconds of clean audio — extractable from a public earnings call, a podcast appearance, or a LinkedIn video — attackers can generate a convincing synthetic voice of any executive. Real-time voice conversion tools allow a human caller to speak and have their voice translated to the target voice with sub-200ms latency.

The attacks that use this capability follow a predictable playbook: an attacker calls the CFO's assistant or a finance team member, impersonating the CEO. They reference a confidential acquisition, an urgent regulatory requirement, or a sensitive deal that mustn't go through normal channels. The urgency and the familiar voice together short-circuit the verification instincts that slower communications allow.

Video deepfakes add another layer. The technology required to generate convincing real-time video deepfakes of known individuals — viable for video call impersonation — has become accessible to well-resourced criminal groups within the past 18 months. The Hong Kong deepfake case cited above was an early indicator. Subsequent cases across the financial services, legal, and technology sectors suggest this has become a repeatable attack pattern, not an isolated experiment.

What makes deepfake fraud particularly resistant to traditional controls is that it bypasses technical security entirely. No malware, no credential theft, no network intrusion — just human trust, exploited at the point of highest authority and lowest verification. The most secure infrastructure in the world doesn't protect against an employee voluntarily initiating a wire transfer because they believe they've spoken to their CEO.

Automated Vulnerability Discovery: Attack at Machine Speed

AI is not only changing the social engineering layer of attacks. It is transforming technical attack capability in ways that are equally concerning for enterprise security teams.

Vulnerability discovery — identifying exploitable weaknesses in software, APIs, and configurations — traditionally required significant human expertise and time. AI-assisted tools are compressing that dramatically. LLM-powered fuzzing frameworks can generate targeted inputs that trigger edge-case behaviours far more efficiently than traditional fuzzing. AI code analysis tools, when pointed at open-source dependencies or reverse-engineered binaries, can identify subtle logic errors, race conditions, and authentication bypasses that would take a human analyst days to find.

The practical consequence is that the window between a vulnerability existing and it being actively exploited is shrinking. Security teams that previously relied on a reasonable lag between patch availability and mass exploitation to manage their patching cadence are finding that window compressed to hours in some cases. AI-assisted exploit development can take a disclosed vulnerability to a working exploit in a fraction of the time it took just two years ago.

On the defensive side, the same AI capabilities are being deployed for proactive vulnerability scanning, attack surface management, and penetration testing assistance. But the asymmetry is significant: defenders must protect everything; attackers only need to find one path in. AI tools give attackers the ability to explore that path space at a scale and speed that puts significant pressure on even well-resourced security programmes.

Prompt Injection: The Attack Vector Nobody Planned For

As enterprises deploy AI agents, copilots, and LLM-integrated workflows, a new class of attack has emerged that has caught most security teams completely unprepared: prompt injection.

Prompt injection exploits the fact that LLMs cannot reliably distinguish between instructions from trusted system operators and instructions embedded in untrusted data they are processing. An attacker who can get malicious instructions into a document, email, or webpage that an AI agent will process can potentially hijack the agent's behaviour — causing it to exfiltrate data, take unauthorised actions, or bypass its intended guardrails.

The attack surface is significant and growing rapidly. An AI email assistant that summarises inbox content can be manipulated by a carefully crafted email in the inbox. An AI document processor can be subverted by hidden instructions in a document it is asked to analyse. An agentic AI with access to internal systems and the ability to send emails can be weaponised to exfiltrate sensitive data if an attacker can inject instructions into any data source it processes.

OWASP added prompt injection to its Top 10 LLM Application Security Risks in 2025, and it remains the highest-rated risk on that list in 2026. Unlike traditional injection attacks (SQL injection, command injection), prompt injection does not have a clean defensive solution equivalent to parameterised queries. The defences are layered and probabilistic — system prompt hardening, input validation, output filtering, privilege separation, human review gates for high-stakes actions — rather than categorical. Every enterprise deploying AI agents needs to understand this attack surface before deploying in production.

