AI Cyberattack Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen | Last updated: October 21, 2026 | License: CC BY 4.0
One in four malicious data breaches studied by IBM between March 2025 and February 2026 was AI-enabled, and each cost an average of $6.0 million — $1.01 million more than the global breach average. Yet the FBI’s complaint data puts AI in just 2.2% of US cybercrime reports. Axis Intelligence Research measures that disagreement for the first time.
Quick Answer
AI-enabled attacks reached 25% of malicious breaches in IBM’s 2026 study (up 56% in a year) and carry a 20.2% cost premium, per Axis Intelligence Research calculations on IBM data. Speed is the clearest signal: Mandiant measured a 22-second handoff from initial access to a second threat group, and Microsoft says new vulnerabilities are weaponized in well under 24 hours. Across six flagship datasets, Axis Intelligence Research finds the measured AI share of attacks varies 11.3-fold, depending on what each source counts.
Key Findings
- IBM’s Cost of a Data Breach Report 2026 found that one in four malicious breaches was AI-enabled, a 56% increase on the prior year, across 602 organizations.
- Axis Intelligence Research calculates that AI-enabled breaches cost $1.01 million (20.2%) more than the $4.99 million global average in IBM’s 2026 study.
- Axis Intelligence Research finds that FBI IC3 complaints referencing AI lost $39,946 each in 2025, 1.93 times the $20,699 average across all 1,008,597 complaints.
- The Axis AI Attack Measurement Gap (AAMG) has a baseline reading of 11.3×: IBM’s 25% AI share of malicious breaches is 11.3 times the 2.2% AI share of FBI complaints.
- Axis Intelligence Research calculates that only 75 of 530 high- or critical-severity open-source bugs disclosed under Anthropic’s Project Glasswing were patched by May 22, 2026 — a 14.2% patch rate.
How Many Cyberattacks Use AI in 2026?
Between 2.2% and 25%, depending on whose ledger you open. That is not a rounding problem. It is four organizations counting four different things.
The highest figure comes from IBM. Its Cost of a Data Breach Report 2026 studied 602 breached organizations between March 2025 and February 2026 and classified one in four malicious breaches as AI-enabled — mostly deepfake impersonation and AI-enabled malware, according to IBM. IBM says that share rose 56% in a year, which implies roughly 16% the year before (Axis Intelligence Research calculation: 25 ÷ 1.56).
Verizon publishes no AI share at all. Its 2026 Data Breach Investigations Report analysed 22,624 breaches and 31,860 incidents from November 1, 2024, to October 31, 2025, and measured AI from the other side: through Anthropic’s enforcement data on 793 threat actors.
The FBI sits at the bottom. The 2025 IC3 Annual Report logged 22,364 complaints whose narrative referenced artificial intelligence, out of 1,008,597 total. Axis Intelligence Research calculates that as 2.2% of complaints and 4.3% of reported losses ($893.3 million of $20.877 billion).
The AI Attack Measurement Gap (AAMG): the 11.3× spread
The AI Attack Measurement Gap (AAMG) is an Axis Intelligence Research metric that divides the highest published AI share of attacks by the lowest, across primary datasets covering the same twelve-to-sixteen-month window. A reading of 1.0 would mean every major dataset agrees on how much of the threat is AI. The October 2026 baseline reading is 11.3×.
