Annual Cyber Threat Report 2025-26

Rapid advancements in AI technologies over the past year are creating significant opportunities for businesses to strengthen cyber security, improve productivity and enhance resilience. While malicious actors are also adopting these technologies, AI has the potential to be a force multiplier for defenders, enabling organisations to identify threats earlier, respond faster and use cyber security resources effectively.

AI can help organisations improve cyber defence by automating repetitive tasks, analysing large volumes of security data at speed, and supporting more consistent and effective decision-making. For many businesses, particularly those with limited cyber security resources, AI-enabled tools can increase visibility of cyber risks and help security teams focus on higher-value activities.

Organisations that integrate AI tooling into their security operations can detect vulnerabilities earlier, improve software quality, monitor unusual behaviour, and respond faster to cyber incidents – reducing both the cost and impact of incidents. AI can also support a range of defensive cyber security functions, including threat detection, vulnerability management, incident response, malware analysis and cyber threat intelligence. These capabilities can help organisations identify emerging threats more quickly, prioritise remediation efforts and improve overall cyber resilience. By reducing the time required to analyse information and investigate incidents, AI can help businesses operate more securely and efficiently.

Many AI use cases involve processing sensitive operational information. Businesses should use AI while maintaining appropriate controls and protecting information, in line with security and data handling obligations. This includes enforcing least privilege access, restricting data exposure to AI systems, validating outputs before use and maintaining auditability of AI-assisted actions.

Organisations must take steps to defend against AI-enabled threats, such as:

• Small businesses can reduce risk by choosing products that are Secure by Design out of the box, enabling automatic updates, and ensuring clear responsibility for security monitoring and incident response.
• Medium-sized businesses should maintain inventories of internet-facing systems, promptly patch vulnerabilities, implement network segmentation and test incident response and business continuity plans.
• Large enterprises, CI operators and government entities should establish executive accountability for AI-related cyber risks, adopt comprehensive monitoring and logging, and work towards layered Zero Trust and Secure by Design architectures supported by human-supervised defensive AI.
• Organisations should actively minimise their attack surface by ensuring only necessary systems and services are exposed to the internet, as AI-enabled exploitation is shrinking the window between vulnerability discovery and compromise.

Cyber resilience cannot be treated as a purely technical issue. It is a core business risk and leadership responsibility. As AI adoption continues to grow, organisations that effectively integrate AI into their cyber security practices will be better placed to manage risk, improve operational efficiency and respond to an increasingly complex threat environment. Organisations should continually assess the costs, benefits and risks of AI, recognising that both AI capabilities and their use by malicious actors will continue to evolve. Cyber risk assumptions can become outdated in months, not years. Success will depend on getting the fundamentals right, acting quickly and integrating cyber security into core business strategy. Organisations should also consider integrating AI into cyber security practices. For many organisations, AI represents not only a new area of risk, but a significant opportunity to build stronger, more adaptive and more resilient cyber defences.

Image

Integrating AI for cyber security

Govern

• Analyse data
• Identify gaps

Identify

• Automate and enrich discovery

Protect

• Scan source code
• Prioritise hardening actions

Recover

• Analyse and inform restoration activities

Respond

• Support activities
• Summarise and interpret information

Detect

• Advance visibility
• Identify patterns