TUEV Verband and BSI find that only one in ten companies is ready for AI powered cyberattacks.

A study by TUEV Verband and BSI finds that 17 percent of surveyed companies report confirmed or suspected AI related incidents, while only 11 percent have dedicated processes for them. The top attack method is convincing phishing email, cited by 90 percent of victims.

The survey covered more than 500 companies with 20 or more staff. 17 percent report confirmed incidents, suspected cases, or both. 90 percent of affected firms cite phishing email as the attack method, 40 percent cite automated attack scripts, and 11 percent cite deepfakes, for example faked voices used in payment fraud. Only 11 percent of AI using companies have dedicated processes for AI related security incidents, 43 percent rely on unmodified general IT processes, and a quarter have no rules at all.

TUEV president Dirk Stenkamp warns the reported cases could be just the tip of the iceberg, since staff can barely distinguish AI generated messages from real ones. At the same time only 31 percent of AI using companies apply the technology to their own security, even as attackers already automate their methods. The study points to a double gap: insufficient protection against external AI attacks and insufficient control over companies own AI use.

It remains open how quickly firms without a dedicated security team can close this gap and whether independent certification, as demanded by TUEV Verband, will actually arrive. Who pays for retrofitting and training is also likely to shape the industry debate in the coming months.

This story was produced automatically from the source named above and checked by software before publication. The image is symbolic and shows neither the event nor a real person. How this paper is made