AAMG = highest published AI share ÷ lowest published AI share = 25% (IBM) ÷ 2.217% (FBI IC3 complaints) = 11.3×
| Dataset | What is counted | AI share | Period | Source |
|---|---|---|---|---|
| IBM Cost of a Data Breach 2026 | Malicious breaches at 602 breached orgs | 25% | Mar 2025–Feb 2026 | IBM |
| Verizon DBIR 2026 | 22,624 breaches | No AI share published | Nov 2024–Oct 2025 | Verizon |
| FBI IC3 2025 (losses) | Reported US victim losses | 4.3% (Axis calc.) | CY 2025 | FBI IC3 |
| FBI IC3 2025 (complaints) | US victim complaints | 2.2% (Axis calc.) | CY 2025 | FBI IC3 |
| CrowdStrike Global Threat Report 2026 | Activity by AI-enabled adversaries | No share; +89% growth | CY 2025 | CrowdStrike |
| Mandiant M-Trends 2026 | 500,000+ IR hours | No AI share published | CY 2025 | Mandiant |
| ENISA Threat Landscape 2026 | 8,257 EU incidents | No AI share published | CY 2025 | ENISA |
What Verizon’s 793-actor dataset shows about AI attacks
Verizon’s 2026 DBIR worked with Anthropic’s enforcement data on 793 threat actors banned between March 2025 and February 2026. The median actor sought AI help with about 15 distinct MITRE ATT&CK techniques; the heaviest users queried 40 or 50.
| DBIR 2026 AI finding | Value | Source |
|---|---|---|
| Threat actors analysed (Anthropic enforcement data) | 793 | Verizon DBIR 2026 |
| Techniques per actor with AI assistance (median) | ~15 | Verizon DBIR 2026 |
| Actors rated high or critical risk | less than 1% | Verizon DBIR 2026 |
| Phishing share of AI-assisted initial-access techniques | 44% (n=837) | Verizon DBIR 2026 |
| Exploitation share of AI-assisted initial-access techniques | 32% | Verizon DBIR 2026 |
| AI-assisted malware observations using rare techniques | less than 2.5% | Verizon DBIR 2026 |
| Known malware examples per AI-assisted technique (median) | 55 | Verizon DBIR 2026 |
| Phishing as initial access vector, all breaches | 16% (unchanged YoY) | Verizon DBIR 2026 |
Verizon’s conclusion is blunt: AI’s primary impact is currently operational, automating techniques defenders already know how to detect. Phishing leads AI-assisted access techniques, yet phishing’s share of breach entry points has barely moved in the incident data.
One discrepancy readers should know about. Verizon’s DBIR web page summarizes this section as “15%” of attack techniques bolstered by generative AI. Axis Intelligence Research searched the full 121-page report and found no such percentage: the 15 is a median count of techniques per threat actor. Anyone citing “15% of attacks use AI” from Verizon is citing a number the report does not contain.
Marcus Chen: The gap is not evidence that anyone is wrong. IBM interviews breached companies after the fact and can see the deepfake call in the incident file. The FBI counts what a victim typed into a complaint form, and most victims never learn a model wrote the lure. The real takeaway is that only two of the six flagship datasets publish an AI share at all. Mandiant went further and said plainly that it does not consider 2025 the year breaches were the direct result of AI. When the incident responders and the insurers’ favorite survey disagree by an order of magnitude, a board should treat any single “AI attack” percentage as a property of the methodology, not of the threat.
How Much Does an AI-Enabled Data Breach Cost?
$6.0 million on average, against a $4.99 million global average, according to IBM’s 2026 study. Axis Intelligence Research calculates the AI breach premium at $1.01 million, or 20.2%.
| Metric | Value | Period | Source |
|---|---|---|---|
| Average cost, AI-enabled breach | $6.0M | Mar 2025–Feb 2026 | IBM |
| Average cost, all breaches (global) | $4.99M | Mar 2025–Feb 2026 | IBM |
| AI breach premium | +$1.01M (+20.2%) | Mar 2025–Feb 2026 | Axis Intelligence Research calc. on IBM |
| Average cost, financial services breach | $6.3M | Mar 2025–Feb 2026 | IBM |
| Average cost, energy breach | $5.2M | Mar 2025–Feb 2026 | IBM |
| Cost reduction with AI and automation in security operations | almost $2M | Mar 2025–Feb 2026 | IBM |
Which sectors do AI-driven attacks hit hardest?
