AI is helping cybercriminals scale and sharpen familiar tactics—especially phishing, social engineering, reconnaissance and fraud—rather than replacing them with entirely new kinds of attacks. Companies should focus on the systems and identities most critical to their operations, then strengthen the controls most relevant to the threats those assets face.
How AI is changing the threat
In remarks reported by CNBC on October 2, 2026, INTERPOL global chief information security officer Bjorn R. Watne described AI as “an evolution and not a revolution.” Its near-term value to criminals is often practical: less effort to prepare an attack, more convincing messages, and the ability to target more people at once.
As an Amazon Associate I earn from qualifying purchases.
More convincing messages and identities
AI tools can improve translation and help scammers tailor messages to different targets. That can make fraudulent requests harder to spot by relying on familiar signs such as awkward wording or obvious inconsistencies. INTERPOL’s African Cyberthreat Assessment Report 2026 also describes deepfake-facilitated sextortion and synthetic identities built from a mix of real personal data and fabricated details.
Faster preparation and broader reach
AI can assist with reconnaissance, social engineering, scripting, troubleshooting and extortion. Palo Alto Networks Unit 42 says its investigations of incidents handled in 2025 found AI reducing friction in these activities. The UK National Cyber Security Centre has likewise assessed that AI can improve reconnaissance and social engineering, while stressing that capability gains vary among threat actors. Its near-term projections were written against a horizon beginning in 2023, so they should be read as earlier analysis, not a new forecast for 2026.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
Harder-to-spot access and activity
Not every intrusion arrives as a conspicuously artificial message. Criminals can use stolen credentials or session tokens to access legitimate accounts, then blend into routine activity. Unit 42 also identifies risks involving excessive permissions, internal AI assistants, trusted software-as-a-service integrations and third-party tools. In these cases, the challenge is not simply recognizing AI-generated content; it is noticing misuse of access that looks valid on the surface.
What the available statistics do—and do not—show
The figures below come from different sources and populations. They describe regional reporting or one security vendor’s investigations, not a single comparable global dataset.
- Africa: INTERPOL’s 2026 assessment, drawing on survey data from 36 African member countries, says AI is enabling 55% of reported cybercrimes across Africa. INTERPOL’s August 2026 announcement also says cybercrime-related losses in Africa rose from USD 192 million to USD 484 million since 2024. These are regional figures, not estimates of the share or cost of cybercrime worldwide.
- Unit 42 investigations: Palo Alto Networks says 87% of more than 750 incident-response engagements involving cases handled in 2025 included activity across multiple attack surfaces. Its report says nearly 90% of its investigations had material identity weaknesses and that identity-based techniques drove 65% of initial access in its case data.
- Cloud permissions: Unit 42 reports that 99% of more than 680,000 cloud identities it examined had excessive permissions; some permissions had gone unused for at least 60 days. That analysis is not established as a representative sample of all cloud identities.
Unit 42’s numbers are useful as warnings about patterns its responders encountered, not as universal incident rates. INTERPOL’s assessment offers a regional view of Africa; its examples include mobile money fraud and infrastructure-targeted ransomware in East Africa, business email compromise and romance scams in Central and West Africa, and threat activity in highly connected Southern Africa. The sources illuminate different risks but should not be treated as directly comparable measurements.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
What companies should watch for
Impersonation that bypasses familiar red flags
Train employees to verify the request and the requester, not just look for spelling mistakes or strange phrasing. A polished message, plausible voice or convincing digital identity is not proof that a request is genuine.
Unexpected use of valid accounts, tokens or integrations
Monitor unusual sign-ins and changes in account behavior, as well as the use of service accounts, API tokens, cloud permissions and trusted integrations. Review whether accounts and machine identities have access they no longer need.
AI tools handling sensitive information or taking actions
Internal assistants can expose operational context if compromised or misused. Keep visibility into model and API activity, sensitive prompts, tokens and service-account permissions. Where an AI system can take actions, define what it is allowed to do and how those actions are checked.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
Threats to the assets that matter most
Begin with critical business systems and data, then consider which actors would have reason to steal, disrupt or extort the organization. An opportunistic criminal and a sophisticated persistent threat actor may require different priorities. Watne cautioned against trying to defend everything at once when an organization is not being targeted by a particular threat; threat intelligence can help focus effort on the tactics most relevant to the business.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Practical priorities for reducing risk
Strengthen high-value identities
- Use phishing-resistant MFA, such as FIDO2/WebAuthn hardware security keys or passkeys, for administrator, executive and other high-value accounts. Check compatibility with the organization’s identity provider and maintain a secure account-recovery process.
- Reduce standing administrator access and review permissions for people, service accounts, cloud identities and machine identities. Remove access that is unnecessary or unused.
- Protect credentials and tokens, and investigate unexpected access even when the account involved belongs to a legitimate employee or service.
Verify sensitive requests independently
For wire transfers, credential resets, remote hiring and other high-impact requests, confirm through a separate, trusted channel. Do not rely on the apparent identity or fluency of the message, or on an approval reply in the same conversation.
Reduce exposure and prepare to contain incidents
- Prioritize rapid patching of critical vulnerabilities on internet-facing systems.
- Bring together visibility across identity, cloud, endpoints, networks, SaaS and third-party access so an incident can be followed across systems rather than treated as an isolated alert.
- Plan how to quickly revoke credentials and tokens, disable compromised integrations, limit access and contain affected systems.
These measures are recommendations from Unit 42’s incident-response report, not guarantees against compromise. Their value depends on how well they fit the organization’s systems, access model and most likely threats.
Why agentic AI raises a separate concern
AI that takes actions, rather than only generating information, creates a different kind of risk: a mistaken or manipulated action may have consequences beyond a misleading answer. Watne specifically raised concern about AI systems acting incorrectly in physical domains, citing the growing use of AI in vehicles and self-driving vehicles. This is a warning about potential consequences, not evidence that a particular cyberattack has caused physical harm.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
