AI Is Giving Hackers a Dangerous New Advantage

Artificial intelligence is rapidly changing the economics of cybercrime, giving attackers the ability to find vulnerabilities, automate attacks and operate at a scale that could leave smaller hospitals, banks, retailers and nonprofits struggling to defend themselves.

How Is AI Changing the Scale of Cyberattacks?

AI agents have become increasingly capable at cybersecurity and coding tasks and can be deployed at enormous scale. This changes a constraint that once limited cybercriminals: the number of skilled human hackers available to carry out attacks.

Work that might previously have required a team of sophisticated attackers can increasingly be carried out by a single individual using agentic systems.

The concern is particularly serious for smaller organisations that lack dedicated security teams and large technology budgets. The previous limiting factor was the finite number of malicious hackers available to conduct attacks, but AI could weaken that constraint by allowing individuals to automate and expand their operations.

Are AI Systems Already Being Used in Cybercrime?

A sophisticated cybercrime operation in August 2025 reportedly used an AI coding tool to extort data from healthcare organisations, emergency services, religious institutions and government entities within a single month.

AI tools can help attackers find vulnerabilities, exploit them and automate parts of an operation. Even people with limited knowledge of artificial intelligence can use automated systems, while experienced hackers can broaden the number of potential targets they pursue.

At the same time, AI is being developed as a defensive tool capable of identifying vulnerabilities. However, access to some of the most powerful cybersecurity models remains restricted because the same capabilities designed to uncover security weaknesses could potentially be misused.

Why Are Smaller Organisations More Exposed?

Smaller businesses, nonprofits, healthcare providers and local financial institutions often do not have the resources for round-the-clock cybersecurity teams or dedicated IT staff constantly searching for unknown threats.

One Alabama-based nonprofit began receiving calls in March about suspicious activity involving companies connected with the organisation. Its third-party IT team took systems offline for three days while investigating and addressing a vulnerability.

The incident left the organisation with a bill of about $5,000. It was unclear whether the attack had been conducted entirely by a human hacker, assisted by AI, or involved no AI at all.

For organisations operating with limited budgets, even the cost of investigating an incident and strengthening systems afterwards can create significant financial pressure.

Can Rapid AI Adoption Create New Security Gaps?

Businesses are also rapidly adopting AI internally, creating another cybersecurity concern. Organisations introducing unfamiliar AI tools may not immediately establish appropriate security practices around their use.

Employees encouraged to find ways to use AI and improve efficiency can adopt tools quickly, while security controls, infrastructure and internal processes may be introduced only afterwards.

Once AI systems become deeply embedded in everyday operations, establishing effective controls can become considerably more difficult.

FCRF Launches CP-FRM to Build India’s Next Generation of Fraud Risk Professionals

Why Are Hospitals Particularly Vulnerable?

Healthcare faces unusually high stakes because a cyberattack can disrupt both information systems and patient care.

In May 2021, a ransomware attack forced a California-based medical provider to shut down key operations, affecting appointment and surgery scheduling. A 2024 study cited in the report found that healthcare faced the second-highest global cyberattack rate behind governments, while initial ransom demands were often upwards of $4 million.

Hospitals must protect not only their technology infrastructure but also sensitive information belonging to patients.

Ransomware can create particularly severe pressure because hospitals cannot simply stop operating for extended periods. Medical facilities rely on digital systems for patient histories, allergies, medications and other information required for treatment.

Cyberattacks against these systems can therefore create consequences extending far beyond financial losses.

What Other Businesses Are Facing Cyber Threats?

The risks extend beyond healthcare. A Maryland grocery cooperative faced so-called “carting attacks”, in which hackers used its online shopping platform to test thousands of stolen credit cards.

Even when almost all attempted transactions were declined, processing fees could still amount to thousands of dollars within a short period. The cooperative subsequently introduced additional precautions and added an IT liability policy to its business insurance.

Small businesses increasingly depend on email, collaboration, procurement and delivery platforms to operate. Disruption of these systems can make it difficult for organisations with limited staff and resources to continue normal operations.

AI can help smaller companies improve efficiency, but increased dependence on digital tools can also expand the number of systems that need to be secured.

Could AI Widen the Cybersecurity Divide?

Large technology companies can invest heavily in advanced AI-based cyber defences, while smaller organisations may struggle to afford comparable protection.

The imbalance could allow individual attackers equipped with powerful AI models to cause serious damage to organisations with comparatively weak defences.

AI can also help attackers identify vulnerabilities and support techniques such as voice phishing, making it easier to exploit weaknesses and target organisations beyond the traditional reach of sophisticated hacking groups.

The concern is that AI may not simply make existing hackers faster. It could increase the number of people capable of launching effective attacks while allowing individual attackers to pursue far more targets.

The420 Insight

The emerging risk is a widening gap between the scale of AI-assisted attacks and the ability of smaller organisations to defend themselves. As offensive capabilities become easier to automate, hospitals, local businesses and other resource-constrained institutions could face threats previously associated with far more sophisticated attackers.

About the author — Ayesha Aayat writes on cybercrime, digital safety, and emerging online threats. Her work focuses on public awareness, legal clarity, and technology-driven risks.