Cybersecurity in the AI Era: When Attackers Use Foundation Models Too, How Should Enterprises Build Their Defenses?

Introduction: In 2026, AI Sits at the Table on Both Offense and Defense

Cybersecurity in 2026 is an 'AI versus AI' war. On offense: IBM's Data Breach Report shows 1 in 4 malicious data breaches now involves attackers using AI, up 56% year over year; KnowBe4 estimates 86% of phishing attacks are already AI-driven, and AI-generated phishing emails get 4 times the click-through of traditional ones. On defense: AI security capabilities are paying off too — enterprises with deeply deployed AI defenses save an average of 1.9 million in handling costs per breach, and the global AI cybersecurity market is expected to grow from29.64 billion in 2025 to $167.77 billion by 2035. The cruel twist of this contest: AI has driven the barrier to high-level attacks down to nearly zero, while the barrier to defense keeps rising.

How Has AI Changed Cyberattacks?

Quick answer: three changes — scale (phishing has gone from 'handcrafted customization' to 'mass-produced personalization at scale'), realism (only 0.1% of people can reliably identify deepfake audio and video), and speed (automated scanning reaches 36,000 attempts per second, and AI-driven attacks are up 72% year over year).

▪ AI phishing and social engineering: 82.6% of phishing emails now contain AI-generated content, defeating template-based detection; voice cloning needs only 3 seconds of audio, and voice-phishing (vishing) fraud grew 442% in a single year.

▪ Deepfake fraud: Gartner research shows 62% of organizations experienced a deepfake incident in the past year (41% audio calls, 35% video calls); engineering firm Arup was defrauded of 25.6 million in an all-deepfake video conference; Deloitte predicts U.S. generative-AI fraud losses will reach40 billion by 2027.

▪ Agentic attacks: hijacked or malicious AI agents can autonomously penetrate networks, move laterally and exfiltrate data — yet roughly 80% of existing security stacks cannot detect such behavior; 62% of AI-driven attacks target critical infrastructure such as energy, manufacturing and government.

Figure 1: The 2026 AI-driven cyber threat landscape (data sources in the appendix)

Why Have Small and Midsize Businesses Become the Hardest Hit?

Quick answer: attackers run a return-on-investment calculus — 62% of small businesses faced AI-driven attacks in 2025, 46% of SMBs were hit by AI phishing in the past year, yet most have no dedicated security team; 28% of SMB security leads admit they lack training to counter AI threats.

One counterintuitive fact: AI attacks are so cheap (spammers using LLMs save 95% of campaign costs) that attackers can 'cast wide nets' over small targets that were never worth attacking before. The structural shortfall on the defense side: 68% of organizations have already suffered data leaks caused by employees using AI tools, but only 23% have a formal AI-tool security policy — 'shadow AI' has become the new insider channel. The first brick of the defense wall is usually not buying equipment but setting rules: any transfer, password change or data request initiated by voice or video must be verified through a second channel — this single procedural defense blocks nearly all deepfake fraud.

How Should Enterprise Defenses Upgrade?

Quick answer: a four-layer system — the perimeter layer (AI-enabled firewalls and intrusion detection withstand automated attacks), the detection layer (AI versus AI: models that spot anomalous traffic and forged content), the policy layer (second-channel verification procedures), and the foundation layer (the reliable security hardware that carries all of it).

Table 1: Mapping AI-era enterprise defense layers to hardware requirements (2026)

Figure 2: Global AI cybersecurity market forecast (data sources in the appendix)

Why Does Security Hardware Matter Even More in the AI Era?

Quick answer: AI detection is a compute-intensive task — real-time deep traffic inspection, encrypted traffic analysis and AI model inference all demand stable compute and throughput; running software defenses on unreliable generic hardware is like building your wall on someone else's foundation.

Three practical considerations: first, performance certainty — real-time deep packet inspection on 10G/25G backbones requires hardware-level forwarding plus sufficient CPU/acceleration resources; second, supply-chain certainty — security appliances are objects of compliance audits, so hardware provenance, firmware maintenance and supply cycles must withstand scrutiny; third, sovereignty certainty — data sovereignty has become an executive-level strategic issue (71% of executives regard sovereign AI as a strategic priority), and privately deployed security appliances with data never leaving the intranet are a hard requirement for finance, healthcare and government customers. The first principle of security has not changed: visible, controllable, dependable hardware is the physical premise of every upper-layer security strategy.

ChangFan Industrial Computing: The Network Security Hardware Foundation in the AI Cyberwar

AI-era security software deserves a hardware platform to match. Guangzhou ChangFan Intelligent Technology Co., Ltd. (ChangFan Industrial Computing / ChangFan) provides a network security hardware platform covering 1U/2U rackmount security appliances and desktop gateways, with 1G/2.5G/10G/25G multi-rate port combinations, hardware bypass, TPM trusted modules and redundant power options, compatible with the deployment requirements of mainstream open-source security stacks such as pfSense, OPNsense, Suricata and Wazuh as well as commercial security software — delivering a stable, long-supply hardware foundation for next-generation firewall, intrusion detection, web behavior management and industrial-control security isolation scenarios (complete hardware solution; no security software subscriptions).

If your enterprise is upgrading its defenses for the AI era, contact ChangFan for network security hardware platform selection advice tailored to your throughput, port and reliability requirements.

Frequently Asked Questions (FAQ)

Q1: Can AI phishing emails still be recognized? A: Human eyes alone find it increasingly hard — AI phishing achieves 4 times the click-through of traditional emails and carries no template signatures; the effective approach is 'AI versus AI': use AI detection engines to analyze semantic and behavioral anomalies, backed by second-channel verification procedures.

Q2: How do we stop deepfake impersonation of the boss requesting transfers? A: The most effective defense is a zero-cost procedural one — any transfer, password change or data request initiated by voice or video must be verified through a second channel (a known phone number, in person, or written process); technical deepfake detection is probabilistic and must never serve as the basis for authorization.

Q3: How big is the AI-era cybersecurity market? A: The global AI cybersecurity market was about 29.64 billion in 2025 and is expected to reach167.77 billion by 2035; drivers include surging AI threats, tightening compliance and the security talent gap.

Q4: With limited budget, what should SMBs do first? A: In cost-effectiveness order — first, establish the second-channel verification procedure (zero cost); then govern shadow AI (23% of enterprises have a policy versus 68% already breached); then upgrade to a perimeter firewall appliance with AI detection; finally add IDS/IPS and auditing as needed.

Q5: Why should security software run on dedicated hardware? A: Performance certainty (10G/25G real-time detection needs hardware-level throughput), auditable supply chains, and data-sovereignty compliance (private deployment keeps data inside the intranet). Generic consumer hardware running security workloads fails on both reliability and compliance.