“TRUST STARTS & ENDS WITH THE TRUTH”
“TRUST STARTS & ENDS WITH THE TRUTH”
Matt is both the company founder and a nationally renowned private investigator. Matt is an intelligence specialist who excels in detecting and preventing the illegal interception of communications and in providing high-tech covert surveillance. Matt has years of hands on experience in the investigation industry and has developed a reputation for incorporating state of the art technology and innovative ideas to provide effective solutions for his clients. Matt also serves as Treasurer for the Executive Board of Directors of FALI, The Florida Association of Licensed Investigators.
The AI cybersecurity trends of 2026 are deepfake impersonation fraud, AI-built software exploits, autonomous attack agents, shadow AI, and delayed regulation. Analysts forecast all five in late 2025. Our Orlando investigators checked six of those forecasts against data the FBI, IBM, and Google have published since. Four are confirmed, one is still early, and one is mixed.
The AI cybersecurity trends of 2026 fall into six areas: impersonation fraud, agentic AI, AI-assisted vulnerability discovery, shadow AI, regulation, and AI inside security operations. Each one was a published forecast from Gartner, IBM, Darktrace, or SentinelOne. The table grades each forecast against data released during the year.
| The 2026 prediction | Who made it | What the data shows |
|---|---|---|
| Deepfakes and AI impersonation drive fraud | IBM, SentinelOne | Confirmed. One in four malicious breaches was AI-enabled, at $6 million on average. |
| Agentic AI becomes a security risk | Gartner, Darktrace, IBM | Early. Malware that takes instructions from a language model is documented, in a small number of cases. |
| AI speeds up vulnerability discovery | Darktrace | Confirmed. One AI-assisted zero-day exploit reported, and a 44% rise in attacks on public-facing applications. |
| Shadow AI exposes company data | IBM, Gartner, SentinelOne | Confirmed. Over 57% of employees use personal AI accounts for work. |
| Regulation tightens | Gartner, SentinelOne | Mixed. EU high-risk rules moved to December 2, 2027, and the NIST profile is still a draft. |
| AI reshapes security operations | Gartner | Confirmed where adopted. Security AI cut breach costs by almost $2 million. |
Readers new to the topic should know that AI changes the speed and cost of an attack far more than it changes the goal, which is still money, credentials, or pressure on a person.
AI-driven fraud grew, and both the FBI and IBM published numbers that show it. The FBI’s Internet Crime Complaint Center recorded 22,364 complaints involving AI and $893,346,472 in reported losses for 2025, in a report released this year. Investment fraud made up $632,041,188 of that total. Victims aged 60 and over reported $352,496,231.
IBM measured the same shift inside companies. Its 2026 Cost of a Data Breach study, conducted by the Ponemon Institute across 602 organizations, found that one in four malicious breaches was AI-enabled. Those breaches cost $6 million on average, against a global average of $4.99 million, and their number rose 56% over the prior year.
Neither source separates deepfakes from other AI-assisted fraud. The FBI figure counts complaints that contained AI-related information, so a victim who never realized a voice was cloned would have no reason to mention it.
Florida sits near the top of the FBI’s list. Residents filed 71,843 complaints across all crime types in 2025, the third-highest total of any state.
Business email compromise, the vendor-invoice and wire-change scam, accounted for $30,256,592 of the AI-related losses, and AI phishing attacks are how those requests reach an inbox.
AI agents are running parts of real attacks, although the documented cases are still few. Forecasters used “agentic AI” for two different risks, and the data on each looks different.
The first risk is attackers using agents. Google Threat Intelligence Group reported in May 2026 on an Android backdoor called PROMPTSPY that contains an agent module. The malware sends a description of the phone’s screen to a language model and acts on the reply, without a person directing each step. Google’s report also describes agents used against Japanese technology firms for automated reconnaissance.
The second risk is the agents a company deploys itself. Gartner and Darktrace both warned that an agent with broad access behaves like an insider. IBM’s 2026 study found that more than 20% of organizations reported a breach targeting AI models or applications.
Agents so far show up on the systems side of AI-generated cyber attacks, in malware and reconnaissance, while fraud aimed at people still runs on impersonation.
Agentic AI in cybersecurity is software that plans and carries out a sequence of steps toward a goal with limited human direction. Attackers use agents to scan for weaknesses and operate malware. Defenders use them to sort alerts. Companies also create risk when their own agents hold broad access to data and accounts.
The 2026 data shows AI helping attackers find software flaws, and it does not yet measure whether patching is keeping up. IBM’s X-Force team recorded a 44% increase in attacks that began with a public-facing application. IBM attributes the rise largely to missing authentication controls and AI-enabled vulnerability discovery. Vulnerability exploitation was the leading cause of the incidents X-Force observed in 2025, at 40%.
Google’s May 2026 report added a milestone. Its analysts found a zero-day exploit, a bypass of two-factor authentication in a web-based administration tool, and concluded with high confidence that the attacker used an AI model to find and weaponize the flaw.
IBM’s wording matters here, because missing authentication controls came first on its list. A burglar who once tried one door a night can now try every door on the street in an hour, and the doors left open were open all along.
A company that has never mapped its internet-facing systems can start with a risk and vulnerability assessment, which lists what is exposed and which fixes come first.
Shadow AI is now a majority habit among employees. A 2025 Gartner survey found that over 57% of employees use personal GenAI accounts for work, and 33% admit entering sensitive information into unapproved tools.
Stolen logins add a second problem. IBM X-Force counted over 300,000 ChatGPT credentials exposed by infostealer malware during 2025. Anyone holding one of those logins can read whatever the account owner typed.
