AI is now accelerating cyber threats faster than security teams can absorb them

Artificial intelligence is changing cybersecurity on both sides of the divide. While defenders are deploying AI to process intelligence and automate labour-intensive tasks, threat actors are experimenting with the same technology to accelerate exploitation, create convincing synthetic content and operate at greater scale. The consequence is an emerging imbalance. Security teams have more activity to monitor, yet the people responsible for deciding what genuinely matters remain a constrained resource.

This is one of the central findings from Flashpoint’s Enterprise Threat Intelligence Report: 2026. The report finds that 65 percent of respondents regard alert noise and false positives as a leading challenge to the effectiveness of their threat intelligence programmes. A further 55 percent cite insufficient analyst bandwidth and half identify integration gaps across their security tools. These are significant findings because AI is simultaneously creating new things for those analysts to investigate.

There are two aspects to the AI cyber threat. The first is the creation or improvement of individual attacks. The second, potentially more important development for enterprises, is scale.

Flashpoint says AI-related threats have become the most frequently cited area in which organisations want greater intelligence coverage. Respondents specifically highlighted deepfake detection, AI-accelerated exploitation of vulnerabilities and emerging AI-enabled threat vectors.

The scale of activity identified by the company provides some indication of why. During the first half of 2026, Flashpoint says it tracked more than 22 million threat-actor posts discussing, sharing or advertising AI toolkits for criminal deployment. Its analysts observed AI being used in areas including phishing, malware development, evasion and vulnerability exploitation. The figure is useful as an indicator of activity rather than a count of successful cyberattacks. Nevertheless, 22 million posts illustrate the extent to which AI has become part of conversations taking place within illicit online environments.

This development is consistent with other evidence concerning the changing economics of cybercrime. As Digital Journal has previously reported , advanced models can potentially make tasks such as analysing large codebases and identifying exploitable weaknesses faster and achievable at greater scale. This matters because the time available to defenders can shrink if technology helps adversaries identify weaknesses more rapidly.

When more intelligence becomes less useful

More threat information does not automatically produce greater security. An organisation can potentially receive thousands of indicators, alerts and notifications while remaining uncertain which require immediate intervention. In this sense, Flashpoint’s finding that 65 percent of respondents identify alert noise and false positives as a leading problem is telling. The report gives an example from a healthcare practitioner involving alerts email breaches that were seven or eight years old. According to Flashpoint, the same data could resurface when resold, prompting another investigation. Respondents also described manual transfers of information between intelligence feeds, SIEM platforms, SOAR systems, ticketing tools and response workflows.

Every irrelevant alert competes with a relevant one for analyst attention. This turns cybersecurity into an information-quality problem. The aim of threat intelligence cannot simply be to collect more information. Intelligence needs sufficient context to enable organisations to discriminate between material threats and background noise.

Digital Journal coverage has described threat intelligence as both the data gathered potential cyber threats and the process of gathering, processing and analysing this material so organisations can better understand their exposure. AI increases the importance of that second element.

Deepfakes expand the problem beyond malware

The threat is not confined to vulnerabilities and malicious code. Deepfakes and synthetic media attack something more fundamental: an organisation’s ability to decide whether a communication or identity is authentic.

This distinction has become increasingly important. Recent Digital Journal reporting on AI voice cloning examined attempts involving synthetic voices impersonating executives or trusted colleagues, demonstrating how AI can be directed at human trust rather than simply at software. This broadens the remit of enterprise threat intelligence. Monitoring malware, vulnerabilities and known threat actors remains important, but defenders increasingly need to understand AI-generated impersonation and other emerging attack mechanisms.

One indication that security leaders recognise the change can be found in spending expectations. According to Flashpoint, half of respondents who provided a budget outlook expect their threat intelligence budgets to increase over the 12 months. Thirty-five percent anticipate growth of at least 10 percent, while another 40 percent expect spending to remain broadly flat. None of those respondents forecast a decrease.

Organisations expecting meaningful increases pointed to AI defence capabilities, additional intelligence feeds and modules, and wider programme development among areas for investment. Throwing money at the problem, however, will not in itself remove the underlying capacity constraint.

The more significant question for 2027 planning is likely to be how organisations convert investment into a better ratio between useful intelligence and analyst effort. The issue is summed up by Josh Lefkowitz, Flashpoint’s Co-Founder and CEO. “2027 will test whether threat intelligence programs can scale their reach as fast as AI is reshaping the threat landscape,” Lefkowitz says. “The opportunity for agentic AI on the defensive side is significant, and our research shows security leaders are ready to invest. But they aren’t swayed by the hype.”

AI does not make every cyberattack novel, nor does each piece of threat information deserve equal consideration. Instead, AI is adding speed and volume to an already difficult environment while expanding the techniques available to adversaries.