What happens to victims, and how fast

Money

What victims report losing, what ransomware collects, and what insurers pay out. Each series counts a different population.

Fraud and impersonation, including AI-enabled fraud

Fraud is its own impact class here: money moved by deception rather than by breaking into systems. Business email compromise is the fraud type IC3 has reported losses for the longest, back to 2014. In 2025 IC3 began tagging complaints whose reporter mentioned AI, which makes it the one outcome series with an AI field. Every AI-tagged figure below is a lower bound: it counts complaints whose reporter noticed and mentioned AI, and IC3 itself notes that many victims do not realize AI was involved.

Speed and detection: attackers and defenders side by side

How fast attackers move once inside, and how long defenders take to notice and contain them. Attacker-side and defender-side panels come from different reports and populations; read each shape on its own scale.

Speed figures not charted as a line, each as its report states it

Volume

How many incidents each source counted. Each counts a different population: complaints to the FBI, insurer claims, incident-response caseloads.

Where a source attributes something to AI

Statements and figures whose own report ties them to AI. Quote marks hold only the report's own words; where this site summarizes a statement, the summary is labelled as this site's description and carries no quote marks. Each describes what that observer could see in its own sample, and each says what kind of statement it is. None is AI's share of all attacks, and none is added to another. Two kinds depend on victims noticing AI and saying so, and both are lower bounds: IC3's AI-tagged complaints (in the fraud section above) and IBM's shares of breached organizations that reported an AI-driven attack (below).

