AI did not just change how we work. It rearmed the attackers. A run of 2026 reports has now put hard numbers to it, and the trend lines all point the same way: cheaper attacks, more convincing lures, and a lot more of them.
The figures below come from across the industry. Read together, they explain why even a small business with nothing obvious to steal is now worth an attacker's time.
The numbers
- 87% of organizations reported facing an AI-powered cyberattack in the past year, and 85% encountered a deepfake attempt of some kind.
- 82.6% of phishing emails now show signs of being AI-generated, and AI-written phishing gets clicked more than four times as often as the old human-written kind.
- IBM's 2025 breach research found 1 in 6 breaches now involve attackers using AI, most often for phishing and for deepfake impersonation.
- Reported phishing losses to the FBI's Internet Crime Complaint Center jumped from about $70 million in 2024 to roughly $216 million in 2025, a threefold rise in a single year.
- Deepfake-enabled fraud has climbed more than 2,000% since 2022, and among organizations that lost money to one, 61% put the loss above $100,000.
Why it matters for a small business
For years, the reason small companies were spared was simple economics: a tailored attack took an attacker time, and you were not worth it. AI erases that math.
- It removes the skill barrier. A low-skill criminal can now generate fluent, personalized phishing in your language, referencing your suppliers and your staff.
- It scales. The same effort that once hit one target can now hit thousands, automatically, so being small is no longer cover.
- It is more convincing. Cloned voices and faked video turn the old "just call them to check" advice into something you have to do more carefully, not less.