Resilience: AI has sped up cyberattacks, shrinking defenders' window to respond to minutes

AI has not created fundamentally new forms of cybercrime, but it has sharply amplified the old ones. According to Resilience, IBM and ReliaQuest, attackers now find it easier to launch mass phishing, automate reconnaissance and speed up intrusions into infrastructure, while defenders are left with just a few minutes to respond.

Why attacks have accelerated

The main effect of generative AI is not the arrival of "magic" attacks, but a drop in the cost and complexity of familiar operations. What once required a team, time and solid skills can now be assembled faster: write a convincing email, tailor it to a specific company, translate it into the right language, imitate a business style and send it to hundreds of recipients at once. For attackers, this means a lower barrier to entry and a better chance of scaling an attack with almost no increase in cost.

The IBM, ReliaQuest and Resilience reports agree on one point: AI is especially useful where attackers need to quickly increase plausibility and tempo. Generative models help prepare social engineering scenarios, speed up analysis of open data about a victim and shorten the time between first contact and an attempt to seize access. Where a company once might have had hours to notice suspicious activity, the attack chain now often unfolds almost in real time.

Where defenses break

The most troubling part of these findings is that the weak spots in companies have long been known and have changed little. AI has not repealed basic security hygiene or made it less important. On the contrary, old organizational and process gaps have become more dangerous, because attackers now get through them faster and with more confidence. This is especially visible in scenarios where a person makes a decision under pressure, does not see the full picture or relies on trust in a familiar process.

• weak help desk procedures
• poor visibility of devices on the network
• access management errors
• corporate email compromise
• fraudulent money transfers

Each of these looks familiar, but combined with AI they become risk amplifiers. A fake password reset request becomes more convincing, an email from a "colleague" is cleaner in style and tone, and preparing an attack on a finance department takes less time. If a company has a poor grasp of which devices are connected to its infrastructure and who holds which permissions, an attacker establishes a foothold inside faster. Email compromise and access errors still offer the shortest path to money and critical systems.

Why there is almost no time

A separate finding of the Cyber Risk Report 2025 is that the window for security teams to react has narrowed noticeably. This is no longer only about detection quality, but also about decision speed. When phishing campaigns, identity spoofing and initial data collection are automated, an incident reaches its critical point faster than standard escalation processes can kick in. The old rhythm of manual checks, lengthy approvals and incomplete asset inventories simply loses here.

For businesses, this means that defending through employee training alone is no longer enough. Companies need stricter identity verification procedures at the help desk, minimization of excessive permissions, continuous device audits and automated responses to events in email and access systems. Otherwise even a not especially sophisticated attack, boosted by AI, becomes an expensive incident: an account takeover, a false payment order or lateral movement across the network before the team grasps the scale of the problem.

What this means

The key takeaway is simple: AI has not replaced cybercriminals' classic methods, but made them faster, cheaper and more widespread. So the winners will not be companies that formally adopt AI, but those that have put their access controls, email, help desk and infrastructure visibility in order, and have learned to respond to attacks at the pace of minutes, not hours.