Reported by Weng Patrick Atokor l Journalist at Weng Global
Businesses are facing growing cybersecurity risks as criminals increasingly exploit artificial intelligence (AI) to launch sophisticated attacks, impersonate senior executives and carry out digital fraud, raising concerns about the ability of organisations to protect their systems, employees and sensitive information.
The warning comes amid the rapid adoption of AI across business operations, where technologies designed to improve productivity and efficiency are also creating new opportunities for cybercriminals.
Among the emerging threats are AI-generated deepfake videos, cloned voices, sophisticated phishing messages and fraudulent communications designed to convince employees that they are receiving legitimate instructions from company executives, business partners or trusted organisations.
The growing threat highlights the need for businesses to strengthen cybersecurity policies, improve employee awareness and introduce more reliable verification procedures for sensitive transactions and confidential information.
AI Adoption Outpaces Cybersecurity Preparedness
New research published by ISACA on 22 September 2026 highlights significant weaknesses in how organisations prepare for security incidents involving artificial intelligence.
According to the organisation’s 2026 State of Cybersecurity survey, only 8 per cent of organisations regularly conduct AI-specific incident response exercises.
The research also found that 64 per cent of enterprises had not conducted any AI-related incident response exercises. These exercises are designed to prepare organisations for situations involving sensitive information exposure through AI systems, AI-enabled phishing, fraud, social engineering and the misuse of generative AI by employees.
ISACA also reported that 48 per cent of respondents either did not know whether their organisations had established AI incident response playbooks or said such plans did not exist.
The findings suggest that many businesses are incorporating artificial intelligence into their operations without developing adequate procedures to manage the security risks associated with the technology.
Jon Brandt, ISACA’s Senior Director of Professional Practices and Innovation, said organisations needed to match their adoption of AI with stronger response planning, workforce readiness and appropriate technical skills.
The survey also found that 51 per cent of cybersecurity professionals were involved in developing, onboarding or implementing AI solutions within their organisations, demonstrating how quickly the technology is becoming part of corporate security operations.
Deepfake Technology Creates New Opportunities for Digital Fraud
One of the most concerning developments in AI-powered cybercrime is the growing use of deepfake technology to impersonate individuals.
Deepfakes use artificial intelligence to generate or manipulate audio, images and videos to make someone appear to say or do something they never actually did.
For businesses, this technology creates opportunities for criminals to impersonate chief executives, finance directors, senior managers, suppliers and other trusted individuals.
A criminal could, for example, use a cloned executive voice during a telephone conversation to instruct an employee to transfer company funds or disclose confidential information.
In other cases, fraudsters can use manipulated video calls and convincing digital identities to establish trust before requesting financial transactions or access to internal systems.
The danger is that employees may receive communications that appear genuine, making traditional warning signs such as poor grammar, unusual wording and suspicious email formats less reliable.
Research published by Gartner on 22 September 2026 reinforces these concerns.
The organisation found that 41 per cent of surveyed chief information security officers reported at least one social engineering incident involving a deepfake during an employee audio call in the preceding 12 months. Another 36 per cent reported an incident involving a deepfake during a video call.
The findings demonstrate the growing importance of identity verification in corporate communications.
AI-Powered Phishing Attacks Become More Difficult to Detect
Phishing remains a major cybersecurity concern, but artificial intelligence is changing how criminals develop and distribute fraudulent messages.
Traditionally, phishing attacks often relied on generic emails containing suspicious links, spelling mistakes or obvious attempts to obtain passwords and financial information.
AI tools can now help criminals produce more convincing messages tailored to specific individuals, organisations and professional environments.
By analysing publicly available information, attackers can create communications that reference employees’ responsibilities, business relationships, ongoing projects and familiar organisational procedures.
This can make fraudulent messages appear more credible, particularly when they are designed to imitate trusted colleagues or business partners.
ISACA’s June 2026 AI Pulse Poll found that 71 per cent of surveyed professionals said AI-powered phishing and social engineering attacks had become more difficult to identify.
The research also found that 58 per cent said artificial intelligence had made it significantly harder to authenticate digital information.
These developments are particularly concerning for organisations that depend heavily on email, digital payments, remote communication and online customer services.
Cybersecurity Teams Face Growing Pressure
The rising complexity of cyber threats is also increasing pressure on cybersecurity professionals responsible for protecting corporate infrastructure.
ISACA’s September 2026 research found that 68 per cent of respondents said their jobs had become more stressful over the previous five years.
The increasingly complex threat landscape was identified as the leading source of stress, cited by 71 per cent of respondents.
The survey further found that 58 per cent of organisations believed their cybersecurity teams were understaffed, while 55 per cent reported difficulties retaining qualified cybersecurity professionals.
