Artificial intelligence is reducing the cost and complexity of cybercrime, helping attackers automate reconnaissance, improve phishing, adapt campaigns and analyze vulnerabilities more quickly. At the same time, many organizations still rely on decision-making processes, governance layers, patching cycles and manual controls designed for a slower environment.
That creates a growing asymmetry.
For business leaders, the question is no longer simply whether the organization has the right security technologies in place. It is whether it can recognize risk, make decisions and act quickly enough when the environment changes.
The goal therefore cannot be perfect prevention. It has to be resilience: knowing what matters most, detecting threats early, containing disruption and recovering quickly enough to keep the business operating.
Cybersecurity is becoming a speed problem
Many of today’s cyber threats are familiar. Ransomware, phishing, credential theft, social engineering and vulnerability exploitation have existed for years.
What is changing is the speed, scale and ease with which those techniques can now be used.
NTT DATA’s Cyber Threat Intelligence analysis shows that attackers are increasingly combining known techniques with greater automation, speed and sophistication. Around 16% of recorded incidents in 2025 already involved some use of AI by attackers, particularly in phishing, impersonation, and campaign automation.
The significance is not that AI has created an entirely new category of cybercrime. It is that it changes the economics of attack.
Tasks that once required more time, specialist knowledge or manual effort can increasingly be performed faster and at greater scale.
Kim Boermans sees this acceleration as a fundamental change in the threat landscape. The time between identifying a vulnerability, exploiting it and causing damage can now compress from months to days or even hours.
NTT DATA’s breach-simulation work shows how quickly this speed gap can translate into real exposure. In one simulation against a Fortune 500 company, lateral movement through 11 hosts, privilege escalation and domain trust abuse were completed in under four hours without detection.
For executives, that is the real issue. The question is not whether security controls exist, but whether they can recognize and respond to attacker behavior quickly enough.
“The assumption that we can prevent every incident is no longer realistic. The strategic question is how quickly we can detect, contain and recover — while protecting the assets that matter most.” — Kim Boermans
This is why the next phase of cybersecurity is not simply about stronger defense. It is about faster, more intelligent defense.
In Kim Boermans’ view, organizations increasingly need to defend at machine speed when attackers are already operating that way. AI and automation can help identify vulnerabilities earlier, detect suspicious behavior faster and accelerate remediation.
But speed alone is not enough.
A 2025 study cited in NTT DATA’s 2026 Cyber Frontiers report found that false positives account for 25% of security teams’ workload, while 70% of professionals reported alert-related burnout.
More alerts do not automatically mean better security. The real objective is to identify what matters most and act on it before it becomes a business incident.
Trust is becoming part of the attack surface
The second major shift is less visible, but just as important.
Attackers increasingly do not need to break through a technical perimeter. They can use legitimate identities, trusted credentials and approved services.
NTT DATA’s analysis shows growing abuse of session cookies, access tokens, valid credentials and legitimate cloud services, making malicious behavior harder to distinguish from normal business activity.
This changes the nature of the problem.
The next cybersecurity battle may not only be about stopping malicious software. It may be about deciding whether an apparently legitimate action should be trusted.
Is the employee requesting access really that employee? Is the supplier behaving as expected? Can an organization trust an email, voice or video when AI-generated content is becoming increasingly convincing?
NTT DATA’s 2026 Cyber Frontiers research identifies a growing blind spot: deepfakes and synthetic media increasingly target human trust rather than technical systems.
That makes trust itself part of the attack surface.
Cybersecurity therefore extends into areas that were once treated separately: fraud, identity management, supplier risk, employee behavior, customer experience and brand reputation.
The ecosystem matters too. While phishing accounted for around 16% of breaches, third-party compromise was already close behind at approximately 15%.
An organization can be well protected internally and still be exposed through a cloud provider, software dependency, supplier or partner.
For executives, cyber risk increasingly has to be managed across the wider business ecosystem, not only inside the company’s own infrastructure.
Ransomware is evolving into a broader business threat
Ransomware remains one of the clearest examples of how cybercrime is maturing.
According to NTT DATA’s Cyber Threat Intelligence analysis, ransomware was involved in approximately 44% of recorded security breaches in 2025, compared with around 32% in 2024.
But the bigger issue is how the model itself is evolving.
Ransomware is increasingly moving beyond encryption into data theft, extortion, reputational pressure and operational disruption. Attackers can monetize an intrusion even without shutting down an organization completely.
That has a direct implication for resilience.
Backups remain essential, but restoring systems is not enough if sensitive data has already been stolen, customers need to be informed or trust has been damaged.
Cyber resilience therefore has to address the full business impact of an incident, not only technical recovery.
The board conversation needs to change
Cybersecurity budgets continue to rise, but budget alone is not a strategy.
Kim Boermans argues that cybersecurity investment should start with risk appetite and business criticality: identifying which systems, services, data and capabilities matter most, and directing investment accordingly.
Instead of asking:
How much are we spending on cybersecurity?
the more useful question is:
Are we spending on the risks that could hurt the business most?
That means understanding which services must remain available, which systems are critical, where third-party dependencies sit and how quickly essential operations can be restored.
These are no longer just IT questions. They are enterprise risk questions.
Resilience also needs to be tested, not assumed.
In one NTT DATA breach-simulation exercise, a simulated attack lasted 13 days and affected more than 60 internal systems. Despite multiple defense layers, detection only occurred after a simulated impact was triggered.
That gap between assumed readiness and actual readiness is precisely why organizations need to test how they would respond before a real incident occurs.
Cyber risk management cannot stand still
The threat environment is changing faster than many risk-management processes.
Elsa Llacera argues that organizations cannot simply repeat the same approach year after year when the nature of cyber risk is evolving so quickly.
“The risk landscape is changing too quickly to manage cybersecurity the same way year after year. Organizations need to reassess where the real exposure is and direct investment accordingly.” — Elsa Llacera
That means cyber risk needs to be reassessed continuously.
Changes in cloud adoption, AI usage, supplier relationships, technology and business models can alter an organization’s exposure in a relatively short period of time.
A static risk model is increasingly incompatible with a dynamic threat environment.
Resilience has measurable business value
There is also an economic dimension to this shift.
Cyber resilience is not only about reducing the probability of an incident. It is about reducing the cost and duration of disruption when something does happen.
NTT DATA’s analysis indicates that organizations using AI and automation in cyber defense achieved an average 34% reduction in incident-related costs.
That changes how cybersecurity investment can be viewed.
It is not simply defensive spending.
Done well, it strengthens the organization’s ability to absorb disruption, restore operations and protect business performance.
The shift in cybersecurity
The cyber landscape ahead may not be defined by completely new forms of attack. It is more likely to be shaped by familiar techniques becoming faster, quieter, more persistent and easier to scale.
NTT DATA expects greater abuse of identities and trusted relationships, continued use of AI as an accelerator, more persistent intrusions and sustained pressure on critical sectors and supply chains.
For business leaders, the implication is clear.
The objective should not be to build an organization that believes it can prevent every cyber incident.
It should be to build one that knows where its greatest risks lie, protects what matters most, makes decisions quickly and can continue operating when disruption occurs.
Cybersecurity is no longer only about protection. It is becoming a test of how quickly and confidently an organization can respond under pressure.
And organizations that build that capability will not simply be more secure.
They will be more resilient, more trusted and better prepared to compete in an increasingly digital and uncertain environment.