Cybercriminals and defenders are racing to deploy artificial intelligence at scale. What happens when neither side is human anymore?
For most of the internet’s history, a cyberattack required a human at the keyboard. Someone had to craft the phishing email, probe the network, write the exploit, and decide when to strike. That model is becoming obsolete. In 2025 and into 2026, artificial intelligence has decoupled offensive capability from human effort at a scale that is genuinely unprecedented, and the same technology is now the primary tool defenders use to keep pace.
The numbers are stark. AI-powered cyberattacks grew 72% year-over-year in 2025, with automated scanning tools probing networks at a rate of 36,000 requests per second. At those speeds, the traditional human-in-the-loop security model simply cannot respond in time. The result is an arms race being fought almost entirely by machines, with human analysts increasingly in the role of strategy and oversight rather than frontline response.
How attackers are deploying AI
The most visible impact of AI on the offensive side has been in phishing. Traditional phishing emails were easy to spot: generic greetings, awkward grammar, implausible scenarios. Today, large language models generate personalized, grammatically flawless messages that reference the target’s real employer, colleagues, and recent activities scraped from LinkedIn and other public sources. The results are measurable: AI-generated phishing achieves a 54% click-through rate compared to just 12% for traditional campaigns, making them roughly 4.5 times more effective at deceiving real people.
But phishing is just the entry point. Once inside a network, AI agents are being used to perform reconnaissance, identify high-value targets, move laterally across systems, and exfiltrate data, all without requiring a human operator to stay engaged. In September 2025, cybersecurity researchers documented what they described as the first fully autonomous AI-orchestrated intrusion, where artificial intelligence handled 80 to 90 percent of the operation from start to finish.
CrowdStrike documented a campaign in 2025 where attackers embedded generative AI at every stage of the attack lifecycle, from initial reconnaissance and personalized phishing through to lateral movement and data extraction. The campaign compromised over 320 organizations in under a year, a pace that would have been impossible without automation. The same report noted that malware-free intrusions grew 27% year-over-year as adversaries increasingly use AI to conduct attacks that leave fewer forensic artifacts.
Ransomware has also been transformed. AI-powered variants now adapt their payloads in real time to evade signature-based detection, a technique known as polymorphic mutation. As of 2025, 76% of detected malware exhibits this kind of AI-driven polymorphism. And the speed of operations has accelerated sharply: AI-assisted ransomware groups have cut their median dwell time dramatically, meaning the window between initial compromise and the moment defenders can detect something is wrong has shrunk to a fraction of what it was three years ago.
Deepfakes represent another frontier. Incidents involving synthetic audio and video surged 680% year-over-year, with Q1 2025 alone recording 179 separate documented cases, more than in all of 2024. The FBI’s 2025 Internet Crime Complaint Center report logged a 37% rise in AI-assisted business email compromise, including hundreds of cases where attackers used cloned executive voices to authorize fraudulent wire transfers over the phone.
How defenders are fighting back
If AI has supercharged the offense, it has also handed defenders their most powerful tools yet. The core problem that AI solves on the defensive side is volume: modern Security Operations Centers receive an average of 4,484 alerts per day, and analysts spend up to 27% of their time chasing false positives. No human team can meaningfully process that volume, which means real threats get buried in noise.
AI-augmented SOCs have demonstrated a 50% reduction in mean time to detect threats and a 60% drop in manual triage workload. These are not incremental improvements. They represent a fundamental shift in how security operations function, with AI handling initial classification and escalation while human analysts focus on investigation and decision-making. The economic case is increasingly clear: IBM’s 2025 Cost of a Data Breach report found that organizations using extensive AI and automation for defense detected and contained breaches significantly faster, and breach costs fell from $4.88 million in 2024 to $4.44 million in 2025, a reversal after five consecutive years of increases, largely attributed to AI-assisted containment speed.
The AI arms race has a measurable economic signal. For the first time in five years, average breach costs fell in 2025, dropping from $4.88M to $4.44M. IBM credits the turnaround directly to faster AI-assisted detection and containment by defenders who adopted the technology ahead of their peers.
A North American financial institution using AI-driven user and entity behavior analytics (UEBA) detected anomalous access patterns from a privileged employee account in early 2025. The AI flagged the session after noticing the account was accessing records outside its normal geographic and time-of-day baseline, correlating the behavior with three other low-signal events that had each individually scored below the human-review threshold. The threat was contained in 11 minutes. A traditional rule-based system would have generated no alert at all, since none of the individual events violated any existing policy.
Identity is becoming a critical theater in this conflict. With 85.6% of common passwords crackable by AI in under 10 seconds, the credential layer is no longer a meaningful defense on its own. Defenders are responding by deploying AI that monitors authentication patterns continuously, flagging behavioral anomalies that suggest credential misuse even when the password itself is correct. This approach, often called continuous authentication, represents a philosophical shift away from verifying once at login toward verifying constantly throughout the session.
What organizations need to prioritize now
Gartner’s 2026 cybersecurity trend analysis identifies several concrete capabilities that security teams should be building in direct response to the AI-versus-AI dynamic.
The deeper question: who sets the pace?
The AI-versus-AI framing captures the mechanics of what is happening, but it understates the asymmetry. Attackers need to succeed once. Defenders need to succeed every time. AI improves both sides, but that asymmetry does not disappear. What AI does change is the cost structure: launching a sophisticated, targeted attack no longer requires a team of skilled human operators. A well-configured AI agent and access to a few dark-web data sets can now substitute for significant human expertise.
That democratization of offensive capability is perhaps the most consequential development in the current landscape. Nation-state techniques, once inaccessible to smaller criminal groups due to the skill and resource requirements, are increasingly available off the shelf. The barriers to entry for sophisticated cyberattacks are collapsing at precisely the moment when the attack surface, driven by cloud adoption, remote work, and connected devices, is growing faster than most organizations can manage.
Proofpoint’s May 2026 threat report found that half of global organizations have experienced a confirmed or suspected AI-related security incident, including 63% that already had AI security controls deployed. That finding is not an argument against AI-powered defense. It is an argument for the permanence of this contest, and for the recognition that AI is now the baseline, not the differentiator.
The organizations that will fare best in 2026 and beyond are not the ones that adopted AI security tools earliest. They are the ones that understood that AI changes the speed and scale of the game without changing its fundamentals: visibility, response time, and the human judgment that decides what matters most when the alerts are piling up faster than any machine can resolve them alone.
- IBM X-Force Threat Intelligence Index 2026 https://www.ibm.com/reports/threat-intelligence
- Verizon DBIR 2025 https://www.verizon.com/business/resources/reports/dbir/
- Gartner Top Cybersecurity Trends 2026 https://www.gartner.com/en/articles/top-cybersecurity-trends-2026 https://www.gartner.com/en/documents/7330730
- Proofpoint AI and Human Risk Landscape 2026 https://www.proofpoint.com/us/resources/threat-reports/ai-human-risk-landscape-report
- CrowdStrike Adversary Intelligence / 2026 Global Threat Report https://www.crowdstrike.com/en-us/global-threat-report/
- AllAboutAI Research — AI Cyberattack Statistics https://www.allaboutai.com/resources/ai-statistics/ai-cyberattack/
- Hornetsecurity Monthly Threat Report (May 2026) https://www.hornetsecurity.com/en/blog/monthly-threat-report/