These workforce challenges could make it more difficult for organisations to respond effectively to increasingly sophisticated attacks.
Cybersecurity teams must now manage conventional threats such as ransomware, data breaches and unauthorised access while also addressing risks associated with generative AI, automated attacks and synthetic identities.
The situation places additional importance on professional training, recruitment and investment in modern security infrastructure.
Businesses Urged to Strengthen AI Security Measures
As artificial intelligence becomes more deeply integrated into business operations, cybersecurity experts and regulatory organisations are emphasising the importance of stronger security controls.
The Information Commissioner’s Office (ICO) in the United Kingdom published guidance in May 2026 outlining several measures organisations should consider when addressing AI-powered cyber threats.
These include:
- Strengthening identity verification: Businesses should establish reliable procedures for confirming the identity of individuals making sensitive requests.
- Improving employee training: Workers should understand how deepfakes, phishing and AI-generated impersonation can be used to facilitate fraud.
- Protecting sensitive information: Organisations should restrict access to confidential data and monitor how employees use AI systems.
- Updating security infrastructure: Companies should regularly update software, address system vulnerabilities and strengthen access controls.
- Improving incident response: Businesses should develop clear procedures for identifying, reporting and responding to AI-related security incidents.
- Introducing additional financial safeguards: High-value transactions should require independent verification and appropriate authorisation.
These measures are particularly important for financial institutions, telecommunications companies, government agencies, technology businesses and organisations handling large volumes of customer information.
AI Is Also Becoming an Important Cybersecurity Defence Tool
Although artificial intelligence is creating new opportunities for cybercriminals, it is also becoming an important tool for defending organisations against digital attacks.
Businesses are increasingly using AI-powered systems to identify unusual network activity, detect suspicious transactions, monitor potential security breaches and automate aspects of incident response.
ISACA’s 2026 State of Cybersecurity research found that 41 per cent of respondents whose organisations use AI in cybersecurity operations rely on it to automate threat detection and response.
Another 40 per cent use AI to automate routine security tasks, while 33 per cent use it for endpoint security.
This demonstrates that artificial intelligence is not exclusively a security risk. Its effectiveness depends partly on how responsibly organisations deploy, monitor and govern the technology.
However, businesses must avoid relying entirely on automated systems. Human oversight remains important, particularly when investigating suspicious activity, approving financial transactions and making decisions involving confidential information.
Why the Warning Matters for African Businesses
The growing use of AI-powered cyberattacks has implications beyond major international corporations.
African businesses are increasingly dependent on digital payment systems, mobile banking, cloud-based services, e-commerce platforms and online communication tools.
This digital transformation creates opportunities for economic growth, but it also increases the importance of protecting digital infrastructure.
Small and medium-sized enterprises may face particular difficulties because they often operate with limited cybersecurity budgets and fewer specialised personnel.
A successful attack could expose customer information, disrupt business operations, compromise financial accounts or damage public confidence in an organisation.
For businesses operating in Nigeria, Kenya and other African markets, the growing use of digital financial services makes reliable identity verification and fraud prevention especially important.
The challenge is not simply acquiring sophisticated cybersecurity software. Organisations must also establish clear internal policies, educate employees and ensure that sensitive decisions cannot be authorised solely through an unverified email, telephone call or video conference.
African companies also need to consider the security implications of adopting third-party AI platforms, particularly where employees enter confidential business information into external applications.
What Happens Next?
The growing threat of AI-enabled cybercrime is expected to keep cybersecurity, digital identity protection and AI governance high on the agenda for businesses and technology regulators.
ISACA’s research highlights the need for organisations to move beyond general cybersecurity training and develop specific response plans for incidents involving artificial intelligence.
Businesses will also need to invest in professional development, strengthen internal security procedures and regularly test their ability to respond to emerging threats.
As AI technology continues to develop, the relationship between cybersecurity and artificial intelligence will become increasingly important to corporate governance and business continuity.
The central challenge for organisations is ensuring that the adoption of AI does not move faster than their ability to manage its risks.
For businesses, protecting digital assets will increasingly require a combination of advanced technology, trained personnel, effective governance and reliable human verification.
Weng Global – Stories beyond borders
Sources
- ISACA – Only 8 Percent of Organizations Conduct Regular AI-Specific Response Exercises (22 September 2026).
- ISACA – A Third of European Organisations Don’t Know if They’ve Been Hit by an AI-Powered Cyberattack (17 June 2026).
- Gartner – 41% of CISOs Reported Deepfake-Related Social Engineering Incidents (22 September 2026).
- UK Information Commissioner’s Office – Five Steps to Protect Your Organisation from AI-Powered Cyber Threats.
- Reuters – AI Sharpens Cat-and-Mouse Hacking Battle as Companies Strengthen Defences (5 November 2026).