• DBIR, 2026: Median number of documented techniques per threat actor with AI research or assistance. Figure: 15 techniques per actor (median) · Oct 2024 through Nov 2025 (edition dataset window; the passage gives no separate window). The report says: Threat actors are demonstrably using GenAI to help at different stages of attack, including targeting, initial access, and development of malware and other tools. The median threat actor researched or used AI assistance in 15 different documented techniques, with some Actors leveraging as many as 40 or 50. a lower bound: counts only AI use the data contributor could observe; never AI's share of all attacks. Source
• DBIR, 2026: Share of AI-assisted malware observations using less-common techniques. Figure: <2.5% of AI-assisted malware observations · Oct 2024 through Nov 2025 (edition dataset window; the passage gives no separate window). The report says: Most AI-assisted development of malware and tooling was associated with well-known and defined attack techniques, with a median of 55 existing known malware examples performing the same functions. Less than 2.5% of the AI-assisted malware observations involved less-common techniques with one or fewer known malware examples. … Distribution of known existing malware examples per ATT&CK technique observed (n=9,897—each dot is 247.43 observations) a stated assessment, not a measurement. Source
• DBIR, 2025: Share of malicious emails that were AI-assisted. Figure: ~10% of malicious emails (approximate, stated as "10-ish%") · Two years up to the 2025 edition ("over the past two years"); start value "5-ish%". The report says: One of our email security data partners allowed us to reproduce some findings from one of their research articles, in which they have discovered an increase of malicious AI-written emails over the last couple of years. ... Figure 23 provides us with the coveted DBIR AI headline: percentage of AI-assisted malicious emails doubled (from 5-ish% to 10-ish%) over the past two years. a stated assessment, not a measurement. Source
• IBM, 2026: Share of malicious attacks that were AI-driven. Figure: 25 percent · Breaches between March 2025 and February 2026 (2026 report). The report says: More than one in 4 organizations experienced a malicious, AI-driven attack—a 56% increase over last year. ... Figure 20. Share of AI-driven attacks ... 25% AI-driven attacks a lower bound: breached organizations reported whether the attack was AI-driven, so the share counts only AI use they noticed; 11% could not determine either way (Figure 20); never AI's share of all attacks. Source
• IBM, 2025: Share of breaches involving attackers using AI. Figure: 16 percent · Breaches between March 2024 and February 2025 (2025 report). The report says: Researchers found 16% of breaches involved attackers using AI. Most of these breaches focused on human manipulation through phishing (37%) or deepfake attacks (35%). a lower bound: breached organizations reported whether the attacker used AI, so the share counts only AI use they noticed. The 2025 edition does not publish how many could not tell; never AI's share of all attacks. Source
• Coalition, 2025 Cyber Claims Report (published 2025-05-07): AI attribution stated. This site's description: qualitative only; no AI-tagged claim count · 2024. The report says: concerns about the rise of ransomware, new AI-powered phishing tactics, and more supply chain attacks all came to fruition last year. a stated assessment, not a measurement. Source
• Coalition, 2024 Cyber Claims Report (published 2024-04-24): AI attribution stated. This site's description: qualitative only; no AI-tagged claim count · 2023. The report says: With new AI tools making it even easier to execute targeted cyber attack campaigns and identify exploitable assets, having an active partner that can help protect your organization from digital risk is crucial. a stated assessment, not a measurement. Source
• Coalition, 2023 Cyber Claims Report (published 2023-05-16): AI attribution stated. This site's description: qualitative only; no AI-tagged claim count · 2022. The report says: Threat actors have started leveraging AI tools to write credible phishing emails and translate the scams across multiple languages, giving them more time and cover to gain access to a network. a stated assessment, not a measurement. Source
• CrowdStrike, 2026 Global Threat Report: Year-over-year increase in attacks by AI-enabled adversaries. Figure: 89 percent increase year over year (not a share) · Calendar year 2025 vs 2024. The report says: Most that integrated AI increased their attack volume compared to 2024; there was an 89% increase in the number of attacks by AI-enabled adversaries year-over-year. … In 2025, there was an 89% increase in attacks by AI-enabled adversaries year-over-year. a growth rate, not a share or a count. Source
• Unit 42, 2026 Global Incident Response Report: AI attribution stated by the source. This site's description: Narrative attribution only: no AI-tagged share or count of cases published · 2025. The report says: What this means in time-to-impact: Last year, Unit 42 simulated an AI-assisted attack that reduced time-to-exfiltration down to 25 minutes. Real-world IR data reflects this acceleration: The fastest 25% of intrusions reached exfiltration in 72 minutes, down from 285 minutes the calendar year prior. a stated assessment, not a measurement. Source
• Unit 42, 2025 Global Incident Response Report: AI-assisted attack simulation: time to exfiltration. Figure: 25 minutes (lab simulation) · Simulation reported in the 2025 edition (published early 2025). The report says: Our testing took the time to exfiltration from the median of two days down to 25 minutes — about 100 times faster. While these are lab-based results a single lab simulation, not a measure of real incidents. Source
• Unit 42, 2025 Global Incident Response Report: Social Engineering Edition: AI attribution stated by the source. This site's description: Observed in IR cases (GenAI lures and cloned executive voices in multiple investigations; agentic AI in limited cases); no count or share published · May 2024 to May 2025. The report says: Unit 42’s incident response cases point to three distinct layers of AI-enabled tooling … In multiple investigations, threat actors employed GenAI to craft highly personalized lures using public information. a stated assessment, not a measurement. Source
• Unit 42, Incident Response Report 2024: AI attribution stated by the source. This site's description: Qualitative only: 'evidence that adversaries have already begun to use and experiment with AI'; no count or share of cases · 2023. The report says: Unit 42 sees evidence that adversaries have already begun to use and experiment with AI. a stated assessment, not a measurement. Source
• M-Trends 2026: Mandiant assessment of breaches directly resulting from AI. This site's description: 2025 not considered the year breaches were the direct result of AI · 2025. The report says: However, despite threat actors increasingly leveraging AI, especially during the early phases of the attack lifecycle, we don’t consider 2025 to be the year where breaches were the direct result of AI. a stated assessment, not a measurement. Source
• M-Trends 2026: ATT&CK T1588.007 (Obtain Capabilities: Artificial Intelligence) observed. Figure: 0.2 percent (denominator not stated in table) · 2025. The report says: T1588.007: Artificial Intelligence 0.2% a lower bound: counts only investigations where responders found evidence of AI acquisition, which usually leaves no trace in the victim environment; never AI's share of all attacks. Source
• M-Trends 2025: ATT&CK T1588.007 (Obtain Capabilities: Artificial Intelligence) observed. Figure: 0.2 percent (denominator not stated in table) · 2024. The report says: T1588.007: Artificial Intelligence 0.2% a lower bound: counts only investigations where responders found evidence of AI acquisition, which usually leaves no trace in the victim environment; never AI's share of all attacks. Source
• M-Trends 2024: Mandiant observation of attacker AI use by attack stage. This site's description: largely limited to Initial Access (social engineering and information operations) · 2023. The report says: Mandiant has observed that attacker usage of AI has largely been limited to the Initial Access stage of the Targeted Attack Lifecycle. Specifically, usage has been limited to social engineering and information operations. a stated assessment, not a measurement. Source

Disruption

Disruption is the third outcome this site follows: systems, services and operations taken offline by an attack, and for how long. This site has not found a public series that counts it the same way every year, so there is no chart here yet, and none of the money or speed series above stands in for it.

