Lately, any conversation about cybersecurity eventually comes back to one word: AI. The twist is that AI in security isn't a simple story of good guys versus bad guys —” it's being used by both sides at once: security teams trying to protect systems, and attackers trying to break into them. And in 2026, the gap between those two sides keeps getting smaller.
In Attackers' Hands: Faster, Cheaper, More Convincing
The most visible misuse of AI shows up in phishing. According to a phishing trends report from Hoxhunt, AI-indicated phishing emails detected on their network jumped from just 4% in November 2025 to 56% in December 2025 —” a 14x surge in a single month. Meanwhile, IBM's 2025 Cost of a Data Breach Report found that 16% of all data breaches now involve attacker use of AI, and 37% of those incidents are AI-assisted phishing. That's not surprising —” the same report notes generative AI has cut the time needed to craft a convincing phishing email from roughly 16 hours down to just 5 minutes. AI makes scam emails read more cleanly, look more convincing visually, and get cheaper to produce at scale, even though the underlying techniques are still largely the same old phishing tricks —” just polished far better.
Then there's deepfakes. Research from iProov found that only 0.1% of people can reliably spot a high-quality deepfake on their own. It's no coincidence that voice- or video-based scams —” from a fake "call from your boss" to a fake video call requesting a wire transfer —” now rank among the threats business leaders worry about most.
AI is also moving into more technical territory: security research itself. A recent, very concrete example is the PHP2Shell case (CVE-2026-109618 and CVE-2026-109619) —” two critical PHP flaws that had existed for years but were only truly uncovered after security researchers used advanced AI models to deeply audit PHP's source code. In other words, AI isn't just writing better scam emails —” it's also speeding up the discovery of technical flaws that used to take enormous time and highly specialized skill for a human to find.
In Defenders' Hands: Faster Detection, Smaller Losses
Fortunately, AI is also a weapon for the defending side. That same IBM report found organizations that use AI and automation extensively detect and contain security incidents 80 days faster, while saving an average of $1.9 million per breach compared to organizations that don't use AI/automation at all (average breach cost of $3.62 million versus $5.52 million). Security Operations Center (SOC) teams are also leaning more on AI to filter through thousands of daily alerts, freeing up human analysts to focus on cases that genuinely need human judgment rather than repetitive work that can be automated.
So Who's Winning?
Nobody is —” and there probably won't ever be a permanent winner. AI lowers costs for both sides: attackers can cheaply run convincing attacks at scale, while defenders can cheaply detect and respond faster. What ends up making the difference usually isn't who has the fancier AI, but who's more disciplined about applying it while still keeping up basic security hygiene.
What Can Your Business Do?
1. Don't assume "it looks real" means "it's safe." A call or video that sounds exactly like your boss is now far easier to fake than before. Build in extra verification steps for sensitive requests like wire transfers, rather than trusting a voice on the phone alone.
2. Train employees to spot the new generation of phishing. AI-written phishing is far more polished now —” there's no longer an obvious typo or blurry logo to serve as an easy red flag.
3. Stay disciplined about patching. The PHP2Shell case proves AI is also being used to find flaws in the everyday software you run. Regular updates remain the most basic —” and most effective —” line of defense.
4. Consider AI-powered security tools. If attackers are already using AI to move faster, defending entirely by manual means gets harder by the day. AI-driven detection tools can help rebalance the fight back in your favor.
AI hasn't changed cybersecurity's basic goal —” protecting data and systems is still the job. What's changed is the speed and scale on both sides of the fight. Businesses that understand this now will be far better prepared than those who only realize it after becoming a victim.