IBM reports that 62% of AI-driven attacks targeted critical infrastructure sectors. The two most expensive verticals in the 2026 study were financial services ($6.3 million) and energy ($5.2 million). IBM also found that reported ransomware incidents rose to 39% from 34%. For a sector-by-sector cost view, see Axis Intelligence Research’s cybersecurity statistics by industry.
Marcus Chen: Note the symmetry. The attacker’s AI adds about $1 million to a breach; the defender’s AI and automation subtract almost $2 million, by IBM’s own count. IBM sells security services, so read that framing with care, but the arithmetic still says the same thing it says every year: the expensive part of a breach is the days nobody noticed, and automation buys back days. The premium is real. It is also smaller than the savings available to anyone who actually deploys the tooling.
How Fast Are AI-Assisted Cyberattacks?
Faster than most change-control processes. The speed data is the most consistent signal across every 2026 dataset.
| Speed metric | Value | Period | Source |
|---|---|---|---|
| Average eCrime breakout time | 29 minutes | 2025 | CrowdStrike |
| Fastest recorded breakout | 27 seconds | 2025 | CrowdStrike |
| Handoff, initial access → second threat group | 22 seconds (vs. 8+ hours in 2022) | 2025 | Mandiant M-Trends 2026 |
| Mean time to exploit | −7 days (before patch) | 2025 | Mandiant |
| Discovery → weaponization (median) | well below 24 hours | 2026 | Microsoft |
| Enterprise remediation, critical external vulns | 30–60 days | 2026 | Microsoft |
| AI-assisted AWS intrusion, credential theft → admin | 8 minutes | Nov 28, 2025 | Sysdig |
Breakout time is how long an intruder takes to move from the first compromised host to others. CrowdStrike’s 2026 Global Threat Report put the 2025 average at 29 minutes, with a fastest case of 27 seconds, and said AI-enabled adversaries increased operations by 89% year over year.
Mandiant’s figure is starker. In 2022 the handoff from an access broker to the group that monetizes the intrusion took more than eight hours. In 2025 it took 22 seconds. Axis Intelligence Research calculates that as at least a 1,309-fold compression (28,800 seconds ÷ 22), a lower bound because Mandiant gives the 2022 value as “more than” eight hours.
The Microsoft Digital Defense Report 2026, published October 1, 2026, counts nearly 40,000 CVEs in the first half of 2026 alone and projects a record of about 72,000 for the full year, with a median weaponization time well under a day and enterprise remediation of 30 to 60 days. Axis Intelligence Research calculates a remediation-to-weaponization ratio of at least 30 to 1.
One incident shows what that looks like in a cloud console. Sysdig documented an intrusion on November 28, 2025, in which an actor used test credentials left in public S3 buckets holding RAG data and reached administrative access in about eight minutes. Sysdig inferred LLM assistance from the code artifacts, including attempts to assume roles in account IDs that do not exist.
Marcus Chen: None of these intrusions needed a zero-day. Sysdig’s actor found keys in a public bucket. The 22-second handoff is an automation story — a broker’s tooling passing a shell to a buyer’s tooling — and AI is one ingredient in that pipeline, not the whole thing. What has changed is the denominator. A 30-day patch cycle was defensible when exploitation took weeks. Against a sub-24-hour weaponization median, the same cycle leaves a month-long window open by design. See our vulnerability exploitation statistics for the CVE-level picture.
Can AI Run a Cyberattack on Its Own?
Partly, and the documented cases moved from hypothetical to operational between September 2025 and May 2026.
- September 2025 — the first AI-orchestrated espionage campaign. Anthropic reported that a group it assessed with high confidence as Chinese state-sponsored manipulated its Claude Code tool to attack roughly thirty global targets, including large technology companies, financial institutions, chemical manufacturers and government agencies. AI performed 80–90% of the campaign, with humans stepping in at four to six decision points. The actor succeeded in a small number of cases.
