Cybercriminals are increasingly turning to artificial intelligence (AI) to breach business systems in record time, sometimes in under an hour, according to new research from ReliaQuest. The report sheds light on several emerging trends in the cyber threat landscape—most notably, a shift away from traditional ransomware attacks toward data theft, as well as a surge in phone-based phishing (voice phishing) campaigns. As attackers refine their tactics with AI-driven tools, organizations need to adapt their security strategies to stay ahead of evolving threats.
In this article, we will break down the key findings of the report, examine how malicious actors are leveraging AI to accelerate their operations, and discuss practical measures businesses can take to bolster their defenses. We’ll also explore the shift away from ransomware toward data theft, the growing prevalence of phishing, and how AI is empowering both attackers and defenders. By understanding these critical developments, companies can more effectively mitigate risks and safeguard their sensitive information.
Why Hackers Are Embracing AI
Artificial intelligence has become a powerful tool for a variety of industries—healthcare, finance, manufacturing, and beyond. But the same technology that delivers breakthroughs in data analytics and process automation also lowers the barriers for cybercriminals. AI algorithms can quickly scan for vulnerabilities, generate targeted phishing campaigns, and even mimic human voices or writing styles to trick unsuspecting users. Here are some of the ways in which AI is reshaping the cyberthreat landscape:
- Automation of Vulnerability Scanning
Hackers can deploy AI-driven bots that continuously crawl networks and systems for weak points—such as outdated software, unpatched servers, or easily guessable passwords. Instead of manually probing each target, these bots can identify hundreds or even thousands of potential entry points in a fraction of the time. - Personalized Phishing Campaigns
AI can be used to analyze social media data, public records, and other freely available information to craft highly persuasive messages. Attackers can then send these emails or messages en masse, tailoring them to each recipient’s role, interests, or recent activities. This level of personalization increases the success rate of phishing campaigns, as users are more likely to fall for a message that appears to be custom-tailored. - Sophisticated Social Engineering
Leveraging machine learning, hackers can create deepfake voices or even entire personas that emulate real executives or employees. This tactic, known as voice phishing or “vishing,” is becoming increasingly prevalent. Attackers will pose as company officials or tech support agents over the phone, convincing victims to divulge login details or authorize suspicious activities. - Rapid Data Exfiltration
Because AI-driven tools can automate the entire process of compromising a system—from infiltration to data extraction—hackers can complete an attack in mere hours. According to ReliaQuest, many attacks now involve just four hours to steal data and six hours to encrypt it, leaving organizations little time to respond.
This perfect storm—where technology gives malicious actors unprecedented reach and speed—means that security teams must rethink their entire approach, embracing AI-based solutions of their own to detect and neutralize attacks quickly.
The Shift from Ransomware to Data Theft
One of the most significant findings in the ReliaQuest report is the declining appeal of ransomware as a primary tactic. While ransomware attacks remain a threat, many criminals have found that simply stealing data can be more lucrative and, in some cases, more difficult for organizations to detect. Here’s why:
- Lower Ransom Payments
In a ransomware attack, hackers encrypt data and demand payment—typically in cryptocurrency—in exchange for the decryption key. Over time, companies have become less inclined to pay because they have developed better backup and recovery strategies. The report notes that only about 7% of victims choose to pay ransoms. When businesses have secure backups and well-structured recovery plans, the financial incentive for criminals diminishes. - High Demand for Stolen Data
The dark web brims with buyers seeking sensitive information—whether it’s personal data, proprietary corporate data, or trade secrets. This underground market can be incredibly profitable for criminals who, instead of relying on a one-time ransom, can sell stolen data to multiple interested parties. - Harder to Detect
Ransomware typically leaves little doubt that an organization has been attacked. Once files are encrypted, the victim is immediately aware something is wrong. In contrast, data theft can occur silently, allowing hackers to remain undetected for weeks or even months. This stealth approach increases the likelihood that criminals can sell the data or use it for future attacks before the victim realizes they have been compromised. - Statistics Reflect This Trend
According to ReliaQuest, 80% of reported breaches involved theft of data, with only 20% including file encryption. This statistic underscores the shift in hacker priorities: extracting data quickly, selling it, or using it for further exploitation is often more profitable than holding a system hostage.
As a result, businesses need to focus not just on preventing ransomware attacks, but also on detecting stealthy exfiltration attempts. This involves monitoring data flows, implementing user behavior analytics, and establishing strict access controls.
