AI-driven cyberattacks surged by 56 per cent over the past year, with more than a quarter of organisations hit by malicious attacks reporting that artificial intelligence was used in the incidents.

The finding is contained in IBM’s 2026 Cost of a Data Breach Report, which revealed that AI-driven attacks now cost businesses an average of $6.04 million per breach.

IBM said cybercriminals are increasingly using AI to automate attacks, identify vulnerabilities and operate at greater scale, reducing the time required to exploit weaknesses and potentially increasing the financial impact on businesses.

IBM found that more than one in four organisations experienced a malicious attack driven by AI, representing a 56 per cent increase from the previous year.

“More than one in 4 organizations experienced a malicious, AI-driven attack—a 56 per cent increase over last year,” IBM said.

The report also found that AI-driven attacks cost businesses about $1 million more per breach, averaging $6.04 million compared with $5.03 million for malicious attacks that did not involve AI.

Deepfake impersonation was the most common form of AI-driven attack identified, accounting for 45 per cent of incidents.

AI-generated malware accounted for 19 per cent, while AI-generated phishing and other forms of communication made up 17 per cent.

IBM said generative AI has made social engineering attacks cheaper to execute and more difficult to detect, enabling cybercriminals to create convincing content and manipulate victims on a larger scale.

“Attackers are abandoning human speed for machine speed,” IBM said.

The company added that generative AI has lowered the time, cost and level of expertise required to launch cyberattacks.

Cybercriminals are also increasingly targeting the AI systems being deployed by businesses.

IBM found that 21 per cent of organisations experienced a security incident involving an AI model or application, up from 13 per cent a year earlier.