- May 2026 — the first AI-developed zero-day. The Google Threat Intelligence Group reported, for the first time, a criminal actor using a zero-day exploit it believes was developed with AI: a two-factor authentication bypass in a popular open-source web administration tool. GTIG cited a hallucinated CVSS score in the exploit code as one indicator, and says its disclosure may have prevented mass exploitation.
- October 2026 — 32 chained attack stages. Microsoft’s 2026 report describes a frontier-model evaluation that strung 32 attack stages together in a controlled environment.
| Case | Date | Autonomy indicator | Source |
|---|---|---|---|
| GTG-1002 espionage campaign | Sep 2025 (reported Nov 13, 2025) | 80–90% of work by AI; 4–6 human decision points; ~30 targets | Anthropic (company-reported) |
| AI-assisted AWS intrusion | Nov 28, 2025 | ~8 minutes to admin | Sysdig |
| AI-developed 2FA-bypass zero-day | Reported May 11, 2026 | Exploit code attributed to an AI model | Google GTIG |
| Frontier evaluation | Reported Oct 1, 2026 | 32 stages chained | Microsoft |
The GTG-1002 case predates this update by more than six months and is flagged as older data in the CSV; it stays because it remains the only public, primary-sourced measurement of how much of a live intrusion an AI system carried out.
Marcus Chen: Read the GTG-1002 report closely and the headline softens in an instructive way. Thirty targets, “a small number” of successes, and a model that occasionally hallucinated credentials it did not have. That is not a superweapon. It is a junior operator that never sleeps and never gets bored of enumeration. The defensive lesson is the same one the DBIR teaches every spring: the attack chain still runs through exposed services and reused credentials. AI just walks it faster. Our agentic AI security statistics and the AI Agent Security Incident Tracker follow these cases as they are disclosed.
What Malware Uses AI While It Runs?
Google and Microsoft document at least nine families between them. Google tracks four that use large language models for obfuscation and three that call an LLM at runtime; Microsoft’s 2026 report adds three classes in which the model becomes part of the attack itself.
| Family | How it uses AI | Target | Source |
|---|---|---|---|
| LAMEHUG | Sends prompts to a remote LLM to generate operational commands in real time (July 2025) | Ukraine | Microsoft |
| s1ngularity | Trojanized Nx npm packages hijacked locally installed AI CLIs (Claude Code, Gemini CLI, Amazon Q CLI) to hunt secrets; leaked ~2,000 secrets and ~20,000 files across 225 victims (Aug 2025) | Developers | Microsoft |
| PromptLock | Experimental ransomware prototype that receives Lua scripts from an open-weights model at runtime (Aug 2025) | Windows, Linux, macOS | Microsoft |
| PROMPTSPY | Android backdoor that sends on-screen UI data to Gemini 2.5 Flash-Lite and executes the returned taps and swipes | Android devices | Google GTIG (first identified by ESET) |
| HONESTCUE | Queries the Gemini API at runtime for VBScript obfuscation and evasion | Windows | Google GTIG |
| PROMPTFLUX | Uses the Gemini API to regenerate its own code | Windows | Google GTIG |
| CANFAIL | LLM-generated decoy code as filler | Ukrainian organizations (Russia-nexus) | Google GTIG |
| LONGSTREAM | LLM-generated decoy code (32 daylight-saving queries) | Ukrainian organizations (Russia-nexus) | Google GTIG |
Runtime use matters because the malicious logic is not fully present in the binary on disk. Each execution can ask the model for new code, which degrades signature-based detection. Google says it disabled assets associated with PROMPTSPY and found no apps containing it on Google Play.
Mandiant’s M-Trends 2026 adds QUIETVAULT, a credential stealer that checks whether AI command-line tools are installed on the victim’s machine — a sign that developer workstations running coding agents are now a target class of their own.
Are Attackers Targeting AI Systems Themselves?
Yes, and the numbers are larger than the “AI as weapon” figures.
