Cybercriminals find ways to break security and gain access to the resources of companies and institutions. In their hands, artificial intelligence is a tool for automating attacks, making them scale greater than ever before.
The coming year will require a revision of the cybersecurity strategy and precise identification of priorities in order to effectively defend against attacks.
The rest of the article below the video:
AI – The Industrialization of Cyberattacks
Few technological changes have had as much impact on the development of cyber threats as artificial intelligence. According to IBM's “Cost of Data Breach” report, 16 percent data breaches in 2025 AI elements were used. Artificial intelligence engines are able to manage the entire attack cycle from victim recognition to ransom negotiations.
This means that one group can conduct many more of them. They are also more effective, as evidenced by data from publications by Harvard Kennedy School scientists – phishing campaigns generated by AI achieve an average click rate of approximately 54 percent, while in the case of traditional campaigns it is approximately 12 percent. Artificial intelligence also makes cyberattacks harder to detect. AI is used to create polymorphic malware that constantly evolves and automatically introduces changes to the code. Therefore, it cannot be included in libraries with known malware and prepared for someone to use it.
Mariusz Kujawski points out that artificial intelligence automates the analysis of attack target profiles. Cybercriminals are able to more quickly correlate information from social media, company resources or obtained through data leaks. The conclusions drawn on their basis allow the creation of more precise, personalized spear-phishing campaigns or deepfake materials, referring to interests, professional position or family relationships, thanks to which the effectiveness of attacks significantly increases.
Don't start by protecting everything
As Mariusz Kujawski argues, the need to constantly improve cybersecurity strategies and investments in this area is a huge challenge for Polish business. This area is sometimes downright messy, as evidenced by, among others: data from the KPMG “Cybersecurity Barometer” report, which shows that 11 percent the organization did not assign responsibility for cybersecurity to any specific person. Interestingly, this percentage is exactly the same as in the previous edition of the study.
Read also: Does Poland give too much data to foreign giants? Vice-President of Asseco on the consequences [WYWIAD]
In the new year, it is worth starting by taking control of cybersec projects, at least to a basic extent. The first step should be to set priorities, according to the principle “you can't secure everything”. According to the Asseco expert, at the beginning it is necessary to determine what resources the organization cannot function, generate income, produce or serve customers without.
Perhaps in a crisis situation, some processes can be handled without using a system that has stopped working due to a cyber attack, damage or supplier failure. However, in every organization there are certainly IT resources that should be embedded in a separate network and for which immediate backup must be provided. An example are OT systems for controlling, monitoring and managing a production line in the manufacturing industry.
According to Mariusz Kujawski from Asseco, it is better to carefully secure key resources than to implement only basic security measures covering the entire IT infrastructure.
The next stage is a comprehensive review of permissions granted to both users and devices, including less obvious ones such as virtualizers or IoT. As Mariusz Kujawski's experience with Asseco shows, they are often redundant and assigned out of convenience. As a result, obtaining the credentials of even one person or hacking a single device opens up numerous attack possibilities and access to many resources.
Digital threats. Skepticism and reason
Every user of digital solutions is exposed to cyber threats to a greater or lesser extent. The Asseco expert emphasizes that it is impossible to avoid attempted cyberattacks, you can only try not to fall victim to them. Disinformation, fraud attempts when shopping online, and false transfer requests mean that nowadays we should be skeptical about the information we receive online and take care of our digital hygiene. When we receive a message from a friend, it is worth confirming whether it is really him, e.g. by making a video call.
A traditional phone can also be used for a cyber attack, and the voice we hear on the handset will be artificially generated and similar to the voice of someone we know. A “red light” should also light up when the seller of a product asks to use a payment gateway on an external website, other than the shopping platform.
A major threat is the unauthorized use of AI tools by employees who, in order to make everyday tasks easier, include sensitive company information in artificial intelligence models. The Asseco expert recalls a situation in which an AI engine was used to search for vulnerabilities in the software, the source code was placed there, which thus became public and ceased to constitute a unique value of the company that created it.
Mariusz Kujawski points out that it is currently impossible to prohibit the use of AI, including at work. With this in mind, organizations must establish rules for the use of artificial intelligence, define what constitutes sensitive data and provide employees with access to proven platforms with an information processing policy known and accepted by the company. However, even the best strategy will not protect the business from unwise users who will intentionally break the rules and expose the organization to a cyber attack.