The Rising Threat of Phishing and Voice Phishing
Phishing continues to be a highly effective tool for attackers. Despite widespread security awareness training, people still click on malicious links or download infected attachments, putting their companies at risk. The ReliaQuest report highlights the disturbing fact that 30% of attacks include the theft of credentials via phishing. Here’s a closer look at phishing’s persistent evolution:
- Automation and Scaling
Attackers can set up elaborate phishing campaigns quickly. AI-enabled systems pull user information from social media, business directories, or even corporate websites, generating emails that appear legitimate. With the click of a button, hackers can send thousands of carefully crafted phishing attempts, boosting the potential success rate. - Voice Phishing (Vishing)
A notable rising trend is phone-based phishing, or “vishing,” which now accounts for 14% of breaches, according to the ReliaQuest data. Hackers call employees posing as IT support or even as high-level executives, persuading them to divulge sensitive information. Manufacturing is cited as a frequent target, potentially because of the complexity of its processes and a higher reliance on vendor and IT interactions.- Deepfake Voices: While the ReliaQuest report doesn’t go into detail about deepfake technology, other industry analyses show that AI-generated voices can convincingly mimic real people. This advanced deception can lead employees to trust phone requests that they would otherwise question.
- Spear Phishing vs. Mass Phishing
Spear phishing involves targeting a single individual or a small group with highly specific information to enhance credibility. In contrast, mass phishing relies on broader, more generic messages. AI can bolster both methods: it can personalize spear phishing attacks more accurately or streamline the mass phishing process. - Continuous User Education
Even the best software defenses can fail when human error is involved. Continuous awareness training that keeps pace with new types of phishing attempts is crucial. Employees should know how to verify unexpected requests for information, recognize unusual URL patterns, and confirm the identity of anyone asking for privileged data.
Given these sophisticated tactics, organizations need robust multi-factor authentication (MFA), strong email filtering solutions, and consistent policy enforcement to curb phishing attempts.
Speeding Up the Attack Cycle: AI’s Impact on Time-to-Breach
One of the most alarming revelations from the ReliaQuest report is how swiftly hackers can infiltrate and exploit networks when AI is in play. The new standard: attackers need about four hours to steal data and six hours to encrypt it, if they choose to go the ransomware route. This compressed timeline challenges traditional incident response protocols:
- Near-Real-Time Vulnerability Discovery
AI automates the scanning of network endpoints, servers, and applications for known vulnerabilities. The moment a new exploit is revealed publicly, hackers can integrate it into their AI-driven toolkits, quickly identifying companies that have not yet patched their systems. - Automated Penetration Attempts
Once vulnerabilities are discovered, AI-powered scripts can systematically try different methods to break in—testing stolen credentials, brute-forcing passwords, or using cleverly disguised malware. By the time a security team identifies odd network activity, the attackers may have already exfiltrated critical data. - High Volume, Global Scale
Threat actors can run these attacks on a global scale, targeting multiple organizations across various industries at once. AI doesn’t tire; it can continuously learn and adapt, scanning for more victims and refining techniques in parallel.
This race against time means that companies must move from a reactive to a proactive security posture. Rather than waiting for alert notifications or suspicious logs, security teams should employ active threat hunting, machine learning-based anomaly detection, and continuous monitoring across all network segments.
How AI and Automation Strengthen Defense
While the rise of AI-assisted attacks is unsettling, defenders have access to similarly potent tools. The ReliaQuest report points to significant progress in defensive strategies, with some organizations managing to contain threats in as little as three minutes after detection. Here’s how AI and automation help level the playing field:
- Automated Threat Detection
Advanced security information and event management (SIEM) platforms combine logs from firewalls, endpoint protection solutions, intrusion detection systems, and other sources. By applying machine learning to this massive dataset, these platforms can identify anomalies that suggest malicious activity—such as unusual login times, atypical data transfers, or repeated failed login attempts. - Instant Remediation
Automation can instantly isolate a compromised endpoint, revoke privileges, or force a password reset when suspicious behavior is detected. This not only prevents lateral movement (where attackers spread from one system to another) but also buys precious time for human analysts to investigate. - Behavioral Analytics
AI-based behavioral analytics can profile legitimate user activities, establishing a baseline of what is “normal.” Any deviation from these established norms—like a finance employee suddenly transferring large sums of money to a foreign account at 3 AM—triggers alerts and can lead to immediate containment actions. - Improved Incident Response Coordination
AI can correlate events from multiple sources. For instance, if there is an abnormal spike in network traffic combined with an uptick in failed login attempts and an unusual file access pattern, the system can flag a probable breach. Rather than issuing separate alerts for each anomaly, a single consolidated alert can be generated, providing context that’s much clearer for human responders. - Augmenting Human Expertise
Even the most advanced AI systems need human oversight. Skilled analysts interpret complex alerts, adjust detection rules, and make strategic decisions. The synergy between human expertise and machine efficiency drastically reduces time to resolution.
