Notifications
Clear all
Topic starter
18/08/2026 2:56 pm
TL;DR: AI is compressing phishing, deepfake fraud, reconnaissance, and credential abuse into faster, more convincing attack paths while also improving anomaly detection, triage, and automated response, according to Xygeni. The operational question is no longer whether AI belongs in security, but whether teams can govern the systems and workflows it now influences.
NHIMG editorial — based on content published by Xygeni: AI in cybersecurity, in one paragraph and related analysis of attack and defence patterns
By the numbers:
- AI-generated phishing jumped from 4% of all reported phishing attempts in November 2025 to 56% in December 2025, a 14x increase in a single month, and has held around 40% of all reported phishing attempts through mid-2026.
- Fully AI-automated spear phishing emails achieved a 54% click-through rate, matching skilled human experts and far outperforming the 12% click-through rate of the control group.
Questions worth separating out
Q: How should security teams handle AI-generated impersonation in fraud workflows?
A: Security teams should treat AI-generated impersonation as a trust and verification problem across onboarding, recovery, and support.
Q: Why do AI attacks change the way organisations should think about verification?
A: AI lowers the cost of believable deception and makes appearance less reliable as a signal of identity.
Q: How can teams tell whether AI threat detection is improving SOC performance?
A: Look at mean time to verdict, analyst rework, and the percentage of alerts resolved with documented reasoning.
Practitioner guidance
- Implement out-of-band verification for high-risk requests Require a second channel for payment approvals, credential resets, and executive instructions that originate by voice or video.
- Use AI to reduce alert noise before expanding detection scope Measure whether AI is collapsing related alerts into fewer incidents, reducing uninvestigated queues, and improving analyst prioritisation.
- Extend governance into AI-assisted development workflows Review model prompts, agent instructions, package provenance, and install-time behaviour with the same discipline applied to code changes.
What's in the full article
Xygeni's full article covers the operational detail this post intentionally leaves for the source:
- The practical mechanics of AI-generated phishing, deepfakes, and defensive anomaly detection across real attack and response paths.
- The developer-facing risks of AI in the software supply chain, including code generation, dependency selection, and unreviewed agent instructions.
- The product-specific workflow details behind CoreAI and DevAI, including how alerts are scored, correlated, and turned into remediation actions.
- The implementation detail behind starting free with GitHub, GitLab, or Google sign-in for repository and AI scan coverage.
👉 Read Xygeni's analysis of AI security attacks, defence, and code risk →
AI in cybersecurity: what security teams need to change now?
Explore further
18/08/2026 3:39 pm
AI security is now an identity trust problem, not only a model-risk problem. The article’s strongest point is that AI attacks succeed by manipulating human and process trust, especially in verification-heavy moments such as payment approval and credential reset. That makes IAM and fraud controls part of the AI security conversation, not an adjacent concern. Practitioners should treat deepfake-resistant verification as core governance, not exception handling.
A question worth separating out:
Q: What should organisations do when AI moves into code generation and software delivery?
A: Extend governance to the pipeline itself. Review AI instructions, package provenance, dependency selection, and runtime permissions before code or automation reaches production. AI-assisted development needs provenance and approval controls, not only static code scanning after the fact.
👉 Read our full editorial: AI in cybersecurity is reshaping both attack and defence
