AI in cybersecurity is already at work behind everyday computing. When you sign in to email, open a work file or pay for something online, software checks whether the request looks normal — in a fraction of a second.
Microsoft says its customers face more than 600 million cybercriminal and nation-state attacks every day, from ransomware to phishing to identity attacks, and it processes more than 78 trillion security signals a day to make sense of them — up from 65 trillion the year before. No team of people could read that volume, so machine learning does the first pass.
This guide explains how defenders spot attacks early, how attackers use it too, what a missed breach costs, and the rules that keep a person in charge.
How AI spots an attack while it is still small
A security team faces far more events than people could ever read one by one. A single company network can generate millions of log entries a day. AI tools learn what normal looks like for each user and each device, then flag the things that break the pattern.
The check usually starts with behaviour. A member of staff who normally signs in from Lagos on a work laptop at 9 a.m. and suddenly signs in from a new country at 3 a.m. on an unknown device will score as risky. So will a user who opens hundreds of files in a minute. None of these is proof of an attack on its own, but together they form a picture a person can act on.
The second job is sorting. Security tools raise thousands of alerts, and most turn out to be harmless. AI ranks them so the most dangerous ones reach a person first, and groups related alerts into one incident. Microsoft says AI improves threat detection, response speed and incident analysis, which lets a small team cover a large network.
Speed matters because breaches take a long time to find. IBM's 2024 report found that, on average, it took 194 days to identify a breach and a further 64 days to contain it — 258 days in total. Organisations using security AI and automation averaged $3.84 million per breach, against $5.72 million for those not using it: faster detection means less data taken and a shorter clean-up.
How attackers use AI too
The same tools that help defenders are available to attackers, and the UK's National Cyber Security Centre (NCSC) is blunt about the result. In a report published in January 2024, it concluded that AI is already being used in malicious cyber activity and will almost certainly increase the volume and impact of cyber attacks in the near term. The NCSC's point is that AI strengthens existing threats rather than inventing new ones.
The clearest gain for attackers is in social engineering — the tricks that persuade a person to hand over a password or open a harmful file. Microsoft's 2024 report lists AI-enabled spear phishing, résumé swarming and deepfakes among the emerging techniques. A language model can now write a message that reads like it came from a real colleague, and criminals are offering generative AI tools as a service, so a buyer with little skill can rent the capability.
Ransomware remains the sharpest threat. The NCSC calls it the most acute cyber threat facing UK organisations, and Microsoft observed a 2.75-fold year-on-year increase in human-operated ransomware encounters. AI lowers the barrier to entry for novice criminals, hackers-for-hire and hacktivists, the NCSC says, because it helps relatively unskilled actors carry out more effective operations.
Attackers also use AI to find weak points faster and to sort stolen data quickly. The contest is now between two sets of AI tools, and the side that keeps a person in the loop has the better chance.
Passwords, phishing and the identity problem
Most attacks start with identity. Microsoft's data shows that password-based attacks make up over 99% of the 600 million daily identity attacks it sees, and that it blocked 7,000 password attacks per second over the past year. A password can be guessed, reused across sites, or stolen in an earlier breach and tried everywhere.
IBM's 2024 report makes the same point from the victim's side: compromised credentials were the most common initial attack vector in the breaches it studied, accounting for 16% of them. Those breaches cost an average of $4.81 million each and took the longest to identify and contain — 292 days. A stolen login is quiet: nothing looks broken, so nothing gets investigated until the damage is done.
This is why sign-in is where AI in cybersecurity is most visible. When you sign in from a new device, you may be asked for a second check — a code, a fingerprint, or approval on your phone — because a risk score flagged something unusual. Microsoft says it is developing phishing-resistant multi-factor authentication, because attackers have learned to trick people into approving fake prompts.
The longer-term fix is to move past passwords altogether. Password-free sign-in methods such as passkeys let you confirm on your own phone or computer with a fingerprint, a face scan or a PIN, instead of typing a secret that can be copied or guessed. Until then, use a different password for each important account, switch on a second factor, and pause before clicking a link in an unexpected message.
What a missed breach costs
IBM's 2024 Cost of a Data Breach report, produced with the Ponemon Institute, put the global average cost of a data breach at $4.88 million, up 10% on the year before — the biggest jump since the pandemic. The rise was driven mainly by business disruption and the work of responding afterwards. Customer personal information was the most commonly compromised data, appearing in 46% of breaches.
The industrial sector shows how the numbers break down. IBM found the average breach there cost $5.56 million, 13% above the global average. Only 32% of industrial organisations made extensive use of security AI and automation — and those that did saved an average of $1.9 million per breach. Catching an attack earlier shrinks the cost.
