ASOS is the latest business to make headlines for a cyber attack, with criminals threatening to leak its cloud-based data platform. The frequency with which cyber attacks are making headlines reflects the upscaling of cyber crime, aided by AI technology.

The UK’s National Cyber Security Centre reported it handled 204 nationally significant cyber attacks in the year to September 2025, up from 89 previously, with scams becoming ever more convincing.

“Once upon a time, the advice would have been to phone and check with a trusted source if there's an unexpected change to payment details,” says Craig Kennedy, Partner at law firm HF and Head of its cyber consultancy team. “But that’s becoming harder to do if you’re already speaking to fake ‘Karen’ or fake ‘Vanessa’”.

How are cyber security and cyber crime changing?

The cyber threat landscape is changing beyond the emergence of new technology. Organisations face a wider attack surface due to digitalisation and increasingly industrialised cyber crime, with specialised services such as phishing-as-a-service making sophisticated attacks easier to launch.

At the same time, businesses are becoming more connected. Hans Study, a network and security consultant for critical infrastructure, highlights the growing importance of the “edge” – the systems and remote access points connecting organisations to the outside world.

“In the last month, various companies have been in the news for exploited flaws and those boxes are the main gates to a facility”, he says.

The age of on-premise is not dead, he says, but organisations need to consolidate their gateways, especially where different teams manage multiple remote access routes.

That challenge grows as more operational technology associated with infrastructure and equipment connects to networks. “We have to balance the connectivity and the security every time,” says Study.

AI is now an ‘active participant’ in cyber attacks

The rise of AI is giving criminals another way to increase the speed, scale and credibility of existing attacks.

“Deepfakes and identity fraud are going mainstream,” says Charlotte Wilson, Head of Enterprise for UK and Ireland at cybersecurity company Check Point. Voice, video and identity fraud are no longer niche capabilities, she says, with criminals using AI-generated voices, face-swapping and synthetic identities.

Voice phishing, or “vishing”, is one example. Attackers can use real-time voice modulation and deepfake audio to make impersonation more convincing, while corporate communication platforms are increasingly being targeted. A Microsoft report found that vishing through Teams surged by 502% year on year.

AI is also being used behind the scenes. Attackers can scrape publicly available information about potential victims, automate reconnaissance, help discover vulnerabilities, analyse stolen data and even make decisions during an attack.

“The biggest change in recent months is that AI has moved beyond being a productivity tool for attackers. It has now become an active participant in cyber attacks,” says Wilson.

Meanwhile, Kennedy notes how accessible tools have become. “The key challenge for organisations is that AI is dramatically reducing the skill level needed to launch sophisticated attacks.”

How businesses can respond to modern cyber threats

For businesses, one of the biggest priorities is keeping on top of vulnerabilities. “[Organisations have] sped it up a bit but they haven't fundamentally changed enough to patch at the speed now required,” says Wilson.

As the time between a vulnerability being identified and exploited continues to shrink, organisations need to continuously assess their exposure and prioritise the systems that could cause the most damage if compromised, she emphasises.

Organisations can also use AI to increase their cyber resilience and identify vulnerabilities before they occur but this comes with a note of caution.

Kennedy says: “Businesses must also recognise that their own use of AI introduces new risks. Without appropriate governance, security controls and oversight, AI tools can expose sensitive information, create compliance concerns and introduce new attack surfaces for threat actors to exploit.”

For Wilson, the biggest thing comes down to training and preparedness. She stresses that businesses should have clear incident-response plans outlining responsibilities, a communication dissemination plan and estimates of recovery time. “Make sure those answers exist before you need them.”

There also needs to be ongoing rather than one-off training, particularly as social engineering becomes more convincing. Businesses should ensure employees know how to challenge unusual requests and verify information.

Finally, organisations should assume an attack will get through and plan for containment. Wilson says: “Things like network segmentation haven't gone away. Assume something will get through and make sure it can't spread – backed by a good operational resilience strategy”.