While headlines scream about the security threats associated with AI, security professionals tend to see AI as more of an ally—while still recognizing the potential threat. A recent survey found that 59% of IT security managers see the use of AI growing in security tools as helping them more than they see AI as a threat they must better defend against.

They’re not wrong. “AI improves anomaly detection to help cut down alert fatigue from false positives and ensure that security staff spends more time on actual threats. Additionally, AI models protect companies from dangers such as malware and DNS attacks by analyzing vast amounts of data and evolving along with the latest threats,” said Zach Capers, senior analyst at GetApp.

Advanced Phishing Attacks

Still, in the year ahead, 38% of security managers reported being most concerned about AI-enhanced attacks, according to GetApp’s fifth annual data security report: U.S. Businesses Gaining Ground Amid Ongoing Threats. Such an attack, according to Capers, uses AI to optimize, automate or obscure a cyberattack. Examples include enhanced detection evasion, improved malware performance and more effective phishing messages. However, 43% of respondents said that advanced phishing attacks are the most concerning threat for the year ahead. Concerns about advanced ransomware attacks, software supply chain attacks and business email compromise (BEC) attacks followed.

Concerns around AI-enhanced attacks and advanced phishing attacks aren’t necessarily unrelated, as AI can be used to craft more convincing, personal messages that are also more difficult to detect. “Attackers are already using generative AI models and could already be using AI and a few minutes of a CEO speaking to generate deepfake videos,” said John Pescatore, director of emerging security trends at SANS Institute.

Taking Cybersecurity More Seriously

The survey also found U.S. businesses are taking cybersecurity more seriously than in previous years. Notably, 70% of respondents cited an increase in security spending. That’s up considerably from the 63% who said budgets were rising a year ago. Only 1% of respondents said their security budgets fell this year.

More encouraging news includes the rising number of organizations that have put into place the ability to report a suspected cyberattack to the security team, reaching 94% this year, up from 77% in 2021. Also, 93% of organizations have an incident response plan, up from 67% in 2021.

“A rise in the volume and severity of cyberattacks over the last several years, particularly following the pandemic when a host of new vulnerabilities opened up due to rising digitization and remote work, means that most businesses have now experienced a significant cyberattack and learned some lessons. Moving forward, more businesses will be better prepared, and fewer will be caught flat-footed,” said Capers.

The report also found the number of reported employees having clicked on a phishing email dropped from 81% to 61% year over year.

Attackers aren’t dissuaded; they turn to newer communication channels for their activity. “Our 2022 SMS Scams Survey by sister site Capterra found that 74% of employees had received a suspicious SMS message in the previous 30 days,” said Capers. “Fifty percent of the HR professionals surveyed said their company had encountered new-hire phishing scams, which often take place over social media sites such as LinkedIn,” he said.

Conducted in August 2023, GetApp’s 2023 Data Security Survey surveyed 872 full-time U.S.-based employees, with 362 respondents identifying as IT management professionals and 271 identifying as IT security managers.