- More than 90 organizations had legitimate generative AI tools hit with injected malicious prompts in 2025, per CrowdStrike. Prompt injection is an attack that hides instructions in content an AI system reads, so the model follows the attacker instead of the user. See our prompt injection statistics.
- More than 20% of organizations in IBM’s 2026 study reported a breach targeting AI models or applications.
- Nearly 900,000 installs of malicious browser extensions posing as AI assistants, affecting more than 20,000 enterprise tenants, harvested URLs, page content and AI chat histories from platforms such as ChatGPT and DeepSeek (Microsoft Digital Defense Report 2026).
- Late March 2026: the actor GTIG tracks as TeamPCP (UNC6780) compromised PyPI packages and GitHub Actions workflows, touching projects including Trivy, Checkmarx, LiteLLM and BerriAI, then deployed the SANDCLOCK stealer to lift AWS keys and GitHub tokens.
Microsoft says 88% of enterprises are experimenting with AI agents. IBM says more than half use agents for threat detection and containment, but only 18% apply them to vulnerability management.
What attacks hit AI workloads most often?
Malicious link injection, by a wide margin. In Microsoft telemetry from Azure AI workloads over a 90-day window in 2026, link injection routed through model and tool outputs made up 52% of observed attack activity. Axis Intelligence Research calculates that the top three classes together account for 80%.
| Attack class on AI workloads (Microsoft telemetry, 2026) | Share |
|---|---|
| Malicious link injection and exfiltration | 52% |
| Jailbreak and safety bypass | 16% |
| Tool and agent abuse | 12% |
| Identity and credential abuse | 10% |
| Prompt injection and instruction subversion | 8% |
| Reconnaissance and data probing | 2% |
| Attacked AI cloud subscriptions, by service (Microsoft, 2026) | Share |
|---|---|
| OpenAI / Azure OpenAI | 39% |
| Custom AI agents, copilots and LLM apps | 31% |
| Other generative AI services | 20% |
| AI Foundry | 8% |
| Non-generative AI services (combined) | less than 2% |
Microsoft also classified malicious prompts sent to generative AI agents between February and May 2026: 45% sought prohibited content such as phishing emails or fraudulent invoices, 17% tried to exfiltrate sensitive data and 14% tried to leak the system prompt.
The inside view comes from Verizon. In the 2026 DBIR, 45% of employees were regular users of AI on corporate devices, up from 15% a year earlier — a threefold rise, by Axis Intelligence Research’s calculation. 67% of users reached AI services through non-corporate accounts on corporate devices, and the average company had more than 15% of users with unauthorized AI browser extensions. Shadow AI, meaning employees’ use of AI services the company has not approved, is now the third most common non-malicious insider action in Verizon’s data loss prevention dataset, a fourfold increase.
Marcus Chen: The AI supply chain is getting the treatment npm got five years ago. TeamPCP did not jailbreak a frontier model; it poisoned the wrapper libraries and CI pipelines that connect models to everything else. LiteLLM sits between an application and its model providers and holds API keys for all of them. That makes it the most valuable credential store most teams never inventoried. The shadow AI statistics page covers the unmanaged half of this exposure.
Is AI Finding Vulnerabilities Faster Than Defenders Can Patch Them?
On current evidence, yes. Anthropic’s Project Glasswing update of May 22, 2026, is the largest published measurement of AI-driven vulnerability discovery, and it is company-reported by the model’s developer.
| Glasswing metric (company-reported) | Value |
|---|---|
| Partners | ~50 |
| High/critical vulnerabilities found by partners | 10,000+ |
| Open-source projects scanned | 1,000+ |
| Open-source vulnerabilities found (all severities) | 23,019 |
| …estimated high/critical | 6,202 |
| Triaged findings confirmed as valid | 90.6% (1,587 of 1,752) |
| High/critical bugs disclosed to maintainers | 530 |
| …patched as of May 22, 2026 | 75 |
| Patch rate (Axis Intelligence Research calc.) | 14.2% |
| Firefox 150 vulnerabilities fixed (Mozilla) | 271 |
Axis Intelligence Research calculates that 85.8% of the high- and critical-severity open-source bugs Glasswing had disclosed were still unpatched at the time of the update. Anthropic says the average high- or critical-severity patch takes about two weeks.