People are part of the cost too. IBM found that organisations with a serious shortage of skilled security staff averaged $5.74 million per breach, against $3.98 million where the shortage was low. For a small business the same pattern holds at a smaller scale: days of lost work, customers who stop calling, and the price of rebuilding systems.
The rules and frameworks teams follow
AI in cybersecurity is powerful, but it is also a system that can be attacked, fooled or misused. That is why governments and standards bodies have written down how it should be run, and why the guidance keeps pointing back to human checks.
The best-known framework comes from the US National Institute of Standards and Technology. Its AI Risk Management Framework, released on 26 January 2023, is voluntary: it is not a law, and no certificate is issued for following it. It organises risk management into four functions — Govern, Map, Measure and Manage — and describes what trustworthy AI looks like. A companion profile for generative AI followed on 26 July 2024, and NIST says the framework is being revised.
A second strand covers the AI systems themselves. CISA, the US cyber defence agency, published a joint guide with partners including the UK's NCSC, the FBI and the NSA's AI Security Center. It sets out four principles for bringing AI into operational technology — the systems that run power, water and factories: understand the risks, assess each use, govern with continuous testing, and embed safety and security, keeping a person in oversight.
The UK's NCSC published its own Guidelines for Secure AI System Development in November 2023, endorsed by 17 other countries, with the message that AI systems should be secure by design. The UK government has also invested £2.6 billion under its Cyber Security Strategy to improve national resilience.
For a small business, the practical version is short: know what AI tools you use, who is responsible for them, and what happens when one flags a problem. Test the tools, keep software updated, back up the data that matters, and make sure a person — not a model — makes the final call.
Frequently asked questions
Does AI replace security staff?
No. AI sorts alerts, flags unusual behaviour and handles the routine checks, but people still decide what to do about a real incident. IBM found that organisations with a serious shortage of skilled security staff paid far more per breach — $5.74 million on average, against $3.98 million where the shortage was low.
Can a small business use AI security tools?
Yes. Most of the AI is already built into the tools a small business uses: email filters that catch phishing, endpoint software that watches for malicious files, and sign-in systems that score risk. Start with a second factor for sign-ins, updated software, backed-up data, and a clear rule for checking unexpected payment requests.
Is AI in cybersecurity safe to trust?
It is useful, not perfect. AI models can be fooled by crafted inputs, trained on poor data, or trusted too far. That is why frameworks such as NIST's AI Risk Management Framework and joint guidance from CISA and partner agencies call for testing, human oversight and incident plans. Treat an AI alert as a lead to investigate, not as a verdict.
AI in cybersecurity is now a contest between two sets of tools. Defenders use it to spot unusual behaviour early and cut the time a breach stays hidden. Attackers use it to write more convincing phishing messages and find weak devices faster. The figures are stark — more than 600 million attacks a day, an average breach cost of $4.88 million, and nearly a year on average to find and contain an intrusion — but the defences that work are practical: strong sign-ins, tested tools, backed-up data and a person who makes the final call.
If you run a small business, start with the basics: a second factor on every important account, updated software, and a simple check for any urgent payment request. If you want help putting AI tools to work in your business, see our AI automation services, or get in touch through our contact page.
What to watch next
Watch whether password-free sign-in spreads beyond the big platforms, and whether the share of organisations using security AI extensively climbs from the one-third IBM found in industry. Watch the revision of NIST's AI Risk Management Framework and the next NCSC assessment.
Sources
- Microsoft — 2024 Microsoft Digital Defense Report — date checked: 2026-11-08 — https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2024
- IBM — Cost of a data breach: The industrial sector — date checked: 2026-11-08 — https://www.ibm.com/think/insights/cost-of-a-data-breach-industrial-sector
- SpyCloud — Top Takeaways from IBM's Cost of a Data Breach Report 2024 — date checked: 2026-11-08 — http://spycloud.com/blog/5-takeaways-from-ibms-cost-of-a-data-breach-report-2024/
- National Cyber Security Centre — Global ransomware threat expected to rise with AI, NCSC warns — date checked: 2026-11-08 — https://www.ncsc.gov.uk/news/global-ransomware-threat-expected-to-rise-with-ai
- CISA — New Joint Guide Advances Secure Integration of Artificial Intelligence in Operational Technology — date checked: 2026-11-08 — https://www.cisa.gov/news-events/news/new-joint-guide-advances-secure-integration-artificial-intelligence-operational-technology
- NIST — AI Risk Management Framework — date checked: 2026-11-08 — https://www.nist.gov/itl/ai-risk-management-framework
Eri-Tech Global Ltd
Eri-Tech Global Ltd is a digital solutions company working with small businesses and growing brands. Learn more at /about.