Key Challenges and Future Trends
Despite encouraging advancements in AI-driven defense, organizations must remain vigilant in a rapidly evolving threat environment. Here are some of the top challenges and trends to watch:
- Talent Shortage
Cybersecurity roles often require specialized knowledge of both technological and analytical aspects. Demand for data scientists, threat hunters, and security analysts outstrips supply, making it difficult for organizations to staff their teams adequately. - Proliferation of Dark Web Markets
The dark web serves as a marketplace for buying and selling stolen data, phishing kits, and hacking services. As AI-generated attacks grow in sophistication, expect to see more advanced malicious toolkits available for purchase. - Stricter Regulations and Compliance
Governments around the world are implementing tougher data protection laws (e.g., GDPR in Europe, CCPA in California, and LGPD in Brazil). Non-compliance can lead to substantial fines and reputational damage. This regulatory pressure places additional responsibility on organizations to secure data effectively. - Increased Adoption of Zero Trust Architecture
A zero trust model assumes no entity—internal or external—is inherently trustworthy. This approach involves ongoing verification, network segmentation, and granular permission levels, all of which can thwart AI-driven attacks by limiting the damage a single breach can cause. - Evolving Social Engineering Tactics
Attackers will continue to refine social engineering strategies. Deepfake technology, advanced reconnaissance, and psychologically savvy persuasion methods will become even more nuanced, requiring continuous employee training and robust verification processes.
Three Actionable Steps to Stay Secure, According to ReliaQuest
The ReliaQuest report offers three core recommendations to combat the escalating threat landscape. Let’s delve deeper into each:
- Integrate AI and Automation into Security Operations
- Continuous Monitoring: Deploy AI-powered tools that constantly scan your infrastructure for abnormalities, ensuring threats are identified as early as possible.
- Automated Remediation: Configure your systems to take immediate action—quarantining devices or disabling compromised accounts—whenever suspicious activity is confirmed.
- Scalable Defenses: As your business grows, ensure your security solutions can scale to handle increased data and user activity without performance bottlenecks.
- Fortify Common Entry Points
- Email Security: Use advanced email gateways that leverage AI to analyze email contents and sender behavior.
- Endpoint Protection: Keep operating systems, software, and firmware up to date. Deploy next-gen antivirus that employs machine learning to detect unknown threats.
- Multi-Factor Authentication (MFA): Implement MFA across all sensitive systems. Even if an attacker obtains a username and password, they will be unable to access accounts without the additional factor.
- Eliminate Blind Spots
- Comprehensive Visibility: Use centralized logging and SIEM solutions to gain real-time insights across all on-premises and cloud environments.
- Shadow IT Awareness: Track and manage any applications or devices that employees use without official IT approval, as these can create hidden vulnerabilities.
- Third-Party Security: Evaluate the security posture of partners, vendors, and contractors. Even if your defenses are robust, an insecure third party can serve as a gateway for attackers.
The rapid adoption of AI has introduced an unprecedented level of speed and sophistication to cyberattacks. Hackers now conduct breaches faster than ever before, capitalizing on automation, advanced analytics, and deepfake technology to compromise organizations within hours. The emphasis on data theft—rather than traditional ransomware—reflects criminals’ preference for stealth and profitability, as stolen data can be sold or exploited multiple times.
Yet, it’s not all doom and gloom. The same technological advancements are empowering defenders to detect intrusions earlier, respond more quickly, and mitigate potential damage. AI-driven security solutions can unify data from across an organization’s entire digital ecosystem, uncover intricate patterns, and automate a significant portion of the incident response workflow.
For businesses, the strategic takeaway is clear: adopting a proactive, intelligence-driven defense strategy is no longer optional. Organizations must continuously update software, train employees to resist sophisticated phishing scams, and invest in AI solutions that provide real-time monitoring and swift remediation. By integrating ReliaQuest’s three recommended steps—embracing AI in security operations, shoring up common entry points, and eliminating blind spots—companies can significantly strengthen their cyber defense posture.
In the age of AI-powered attacks, complacency can be catastrophic. While technology brings extraordinary opportunities for innovation and growth, it also demands an ever-evolving approach to cybersecurity. Organizations that prioritize robust, adaptive defenses will be far better positioned to navigate the challenges of an increasingly connected—and contested—digital world.