That backlog lands in a vulnerability pipeline already near capacity. Microsoft counts nearly 40,000 CVEs in the first half of 2026, and Mandiant estimates the mean time to exploit at minus seven days — meaning exploitation routinely begins before a patch exists. See our zero-day statistics and the live Zero-Day Tracker.
Marcus Chen: Discovery is no longer the bottleneck. Maintainers are. A small volunteer team cannot absorb findings at the rate a model files them. The same capability in the wrong hands does not need the disclosure step at all, which is exactly why the Five Eyes agencies wrote what they wrote in June. If your open-source dependency list includes small projects with one maintainer, the 85.8% number is your number too.
How Much Money Do AI-Related Scams Cost Victims?
US victims reported $893.3 million in losses across 22,364 complaints that referenced AI in 2025, according to the FBI’s IC3. Axis Intelligence Research calculates an average loss of $39,946 per AI-referenced complaint — 1.93 times the $20,699 average for all complaints.
| AI-referenced IC3 complaints, 2025 | Loss | Share of AI losses |
|---|---|---|
| Investment fraud | $632,041,188 | 70.7% (Axis calc.) |
| Business email compromise | $30,256,592 | 3.4% (Axis calc.) |
| Tech/customer support | $19,457,078 | 2.2% (Axis calc.) |
| All AI-referenced complaints | $893,346,472 | 100% |
Source: FBI IC3 2025 Annual Report. The listed categories do not sum to the total, because IC3 does not break out every crime type.
Investment fraud dominates: Axis Intelligence Research calculates it at 70.7% of all AI-referenced losses. That matches the pattern of synthetic personas and AI-written chat scripts in pig-butchering schemes. For the full decomposition by crime type and the deepfake angle, see Axis Intelligence Research’s deepfake fraud statistics, AI scam statistics and AI voice cloning scam statistics.
Marcus Chen: The multiplier is the useful number. An AI-referenced complaint costs nearly twice the average one, and the reason is not exotic: AI makes long-con fraud cheaper to run, and long cons are where the six-figure losses live. The phishing side is moving to the phone. Mandiant now ranks voice phishing as the second-most common initial infection vector at 11%, while email phishing fell to 6%, and Microsoft says 93% of voice phishing attacks kept the victim on the line long enough to start the pitch. Our AI phishing statistics track the email side.
What Do Governments Say About the AI Cyber Threat?
Six Five Eyes cyber agencies — Australia’s ASD, Canada’s CCCS, New Zealand’s NCSC, the UK’s NCSC, and the US CISA and NSA — signed a joint AI call to action on June 22, 2026. Its central line: “The timeline is not years, it is months.” The statement asks boards to prepare for a sharp rise in vulnerabilities and incidents driven by frontier AI.
| Government source | Key figure or finding | Date |
|---|---|---|
| Five Eyes AI call to action | 6 agencies; risk assumptions can expire in months | Jun 22, 2026 |
| NCSC New Zealand Cyber Threat Report 2026 | 369 incidents of potential national significance; 4 “highly significant” incidents, equal to the previous ten years combined | Sep 24, 2026 |
| ENISA Threat Landscape 2026 | 8,257 EU incidents analysed; AI threats described but not quantified | Sep 2026 |
| Europol IOCTA 2026 | Warns of a widening “velocity gap” between criminal AI use and law enforcement response | 2026 |
| WEF Global Cybersecurity Outlook 2026 | 94% see AI as the top change driver; 87% call AI vulnerabilities the fastest-growing risk | Jan 12, 2026 |
New Zealand’s NCSC also expects malicious actors may have access to advanced AI capabilities by early 2027. The WEF found the share of organizations assessing the security of AI tools rose from 37% to 64% in a year.
