AI Cyberattacks: $100 Billion Threat by 2028?

A recent report projects that AI-powered cyberattacks will cost businesses globally over $100 billion annually by 2028. That number should be a wake-up call. It’s a clear signal that how we handle AI IT risk has to change, especially with supplier risk in a world where everything’s connected. Our old IT risk frameworks just weren’t built for the fast-moving, black-box reality of AI deployments. This means adopting new search protocols isn’t a simple upgrade. It’s a matter of survival.

The Escalating Cost of AI-Driven Breaches: A 70% Increase in Detected Incidents

Data from CISA (Cybersecurity and Infrastructure Security Agency) is already showing a 70% spike in AI-driven cybersecurity incidents across critical infrastructure just between 2024 and 2025. This is more than just better phishing emails. We’re seeing attacks where generative AI creates disturbingly realistic social engineering campaigns, or where reinforcement learning hammers away at network weak spots faster than any human team could. The sheer scale and sophistication of these attacks are simply blowing past traditional signature-based detection. From what I see in the field, a lot of companies are still behind, trying to fight this with legacy tools that are completely outgunned. The problem gets worse when you think about the supply chain, where a vendor’s innocent-looking AI tool can become the entry point for a major breach if their own security hasn’t kept up.

Untraceable Attack Vectors: 45% of AI Supply Chain Incidents Lack Clear Attribution

What’s really disturbing is a trend from NIST (the National Institute of Standards and Technology): in the last year, around 45% of AI-related supply chain incidents couldn’t be traced back to a specific attacker or point of failure. That fog of uncertainty comes directly from AI’s “black box” problem and the tangled mess of modern software dependencies. When you plug a third-party AI model into your system, its internal logic is often a mystery, making it almost impossible to figure out where a malicious input came from or how it spread. We’ve seen data poisoning attacks, for instance, that quietly corrupt training data over months, creating a biased or exploitable model with no obvious sign of a break-in. This means we have to completely overhaul supplier risk management. We can’t just audit code anymore. We have to audit data pipelines, training environments, and inference endpoints, often stretching across different companies. It’s a huge job, but the only other option is to keep operating blind.

The Vendor Blind Spot: Only 20% of Companies Fully Vet AI Components in Third-Party Software

A recent Ponemon Institute survey found that only 20% of companies are doing any kind of serious vetting of the AI components inside the third-party software they use. This is a massive vulnerability. Most vendor security checks are stuck in the past, focusing on network security, access control, and data encryption. Those things still matter, but they don’t touch the new risks AI brings. Is your vendor’s model being trained on your sensitive customer data? How are they protecting that model from attacks designed to steal information from it? What biases are baked in that could expose you to regulatory or reputational damage? Too often, these questions aren’t even being asked. Conventional wisdom says if a vendor has a SOC 2 report, they’re safe. I think that’s dangerously naive. A SOC 2 is a good start, but it almost never gets into the weeds of AI model security, data sourcing for training, or defenses against adversarial attacks. You need to start demanding AI-specific proof from your vendors on model explainability, bias detection, and how they monitor their AI systems. Without it, you’re just importing their unknown risks into your own operations.

The Data Integrity Challenge: 65% of Organizations Lack Protocols for AI Data Provenance Across Vendors

An IEEE report showed that a staggering 65% of organizations admit they have no set procedures for tracking the origin and integrity of data that their vendors’ AI models use. This is a critical failure. The old saying “garbage in, garbage out” is more true for AI than anything else. If a supplier’s fraud detection model was trained on subtly manipulated data, it might start flagging good customers or, even worse, let actual fraud slip right through. What’s the fix? You need to establish clear search protocols for data lineage, insist on data quality checks throughout the entire AI lifecycle (not just at the start), and force vendors to be transparent about where their data comes from and how they validate it. This is about more than just security. It goes to the core trustworthiness of the AI systems your business now relies on.

The Talent Gap: 80% of IT Security Teams Report Insufficient AI Security Expertise

The most immediate and painful problem might be the talent gap. A recent (ISC)² survey found that 80% of IT security teams feel they don’t have enough AI security expertise to handle the new threats. You can buy all the advanced AI security tools you want, but they’re basically expensive paperweights without skilled people to deploy them, monitor them, and interpret what they’re saying. Building that expertise internally takes time, and most companies don’t have any to spare. The only realistic path forward is a mix of aggressive internal training, making strategic hires for AI security specialists (good luck, it’s a tough market), and bringing in external experts for specialized audits and AI pen-testing. Companies that don’t make a serious investment in people are going to be stuck playing defense, constantly reacting to breaches instead of preventing them. You have to invest in your people as much as your tech, because humans are the ones who design, defend, and in the end make sense of these complex systems which also ties into broader AI workforce reskilling.

AI is now fused with our IT infrastructure, and that has broken traditional risk frameworks. Every organization has to fundamentally change its security posture, especially around third-party vendors and the AI they sell. Proactive, AI-aware strategies are the only way forward, demanding deep dives into vendor practices and constant monitoring for the slightest anomaly, particularly with the growth of AI ransomware risk.