Consider a paralegal who pastes a client’s settlement terms into a free chatbot to tighten the wording. The firm was never attacked, and the terms now sit on a server the firm does not control.
Leaks through people and devices are the subject of an insider threat audit, which reviews who has access to sensitive communications and how those channels are secured.
Shadow AI is the use of AI tools at work without approval from the employer’s IT or security team. Free chatbots, browser extensions, and AI note-takers are common examples. Company and client data leaves through a channel the company does not monitor, which is how a harmless shortcut turns into a data exposure.
A recording or a message no longer proves who sent it, so the original file has become the most important piece of evidence in an AI-enabled incident.
Take a hypothetical Orlando title company. The office manager gets a voicemail in the owner’s voice asking her to release a wire early. She plays it for a coworker, forwards it to her personal phone, and deletes the original to clear her inbox.
Forwarding a suspect file is like photocopying a signed check. The image survives, and the ink a lab would test is gone.
Our AI threat investigations work from the original file. The methods are frame-by-frame video inspection, audio waveform and cadence analysis, metadata and file history review, and comparison with verified recordings of the real person.
Recommended:
When a file may end up in front of a judge, digital forensics services document how the evidence was collected and handled.
Not sure whether a recording, email, or video you received is real?
Our investigators examine the original file and report what the evidence shows.
See how an AI threat investigation works
Confidential and without obligation.
AI regulation moved slower in 2026 than forecasters expected. The European Union moved its deadline for high-risk AI systems to December 2, 2027 through Regulation (EU) 2026/1744, adopted on July 8, 2026. The original date was August 2, 2026. AI built into regulated products now has until August 2, 2028.
One EU rule kept its date. The requirement to mark AI-generated audio, images, video, and text still applied from August 2, 2026, with a four-month transition for systems already on the market.
In the United States, the main federal reference point is still unfinished. NIST released its Cybersecurity Framework Profile for Artificial Intelligence as a preliminary draft on December 16, 2025, and the agency is reviewing public comments. The draft covers three areas: securing AI systems, conducting AI-enabled cyber defense, and thwarting AI-enabled cyberattacks.
Florida has its own statutes on AI-generated images and impersonation, covered in our guide to Florida’s deepfake laws.
The regulation section is general information for US readers and is not legal advice.
AI helps the defenders who have deployed it, and a quarter of organizations have not. IBM’s 2026 study found that security AI and automation cut breach costs by almost $2 million on average. The same study found that one in four organizations still had not adopted those tools.
Awareness is ahead of adoption. In the World Economic Forum’s Global Cybersecurity Outlook 2026, 94% of respondents named AI the most significant driver of change in cybersecurity. The share of organizations that assess the security of their AI tools rose from 37% in 2025 to 64% in 2026.
AI earns its keep at detection, and attribution is where AI still falls short in security, because naming the person behind an attack takes account records, device analysis, and testimony.
AI is changing cybersecurity jobs more than removing them. Automated tools sort alerts and flag anomalies faster than a person can. People still decide what an alert means, identify who is responsible, preserve evidence properly, and explain the findings to a client, an insurer, or a court.
AI-enabled fraud, shadow AI, and the regulatory calendar all carry into 2027, and the calendar is the only one with fixed dates.
Encryption is the quiet item on that list. IBM’s 2026 study found that 34% of organizations have visibility into their cryptographic assets.
For an individual or an executive, the practical starting point is knowing what is already exposed. A Digital Risk Profile maps leaked credentials, accounts, and photos across the surface web, deep web, and dark web.
The AI cybersecurity trends of 2026 were forecast in late 2025, and most of them held up. AI-enabled fraud is confirmed by FBI and IBM data, with one in four malicious breaches AI-enabled and $893 million in AI-related losses reported to the FBI for 2025. AI-assisted vulnerability discovery and shadow AI are confirmed too. Attack agents are documented and still rare. Regulation slowed, with the EU moving its high-risk deadline to December 2, 2027. For anyone who receives a suspicious recording or message, the original file is the evidence that counts.
Find out which of these risks apply to your business or your name.
Southern Recon Agency verifies suspect media, traces fraud, and documents the findings for your attorney.
Request a confidential consultation
Handled by a licensed Florida investigator, License A1400197. Call (844) 307-7771.
Measured by reported losses, AI-enabled fraud is the biggest threat. Investment fraud accounted for $632 million of the $893 million in AI-related losses reported to the FBI for 2025. Inside companies, IBM found that AI-enabled breaches cost $6 million on average, about $1 million above the global average for all breaches.
One in four malicious breaches was AI-enabled in IBM’s 2026 study of 602 organizations. In FBI data, 22,364 of the 1,008,597 complaints filed for 2025 contained AI-related information, which is about 2%. The FBI count depends on a victim or analyst recognizing that AI was involved.
Start by listing the AI tools employees already use and deciding which ones are approved for company or client data. Put that decision in a written policy. Then require a callback on a known number for any payment change or wire request, since AI-enabled fraud depends on someone acting without a second check.
Call your bank’s fraud line first if money moved, since speed affects whether funds can be frozen. Then file a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov. Keep the original messages, files, and transaction records, and report the account to the platform where the scam took place.
Matt Aubin is the Founder and Managing Partner of Southern Recon Agency, which he started in 2010. He is a Certified TSCM Technician, a Certified Digital Forensics Examiner, and a Florida Board Certified Investigator, and he is a court-qualified expert witness in cyber intelligence and cyber forensics. Matt is a member of the U.S. Secret Service Miami Electronic Crimes Task Force and FBI InfraGard Tampa.
The information in this article is general and is not legal advice. For help with a specific situation, talk to a licensed attorney in your state.