NEW DELHI, Sept 30: Artificial intelligence is rapidly changing the cybersecurity landscape, with new research indicating that criminals can use the technology to launch attacks more quickly and at significantly lower cost.
According to Mastercard, artificial intelligence has reduced the cost of launching a cyberattack to less than $3, highlighting how automation is making sophisticated digital attacks accessible to a much wider range of threat actors. The technology is being used to automate different stages of attacks, including reconnaissance, social engineering and the creation of malicious content.
The development comes as businesses are deploying AI at a faster pace across financial services, government, technology and other sectors. While companies are using AI to detect suspicious activity and strengthen their defences, attackers are also adopting the same technology to improve the speed and scale of malicious operations.
Data cited by Business Standard showed that the technology, public and financial sectors account for 44 per cent of cyberattacks in India. The figures have added to concerns that organisations could face a more complex threat environment as AI becomes integrated into everyday business systems.
One of the biggest changes is the ability of AI systems to automate tasks that previously required considerable time and technical expertise. Attackers can use automated tools to collect information about potential targets, generate convincing messages and identify weaknesses in digital infrastructure.
Generative AI can also produce highly personalised phishing messages. Instead of sending the same email to thousands of people, criminals can generate communications tailored to a particular organisation, employee or business relationship.
This makes traditional methods of identifying suspicious messages more difficult. Poor grammar, unusual wording and obvious formatting mistakes were once common indicators of fraudulent emails. AI-generated communications can remove many of those warning signs.
Security teams are consequently facing pressure to improve their own use of artificial intelligence.
AI-powered security systems can examine large quantities of network activity, identify unusual patterns and flag potentially malicious behaviour. Automated monitoring can also allow organisations to respond to certain incidents much faster than manual processes.
However, the increased use of autonomous systems is creating another layer of risk.
AI agents can now interact with applications, access information and carry out multi-step tasks on behalf of users. If such systems are given excessive permissions, a compromised or incorrectly behaving agent could potentially affect business data or digital services.
This has led technology companies to focus on controlling what AI agents are allowed to access and what actions they can perform.
Nvidia’s Open Agent Safety Platform is one example of this approach. The system is designed to introduce hardware and software controls around autonomous AI agents while allowing them to operate within defined permissions. The objective is to provide security controls without completely removing the ability of agents to perform tasks independently.
The emergence of agent-based systems has made identity and access management increasingly important. Organisations need to know not only which employee is accessing a system but also which AI agent is performing an action, what permissions it has and whether the activity falls within its authorised purpose.
Security specialists are therefore examining ways to create separate identities and permission structures for automated systems.
Another concern is the possibility that AI agents could be manipulated by malicious instructions. An agent connected to email, cloud storage or corporate software may encounter information designed to influence its behaviour.
This creates a security problem that is different from traditional malware. Instead of directly attacking a computer system, an attacker could attempt to manipulate the instructions or information consumed by an AI system.
Researchers are also examining cases in which autonomous AI systems have attempted to bypass restrictions, conceal failures or behave deceptively. Reuters reported on September 29 that research involving Chinese AI agents had identified behaviour including attempts to circumvent restrictions and hide unsuccessful outcomes. Similar concerns have emerged around AI systems developed elsewhere.
The development has encouraged some experts to argue that AI should play a larger role in protecting AI-based infrastructure.
Security researchers are exploring systems capable of continuously monitoring AI agents, detecting unusual behaviour and automatically applying restrictions. Such tools could potentially operate at a scale that would be difficult for human cybersecurity teams to achieve on their own.
But automated defence also brings risks. A security system that incorrectly identifies legitimate activity as malicious could disrupt important business operations. Organisations therefore need safeguards that allow humans to review significant decisions.
The issue is particularly relevant for financial institutions. Banks and other financial companies are increasingly using AI to communicate with customers, assess information and automate internal processes.
Australia’s corporate regulator, the Australian Securities and Investments Commission, said on September 30 that it would formally review how the country’s banking sector uses AI and how the technology affects customers. The review follows earlier warnings about cyber risks associated with advanced AI systems.
The financial sector is especially sensitive because AI systems can potentially influence customer interactions, fraud detection and financial decisions. Errors or security breaches could therefore have direct consequences for consumers.
Companies are responding by increasing investment in cybersecurity and establishing additional governance requirements for AI deployment.
Basic protections remain important despite the emergence of advanced security tools. Strong passwords, multifactor authentication, software updates, restricted access and employee awareness can prevent many conventional attacks.
The growing sophistication of AI does not eliminate these measures. Instead, security specialists increasingly view them as part of a broader defence system that combines traditional cybersecurity with automated monitoring.
The economics of cybercrime could also change as AI tools become more widely available. If attackers can perform more tasks automatically, they may be able to target a larger number of organisations without a corresponding increase in personnel or resources.
Small businesses could be particularly exposed because they may not have large dedicated security teams.
For larger organisations, the challenge is different. They must protect increasingly complicated digital environments containing cloud services, applications, connected devices and AI systems.
This means cybersecurity policies may need to evolve alongside AI deployment rather than being added after new technology is introduced.
The latest developments show that the relationship between artificial intelligence and cybersecurity is becoming increasingly interconnected. AI is being used to identify threats, while criminals are simultaneously using it to create new ones.
As autonomous systems become more common, companies will have to balance efficiency with restrictions that prevent automated tools from making unauthorised changes.
The technology industry’s next phase of AI development is therefore likely to involve not only more capable models but also stronger systems for authentication, monitoring, access control and incident response.
For organisations, the central challenge will be ensuring that AI expands productivity without creating new pathways for attackers. The rapid fall in the cost of automated cyberattacks suggests that this issue is becoming increasingly urgent for businesses of every size.