Basic security gaps leave enterprises exposed to AI-boosted attacks

Cybercriminals are exploiting basic security gaps at dramatically higher rates, accelerated by AI tools that help attackers identify weaknesses faster than ever according to a new report.

The latest 2026 X-Force Threat Intelligence Index from IBM shows a 44 percent increase in attacks that began with the exploitation of public-facing applications, largely driven by missing authentication controls and AI-enabled vulnerability discovery.

Active ransomware and extortion groups surged 49 percent year-on-year, marking ecosystem fragmentation, while publicly disclosed victim counts rose roughly 12 percent. At the same time large supply chain and third-party compromises have nearly quadrupled since 2020, as attackers increasingly exploit environments where software is built and deployed or SaaS integrations.

The report also shows that vulnerability exploitation became the leading cause of attacks, accounting for 40 percent of incidents observed by X-Force in 2025.

“Attackers aren’t reinventing playbooks, they’re speeding them up with AI,” says Mark Hughes, global managing partner for cybersecurity services at IBM. “The core issue is the same: businesses are overwhelmed by software vulnerabilities. The difference now is speed. With so many vulnerabilities requiring no credentials, attackers can bypass humans and move straight from scanning to impact. Security leaders need to shift to a more proactive approach, using agentic-powered threat detection and response to identify gaps and catch threats before they escalate.”

Among other findings manufacturing tops the target list for the fifth year. The sector accounted for 27.7 percent of incidents observed by X-Force, with data theft being the most common. North America emerged as the most attacked region. Accounting for 29 percent of total cases observed by X-Force, and up from 24 percent in 2024, North America became the most attacked region for the first time in six years.

You can get the 2026 X-Force Threat Intelligence Index from the IBM site.

Image credit: Ruslan Batiuk/Dreamstime.com