Cybercrime in the AI Era

An AI agent receives a goal, makes its own plan and acts using the systems it can access. Criminals are already putting such agents to work. In August 2025, an AI company described one attacker's extortion campaign against at least seventeen organisations: his agent found vulnerabilities, broke in, selected the most sensitive data and drafted the ransom demands. In November 2025, the same company reported an espionage campaign in which, by its own assessment, AI did most of the hands-on work and people stepped in only at a few decision points. In a scenario for 2040, one criminal directs dozens of agents that scout, break in and negotiate at thousands of targets at once. The pace of the attack then becomes the pace of the machine.

Almost everything secured online relies on encryption: mathematics that ordinary computers cannot practically crack. Quantum computers calculate differently. Once sufficiently large and stable, they could solve some of that mathematics quickly. Nobody knows exactly when; security agencies and researchers consider the next ten to fifteen years a possibility. Attackers are already collecting encrypted data to read later: research, negotiations and information that must remain secret for twenty years. Standards now exist for new encryption designed to withstand quantum computers, and governments and businesses have begun switching. The race is about which side will be ready first.

An increasing number of physical machines run on software and connect to the internet: warehouse robots, delivery drones, driverless cars, smart locks and medical devices. Researchers have already demonstrated remote takeovers of cars and vulnerabilities in medical devices. Next, these machines will coordinate and plan work together. In a 2040 scenario, delivery robots, vehicles and warehouse systems manage much of a city's logistics themselves. An attacker who takes over their shared controls could reroute deliveries or shut down an entire service. Extortion could then revolve around the machines a city relies on every day.

An AI-first organisation lets AI and new technology do the repetitive and predictive work, security included. AI reviews access rights, compares software versions and prepares the checks when part of the organisation connects a new system. Day and night, it searches millions of lines in log files, far faster than a person could. It notices a login at an unusual hour, for example, or data leaving the network unusually fast. The security team judges and chooses: what is a real attack, whether security or workability comes first, and what the board needs to know. When the organisation deploys agents of its own, the team decides which access to systems and data fits their tasks.

Security teams receive large numbers of alerts each day, often mostly noise. AI helps distinguish real threats. It learns normal network behaviour and flags anomalies: an account downloading large quantities of files in the middle of the night, or a supplier suddenly accessing systems it has no reason to enter. When an attack is clear, AI can block an account or disconnect a device within seconds. Where AI forms the first line of defence, it handles monitoring, sorting and investigating. Analysts judge uncertain cases and make major decisions. Next come defensive AI agents that independently track and contain attacks while people supervise.

AI changes the work of security teams. Existing roles gain new responsibilities, and new specialisms emerge: red teamers attack their own AI systems to find weaknesses before criminals do; specialists assess which AI applications are safe enough to deploy; supervisors of defensive AI agents decide what those agents may block independently. Analysts change too. AI sorts and investigates, while people choose, judge and intervene. Responsibilities extend beyond IT: finance teams need to recognise fake payment instructions, and HR needs to establish that a job applicant actually exists.

Digital security is now a board responsibility. Network and information security rules make board members in many organisations accountable for managing cyber risks; they must understand the risks themselves and oversee the actions taken. AI that acts independently adds another dimension. Once an organisation maps, process by process, which tasks AI carries out itself and where a person decides, its board also sets the permissions for systems that react faster than people: which data they see and what they may do alone. A defensive AI agent might block an account while an employee handles an urgent delivery. Digital security directly affects service and continuity, making it part of strategy.

Many attacks start with a person: a click, a phone call, a payment under pressure. That is why culture matters so much. An employee who immediately reports a mistaken click gives the security team time to act before serious damage occurs. Shame and silence give attackers time instead. A culture of reporting without blame turns each employee into a sensor. AI makes this role more significant by personalising attacks: a message about yesterday's project, or a leader's voice on the phone. Technology takes on some of the burden, for example through passkeys that will not work on a fake website. An alert colleague's judgement remains the final safety net.

A future academy makes practising with new AI applications part of the job. New applications sometimes change the work faster than training courses can update their programmes, and organisations do not wait for them. Existing staff learn there to work with AI and new technology and to recognise what can go wrong; new colleagues practise with situations in which an application gives a wrong answer. Leaders practise how to make decisions under pressure. Learning becomes a permanent part of the organisation.

Criminals may plan an attack in one country, carry it out in a second and collect the proceeds in a third. No organisation or country can stop it alone. A resilient organisation belongs to an ecosystem that crosses borders: sector information-sharing centres, computer emergency response teams connected worldwide, and security companies and researchers sharing new criminal tactics quickly. Europol and Interpol bring police, judicial authorities and businesses together to take criminal services offline. An international initiative by police and businesses gives ransomware victims free decryption keys to recover their files. Your organisation's resilience increasingly depends on the quality of its ecosystem.