Verizon’s 2026 Data Breach Investigations Report revealed that AI-powered cyberattacks are increasing rapidly across businesses and institutions worldwide. AI was being used by threat actors “to accelerate the time to exploit known vulnerabilities, shrinking the window for defense from months to mere hours,” the report said.
Hackers are increasingly using AI to detect software vulnerabilities, which has shortened the time that targets have to respond to threats, Verizon said in an annual report tracking data breaches.
The report said using software flaws in data surpassed stolen credentials for the first time. It said in a review of more than 31,000 incidents, 31% of all breaches started with vulnerability exploitation, adding, ‘AI is fundamentally reshaping the cybersecurity industry.’
The annual report has reviewed a wide range of industry data, showing that intruders are using generative artificial intelligence at all stages of attacks, including targeting, initial access, and the development of malware and other tools.
The Verizon report also found that the use of Shadow AI - or non-authorized AI - is now the third most common non-malicious insider action in data loss incidents. Employees are submitting source code, by images, and other types of structured data.
This is the latest in a series of reports detailing the rise of AI in cyber incidents. CrowdStrike said in its annual global threat report earlier this year that in 2025, “AI-enabled adversaries increased attacks by 89% year-over-year…It elevated less sophisticated threat actors and amplified the most advanced ones.”
Also Read: Top Cybersecurity Companies in Dubai
Verizon said AI’s primary impact “is currently operational: automating and scaling techniques defenders already know how to detect, not yet unlocking these novel or rare attack surfaces.” However, it added that the assessment might be obsolete as AI continues to advance rapidly.
Verizon chief information security officer Nasrin Rezai said it was critical to address the growing threats.
“We need to fight AI with AI. We need to incorporate them into our practices,” Rezai told Reuters. “We need to bring them into our software development life cycle, in our testing processes, in our cyber defense processes at a scale that we have never done before,” he added.
The report does not cover data from Mythos, a new AI model that has raised widespread cybersecurity concerns.