Missing instrument: a recurring public count of attack-caused outages with their duration, reported on the same definition each year, ideally with a field for how the attack was carried out.

Defender capacity: who can take the next case

A defender-side outcome with no public series: whether victims can get incident-response help when they are hit, and whether security teams can work through the alerts they already have. What exists is reports and quotes, collected below, 10 of them, each read from its page. These are collected reports and quotes, not a measurement. They were found by searching for strain, so they cannot say how common strain is, and no count of them is a trend. The surveys are vendor-sponsored, and most sponsors sell a product for the problem their survey measures. That makes this a record of what people with a view of the problem said, not a measurement of how often it happens.

Incident-response firms at capacity (5)

• 2026-10-31 · Erez Liebermann, Luke Dembosky, Robert Maddox, Stephanie Thomas, Lily Schoen and Joshua A. Goland, Breach counsel, Debevoise & Plimpton's data strategy and security group Breach counsel's observation

  Incident response firms are stretched thin and turning away work, or have wait times of days, not hours. Some victim companies are being forced to check with three or four incident response firms before finding one with capacity.

  AI: tied to AI by Erez Liebermann, Luke Dembosky, Robert Maddox, Stephanie Thomas, Lily Schoen and Joshua A. Goland, in their words: The threat actors were using AI as jet fuel for their old-school attacks. An assertion, not a measure of how much of the strain AI caused.The same source adds: The truth is that the incident response world was at capacity already even without truly agentic AI attacks. Debevoise Data Blog
• 2026-10-30 · Troy Bettencourt, as reported by Axios, Leads Palo Alto Networks' global digital forensics and incident response practice Practitioner, on the record

  The same heavy workload is happening across the industry, and even Palo Alto Networks' incident response subcontractors are at max capacity, he said. Axios's words, reporting what the speaker said.

  AI: tied to AI by Axios's own framing, Humans are still at the frontlines of a fight enabled largely by AI, not by the person quoted. The source sells a remedy for this problem. Axios · read from this copy (Axios refuses scripted reads (HTTP 403); Yahoo News carries the same Axios article.)
• 2026-10-26 · Sophos, Security vendor with its own incident-response service Vendor's own caseload

  our own IR function has never been busier and is forecasting an industry-wide capacity crunch

  AI: not attributed. This source does not say that AI caused this strain. The source sells a remedy for this problem. Sophos blog
• 2026-10-21 · Sophos, Security vendor with its own incident-response service Vendor's own caseload

  DFIR firms we know are asking whether they can use Sophos to provide overflow support when their teams reach capacity.

  AI: tied to AI by Sophos, in their words: AI has changed what threat actors can accomplish with the people and resources they already have. An assertion, not a measure of how much of the strain AI caused. The source sells a remedy for this problem. Sophos blog · read from this copy (sophos.com does not answer scripted reads of this post in time; InfoSec Today republishes the full post.)
• 2026-10-19 · Rob Joyce, as quoted by Sophos, Former NSA cybersecurity director Practitioner, on the record

  IR firms are saturated & turning away work.

  AI: not attributed. This source does not say that AI caused this strain. Sophos blog · original post (Joyce's own post on X, linked from the Sophos post. This site does not read X by script, so the words are checked against Sophos's quotation of them.)

Teams that cannot triage what they already have (4)

The surveys ask different questions of different samples, so their figures are not a trend and are never compared with one another.

• 2026-10-30 · Samantha Lewis, as reported by Axios, Head of threat intelligence, Armadin (AI offensive security testing) Practitioner, on the record

  The number of people you would need to actually defend against this starts to become entirely untenable

  AI: tied to AI by Axios's own framing, Humans are still at the frontlines of a fight enabled largely by AI, not by the person quoted. The source sells a remedy for this problem. Axios · read from this copy (Axios refuses scripted reads (HTTP 403); Yahoo News carries the same Axios article.)
• 2026-08-03 · Prophet Security, State of AI in the SOC 2026, Vendor survey of security operations teams, fielded by ViB Vendor-sponsored survey

  The average organization leaves roughly 28% of its alerts uninvestigated, with a median of 22%, and 39% of respondents leave 30% or more untouched.