Marcus Chen: When six signals-intelligence agencies co-sign a document with the word “months” in it, the wording was negotiated hard. Notice what they did not do: they did not publish a number. Neither did ENISA, with 8,257 incidents in hand. Governments are telling boards the threat is accelerating while declining to measure what share of it is AI — which is the measurement gap this page exists to track.
Methodology
Collection. Axis Intelligence Research reviewed the most recent edition of six flagship annual threat datasets available on October 20, 2026: IBM Cost of a Data Breach 2026, Verizon DBIR 2026, FBI IC3 2025, CrowdStrike Global Threat Report 2026, Mandiant M-Trends 2026 and ENISA Threat Landscape 2026. These six form the AAMG review set. We added the Microsoft Digital Defense Report 2026 for speed and AI-targeting figures, and primary disclosures from Google Threat Intelligence Group, Anthropic, Sysdig, the Five Eyes agencies, NCSC New Zealand, Europol and the World Economic Forum. Every figure was read in the publisher’s own document or release and logged with its URL and retrieval date. Vendor and company figures are labeled as company-reported where the publisher has a commercial stake; IBM and Microsoft sell security services, and Anthropic develops the model behind Project Glasswing.
AI Attack Measurement Gap (AAMG). AAMG = highest published AI share of attacks ÷ lowest published AI share of attacks, using only primary datasets that (a) state an AI share against a defined denominator and (b) cover a reporting window ending between October 2025 and February 2026. Baseline inputs: IBM 25% (malicious breaches) and FBI IC3 2.217% (complaints; 22,364 ÷ 1,008,597). IC3’s 4.3% loss share sits inside the range and is published for context. Datasets that report growth (CrowdStrike) or no AI share (Verizon, Mandiant, ENISA) are excluded from the ratio and counted in the coverage note. The AAMG is not an average: the denominators are different by construction, and merging them would produce a number that measures nothing. The ratio is recomputed whenever one of its inputs publishes a new edition.
Other Axis calculations. AI breach premium = (6.0M − 4.99M) ÷ 4.99M. IC3 AI loss multiplier = (893,346,472 ÷ 22,364) ÷ (20,877,000,000 ÷ 1,008,597). Handoff compression = (8 h × 3,600 s) ÷ 22 s, a lower bound. Remediation-to-weaponization ratio = 30 days ÷ 1 day, a lower bound. Glasswing patch rate = 75 ÷ 530.
What the figures do not capture. IBM’s sample consists of organizations that suffered a breach, so its AI share describes breaches, not attempts. IC3 counts only what US victims report and recognize. Glasswing figures come from the developer of the model and from an update five months old at publication. Microsoft’s AI-workload percentages come from Azure telemetry and describe Microsoft’s own cloud, not the wider market. Verizon and Microsoft figures were read in the full reports (DBIR 2026, 121 pages; Microsoft Digital Defense Report 2026, 103 pages, and its executive summary), not only in their web summaries.
About This Dataset
The CSV contains 146 rows: 124 published figures and 22 Axis Intelligence Research calculations, each with source_org, source_document, source_url, retrieved_date, is_primary, axis_calculated and a method_note. All values are raw numbers with units in a separate column, dates in ISO 8601.
- Coverage: November 2024 – June 2026 reporting windows; global, US and EU.
- License: CC BY 4.0. Republish, chart and build on it with attribution.
- Mirrors: Hugging Face, Kaggle and GitHub (Axis Intelligence Research).
Cite This Research
APA: Axis Intelligence Research. (2026, October 21). AI cyberattack statistics 2026: One in four malicious breaches, a 22-second handoff, and an 11× measurement gap. Axis Intelligence. https://axis-intelligence.com/ai-cyberattack-statistics/
MLA: Axis Intelligence Research. “AI Cyberattack Statistics 2026: One in Four Malicious Breaches, a 22-Second Handoff, and an 11× Measurement Gap.” Axis Intelligence, 21 Oct. 2026, axis-intelligence.com/ai-cyberattack-statistics/.