How Leading Enterprises Are Adapting Their Defences

The enterprises navigating this landscape most effectively are not the ones buying the most security tooling. They are the ones rethinking their assumptions about what “secure” means in an AI-threat environment and building defences that address the new attack surfaces specifically.

Rebuilding verification workflows. The deepfake threat demands that verbal authorisation alone cannot justify financial transfers or access grants above a certain threshold. Leading organisations are implementing callback verification procedures — a separate, pre-registered number that must be called to confirm any unusual or high-value request, regardless of how convincing the original communication was. Some are extending this to code words or shared secrets that are never communicated digitally.

Rearchitecting security awareness training. Training employees to spot bad grammar is now actively misleading — it teaches them a heuristic that no longer works and may give them false confidence. The new training focuses on process adherence: follow the verification procedure every time, regardless of urgency, authority, or apparent familiarity. The goal is to make process-following automatic and to inoculate employees against the social pressure tactics that bypass it.

Deploying AI-native email security. Traditional signature and rule-based email security is insufficient against AI-generated phishing. The defensive response requires AI-powered analysis that evaluates the semantic intent and context of messages, not just their surface characteristics. Tools from vendors like Abnormal Security, Darktrace, and Microsoft Defender are evolving rapidly to address AI-generated threats — but selection and configuration require security expertise.

Treating AI agent deployments as a new security perimeter. Every AI agent that touches internal systems represents a new attack surface. Security-conscious organisations are applying least-privilege principles rigorously — agents only have access to the specific tools and data sources they need, write access is minimised, irreversible actions require human approval, and all agent actions are logged with sufficient detail for audit and forensics.

Threat intelligence for AI attack tooling. Staying current on how AI is being weaponised requires dedicated threat intelligence effort. The darknet ecosystem around AI attack tools is evolving rapidly. Security teams that maintain threat intelligence subscriptions and actively monitor emerging AI attack patterns are better positioned to adapt defences proactively rather than reactively.

The Security Programme for the AI Threat Era

Addressing AI-augmented threats is not a discrete project with an end date — it is a recalibration of how enterprise security programmes operate. The organisations that will remain secure are those that treat AI threat evolution as a permanent, ongoing operational reality rather than a specific risk to be addressed and closed.

This means continuous security posture assessment that explicitly includes AI attack surfaces. It means red team exercises that specifically test deepfake and AI-assisted social engineering scenarios. It means governance frameworks for AI deployment that treat security as a first-class concern from the outset, not an afterthought. And it means investing in the security expertise needed to evaluate, select, configure, and operate the AI-native defensive tooling that this threat environment demands.

The cost of inaction is quantifiable. The average enterprise data breach cost reached £4.1 million in 2025, a figure that rises significantly when AI-assisted attacks are involved due to their speed and the typical delay before detection. The cost of a proactive AI security programme is a fraction of that — and it is an investment that compounds, because the capabilities, processes, and culture it builds remain valuable as the threat landscape continues to evolve.

What We'll Be Covering Next

This article is the opening of a broader series on AI-era enterprise security. The topics we'll be exploring in upcoming pieces are each substantial enough to deserve dedicated treatment:

Defending your AI agents from prompt injection — A technical deep-dive into the specific architectural decisions, guardrail configurations, and operational practices that reduce prompt injection risk in enterprise AI deployments. If your organisation is deploying agentic AI — and most are — this is essential reading.

Building a deepfake detection and verification protocol — The practical steps for implementing verification workflows that hold up against real-time voice and video deepfakes, without creating so much friction that they get bypassed under pressure.

AI-native security tooling: an enterprise buyer's guide — An honest evaluation of the defensive AI security market — what the tools actually do, where they fall short, and how to build a stack that addresses the threat landscape rather than just filling a compliance checkbox.

If any of these topics connects with a specific challenge your team is navigating right now, we're happy to talk through it in detail. The threat is moving quickly — the conversations worth having are the ones that happen before an incident.