  AI: not attributed. This source does not say that AI caused this strain. The source sells a remedy for this problem. Survey: State of AI in the SOC 2026, sponsored by Prophet Security, fielded by ViB (sample size not stated on the page). Prophet Security
• 2026-03-18 · Ponemon Institute for Crogl, The State of SecOps and the Deployment of AI in the SOC, Vendor-commissioned survey of 649 IT and IT security practitioners in North America Vendor-sponsored survey

  Enterprises report receiving an average of 4,330 security alerts per day, yet only 37% of those alerts are detected and investigated.

  AI: not attributed. This source does not say that AI caused this strain. The source sells a remedy for this problem. Survey: The State of SecOps and the Deployment of AI in the SOC, sponsored by Crogl, fielded by Ponemon Institute, 649 respondents, IT and IT security practitioners in North America. Crogl
• 2026-02-17 · Omdia for Microsoft, State of the SOC: Unify Now or Pay Later, Vendor-commissioned survey of 300 SOC professionals (US, UK, Australia and New Zealand), fielded June 25 to July 23, 2025 Vendor-sponsored survey

  Surging alert volumes bury analysts in noise with an estimated 46% of alerts proving false positives and 42% going uninvestigated, overwhelming capacity, driving fatigue, and increasing the likelihood real cyberthreats slip through unnoticed.

  AI: not attributed. This source does not say that AI caused this strain. The source sells a remedy for this problem. Survey: State of the SOC: Unify Now or Pay Later, sponsored by Microsoft, fielded by Omdia, 300 respondents, SOC staff at organizations of more than 750 employees, US, UK, Australia and New Zealand, fielded 2025-06-25 to 2025-07-23. Microsoft Security Blog

Counter-evidence and rival readings (1)

• 2026-10-23 · CrowdStrike Counter Adversary Operations, Threat research team of an incident-response vendor Vendor threat research

  At this time, CrowdStrike Counter Adversary Operations has not observed successful exploitation of these vulnerabilities in the wild or within our honeypot environments.

  AI: not attributed. This source does not say that AI caused this strain.This site's reading: The October surge is not shown to be successful intrusions: at the time of this post, the most-discussed flaws of the month had produced probing and failed attempts in CrowdStrike's view. Demand for response can rise on exposure checks alone. The source sells a remedy for this problem. CrowdStrike blog

Gaps: No report found in this collection says incident-response capacity was adequate in October 2026; the search looked for that and found none, which is not evidence that none exists. No public series counts incident-response capacity, waiting times or turned-away cases over time, so none of these reports can be set against a baseline. The three triage surveys ask different questions of different samples (Prophet: share of alerts left uninvestigated; Ponemon: share detected and investigated; Omdia: share uninvestigated), so their figures are never compared as a trend.

Changes in how these sources count

A dashed seam on a chart marks a change in how its source counts: a dated change listed below, or a change in the edition's own definition of the series (IC3's business email compromise category). A rise that starts at a seam is a change in measurement until shown otherwise.

• 2024-05-01 · DBIR redefines its human-element metric. From the 2024 edition, Verizon removed malicious insiders (Privilege Misuse) from the human-element share. The old definition would have given 76% against the new 68%, so human-element shares before and after the 2024 edition are different measures. Source (context only, not drawn)
• 2024-05-01 · DBIR adds a third-party involvement metric. The share of breaches involving a third party is new in the 2024 edition, so there is no like-for-like value before it. The 2026 edition's 48% third-party figure can only be compared back to the 2024 edition. Source (context only, not drawn)
• 2025 · IC3 adds an "AI Related" descriptor (AI-tagged figures only). The 2025 IC3 report adds an "AI Related" descriptor and marks earlier years as not captured. A descriptor is a tag IC3 adds to a complaint after its crime type is chosen, so it changes nothing about how complaints or losses are counted: total complaints, total losses, business email compromise and every other crime type are counted as before, and no seam belongs on those charts. It affects only the AI-tagged figures, which count complaints whose text mentions AI. Those depend on the victim knowing and saying AI was involved, so they are lower bounds with no earlier baseline. Source (no chart here draws it: the series it changes is not charted here, or not across that date)