AI Intensifies Cyber Warfare on Both Offense and Defense, Vulnerability Reports Triple Year-on

Cyberattacks targeting companies have rapidly intensified in both quality and quantity since the start of 2026. While attackers use artificial intelligence (AI) to automate the for intrusion routes and the exploitation of vulnerabilities, defenders have also moved to adopt AI-embedded monitoring and remediation systems, creating a landscape in which both sides are "arming themselves with AI." According to the Common Vulnerabilities and Exposures (CVE) list, an international registry of software vulnerabilities, the number of flaws reported in the third quarter of 2026 reached approximately 37,000, triple the figure for the same period a year earlier.

Markus Noga, chief technology officer (CTO) of German web hosting giant Ionos (roughly 7 million customers), said incidents of a scale that previously occurred every few months are now happening "every week, or every few days," suggesting that the burden on IT departments is approaching its limit. Marnie Wilking, chief security officer (CSO) at travel booking site Booking.com, described the contest with attackers as an "endless game of whack-a-mole," saying, "Even if you close off one route, the attackers have already moved on to the before the remediation is finished." The company currently has hundreds of engineers working on building AI-powered defense systems.

Ionos reviewed its security posture after a surge in vulnerabilities in July, shifting to an operation in which AI-based monitoring systems detect threats and AI-assisted tools are used to apply patches around the clock. "There are limits to what a team can do during working hours from 9 a.m. to 5 p.m., and that is no longer sufficient," Noga explained.

Refrigeration Equipment Attacks and Crypto Theft Cause Real-World Damage

The threat is not confined to the digital realm; it is hitting physical business operations directly. European supermarkets have been targeted twice in the past three weeks, with hackers raising the temperature of refrigeration and freezing equipment, forcing the disposal of food worth millions of dollars. In this week's attack, refrigeration equipment in 12 European countries was affected, and Dutch food retail giant Ahold Delhaize confirmed damage at some stores in Belgium and Luxembourg.

It was the company's second hacking incident in a month. In the first, in mid-October, the company detected an intrusion and shut down its website and app for a week. The incident caused more than €200 million (approximately $224.9 million) in lost sales, prompting a downward revision of its earnings outlook. Chief Financial Officer (CFO) Jolanda Poots-Bijl said, "We are adapting to a new reality," and noted that smaller companies are more vulnerable to attacks. At the same time, she said AI can also serve as a means of defense, stressing, "Thanks to AI, we can now detect and recover from attacks far faster than before."

At cryptocurrency exchange Binance, crypto assets worth $6.3 billion were stolen by hackers in the largest such heist on record. The company said it would increase investment in AI-enhanced detection systems. The Port of Rotterdam in the Netherlands, one of Europe's largest ports, is building an AI-powered "cyber shield," and Siemens has also begun testing advanced AI models for defensive purposes.

Reproducing a Vulnerability for "$6 and 28 Minutes," Defense Investment to Rise 1.5-Fold in Four Years

AI has also permeated the attacker's side as a research tool. According to Sean Tufts, field CTO at cybersecurity firm Claroty, the company had published in August, months before the attacks began, the results of research into weaknesses in refrigeration equipment controllers. After a store in France suffered the first attack on October 11, researchers reproduced the flaw using an AI tool available to anyone and succeeded in taking over a test device. "We could reproduce it for $6 and in 28 minutes," Tufts said, demonstrating that the barrier to attack has fallen markedly.

On October 21, two flaws found by AI were disclosed in PHP, the programming language underlying many websites. Governments and companies around the world, from Tokyo to Helsinki, took the precautionary step of shutting down their websites. According to U.S. internet infrastructure company Cloudflare, attempts to exploit the PHP flaw surged from thousands to millions within hours of disclosure. The company said bugs found by AI could cause further disruption in the future.

Swiss building materials giant Holcim shut down its website around 9:30 p.m. on October 21 (4:30 a.m. Japan time on October 22) to apply the PHP patch and restored service before midnight the same day. CFO Steffen Kindler said, "We have to get smarter. Both sides are heavily armed. Both sides are using AI, and that competition continues." Steve Cahillane, chief executive officer (CEO) of U.S. food and beverage giant Kraft Heinz, also said, "The threat is real and it is growing," expressing the view that cybersecurity is "more important today than yesterday, and will be even more important tomorrow."

The normalization of such threats is driving up investment on the defensive side. McKinsey forecasts that the global market for cybersecurity products and services sold by external vendors will expand from $223 billion in 2025 to $346 billion in 2029.

Note: Vulnerability counts are based on CVE registrations. Market size figures are McKinsey forecasts.

What these cases illustrate is an asymmetric competitive dynamic in which AI raises the speed and scale of attacks while defenders are compelled to adopt the same technology. The time from disclosure of a vulnerability to its exploitation has shrunk to hours, and manual responses by IT departments are inherently limited. For companies, cybersecurity is becoming a core issue of business risk management, making expanded defense investment unavoidable.