Chicago: Axis Intelligence Research. “AI Cyberattack Statistics 2026: One in Four Malicious Breaches, a 22-Second Handoff, and an 11× Measurement Gap.” Axis Intelligence, October 21, 2026. https://axis-intelligence.com/ai-cyberattack-statistics/.
AI Cyberattack Questions Security Teams Are Asking
Did AI cause most data breaches in 2025?
No. IBM classified one in four malicious breaches as AI-enabled in its 2026 study, and Mandiant’s M-Trends 2026 said it does not consider 2025 the year breaches were the direct result of AI. Vulnerability exploitation remained the leading entry point, at 31% of breaches in Verizon’s 2026 DBIR and 32% of intrusions in Mandiant’s data.
Why does IBM say 25% while the FBI data suggests about 2%?
They count different things. IBM investigates breached organizations and can identify a deepfake or AI-built malware in the incident record; the FBI counts complaints in which the victim mentioned AI. Axis Intelligence Research measures the resulting spread as the AI Attack Measurement Gap, with a baseline reading of 11.3× in October 2026.
Does Verizon say 15% of attacks use AI?
No. Verizon’s DBIR web page summarizes its AI section as 15% of attack techniques bolstered by generative AI, but the full 2026 report contains no such percentage. The report says the median threat actor sought AI help with about 15 distinct techniques, across 793 actors in Anthropic’s enforcement data, and that fewer than 1% of them were rated high or critical risk.
What does “AI-enabled breach” mean in IBM’s 2026 report?
IBM uses it for malicious breaches in which attackers used AI, which it says consisted mostly of deepfake impersonation and AI-enabled malware. These breaches averaged $6.0 million, against a $4.99 million global average across 602 organizations studied from March 2025 to February 2026.
Has anyone caught a zero-day exploit written by AI?
Yes. In May 2026 the Google Threat Intelligence Group reported, for the first time, a criminal actor using a zero-day it believes was developed with an AI model: a two-factor authentication bypass in an open-source web administration tool. GTIG disclosed the flaw to the vendor and disrupted the activity.
How long does a company have to patch before AI-speed exploitation?
Less than it has. Microsoft’s 2026 report puts median weaponization well under 24 hours and enterprise remediation at 30 to 60 days, and Mandiant estimates exploitation starts seven days before a patch on average. Axis Intelligence Research calculates a remediation-to-weaponization ratio of at least 30 to 1.
Are AI tools inside my company a target?
Increasingly. CrowdStrike reported injected malicious prompts in legitimate generative AI tools at more than 90 organizations in 2025, and more than 20% of organizations in IBM’s 2026 study reported a breach targeting AI models or applications. Wrapper libraries and API gateways that hold model keys are a frequent entry point.
Does using AI in the security operations center reduce breach costs?
According to IBM’s 2026 study, organizations using AI and automation in security operations cut breach costs by almost $2 million on average. That saving is about twice the $1.01 million AI breach premium Axis Intelligence Research calculates from the same study.
What did the Five Eyes agencies say about AI in June 2026?
On June 22, 2026, six cyber agencies from Australia, Canada, New Zealand, the UK and the US warned that frontier AI is shortening the time between discovering and exploiting vulnerabilities, with a timeline of months rather than years. They asked leaders to assess readiness and prioritise foundational security controls.
Related: AI cybersecurity statistics · Business email compromise statistics · Ransomware attack cost · Data breach statistics
Correction, October 21, 2026: an earlier version of this page published the AI Attack Time-to-Impact Index (AATI™) with a composite of 75.3 for 2026. That value was an unweighted average of the four component scores; the weights stated in the published formula produce 80.5. The AATI has been retired and replaced by the sourced figures above and the AI Attack Measurement Gap.