Artificial intelligence is accelerating cybersecurity threats against businesses and government agencies, allowing criminals to potentially impersonate employees, steal sensitive information, and compromise corporate networks faster than organizations can respond, warn some cybersecurity experts.

The Passwords, Passkeys, and Threats, Oh My panel discussion, held Oct. 22 at Eastern Washington University, was hosted by Stu Steiner, director of EWU's Cybersecurity Institute.

Panelists included Dan Brown, a cybersecurity adviser with the Cybersecurity and Infrastructure Security Agency, an agency within the U.S. Department of Homeland Security; Lewis Thomas, an information security associate at Liberty Lake-based Itron Inc.; Colin Turnbull, EWU's director of information security and chief information security officer; and Eric Leachman, an EWU cybersecurity graduate student and instructor.

Findings from cybersecurity company CrowdStrike's 2026 Global Threat Report, identify an 89% increase in attacks involving AI-enabled adversaries in 2025. CrowdStrike's cybersecurity services are used by both the Department of Homeland Security and by Itron. The report states the growing sophistication of cyberattacks is forcing organizations to reconsider how they protect information, manage emerging technologies, and train employees to combat threats.

Cybercriminals required an average of 29 minutes to move from one compromised system to another system within an organization in 2025. The fastest recorded breach in 2025 occurred in 27 seconds, according to the report. Additionally, 82% of CrowdStrike's detections involved attacks that didn't rely on traditional malware. Instead, the attacks mimicked normal user behavior passing through trusted systems to access corporate systems, the report explains.

CrowdStrike also identified a 37% increase in cloud-focused intrusions in 2025, while cloud-related attacks associated with nation-state actors increased 266%.

For businesses, those developments create added financial and operational risks as criminals increasingly use AI-generated communications to impersonate executives, manipulate employees, and obtain confidential information, Brown says.

"The scams that are used are not new," Brown explained during the panel discussion. "It's the same scam that's been going on for a long time, but the method and technologies are different."

Fraudulent communications, such as phone or video calls, often incorporate convincing AI-generated voices, images, and messages, making traditional warning signs less reliable, he says. Deepfake technology can reproduce an individual's appearance or voice, potentially allowing criminals to impersonate executives, employees, or family members to obtain confidential information or authorize fraudulent payments.

Criminals are relying on manufactured emergencies, emotional manipulation, and demands for immediate financial transactions. Brown says organizations should establish procedures to independently verify unusual requests, particularly those involving wire transfers or confidential information. He also emphasizes the importance of immediately reporting fraudulent financial transactions, as financial institutions and enforcement agencies sometimes can recover transferred funds when incidents are reported quickly.

"Many times, they can claw that money back," Brown says.

Beyond financial fraud, autonomous AI agents present emerging security concerns for companies incorporating the technology into daily operations. At the panel discussion, Thomas explained how agentic AI can perform multistep tasks, interact with connected software, and access corporate files or databases when granted permission, unlike conventional chatbots.

Thomas, whose responsibilities at Itron include monitoring for corporate espionage, insider risk, cloud security, and enterprise protection, says technology's capabilities create vulnerabilities when employees use and authorize application functions without understanding the granted privileges.

"Agentic AI scares the Jesus out of me," Thomas says. "It can complete tasks or spread into other systems faster than ever."

For employees who grant AI applications access to corporate storage platforms, allowing those systems to retrieve information beyond what's necessary for an assigned task can contribute to shadow AI, which occurs when employees use AI applications without organizational approval or oversight, creating potential gaps in data governance and security, says Thomas.

Protecting corporate information is particularly important for companies operating internationally and maintaining sensitive engineering, financial, and customer records, Thomas contends. He recommends people remain aware of what they input, limit application permissions, and refrain from providing confidential details to AI platforms. Once AI learns the info, he says, it won't unlearn it, which creates a large vulnerability.

"I just remove all the sensitive information or business names when inputting prompts into AI," Thomas says. "I can still get hypothetical scenarios that way without the threat of an actual information leak."

Brown recommends using enterprise-approved AI platforms that operate under organizational data protection agreements rather than submitting confidential information to public-facing applications.

While AI introduces new vulnerabilities, the technology also provides tools for defending corporate networks. Turnbull says EWU recently introduced a phishing-reporting feature that allows employees to flag suspicious emails for automated analysis.

"Our system is actually monitored by AI now, and it's doing an excellent job of analyzing emails," Turnbull said during the event.

The system allows security personnel to more easily identify malicious communications and remove them throughout the university's network, he explains.

"We're working together to help keep our environment safe," Turnbull says. "The objective is to get a remedy just as fast as possible when a potential intrusion does happen."

Organizations also face challenges balancing cybersecurity investments with operational requirements and limited budgets.

"You can have the best tech in the world, but if you don't have a business process and the people to do it, you're just throwing away millions of dollars," Thomas says.

Budgets and employee awareness can be significant obstacles, and Brown says that mostly applies to agencies and organizations responsible for critical infrastructure. His work with the Cybersecurity and Infrastructure Security Agency involves assisting organizations across 16 critical infrastructure sectors, including energy, transportation, water systems, and financial services.

Internal policies, employee training, and established response procedures can strengthen organizational defenses without substantial investments, he explains. Password managers, multifactor authentication, regular software updates, and phishing-resistant login methods are all recommended as practical measures businesses can implement to protect themselves, employees, and clients.

Cybersecurity should become a routine organizational responsibility rather than something addressed exclusively by information technology departments, Leachman said at the panel discussion.

"Making your employees and everybody in the company or your organization aware of these issues and bringing it into the fold and the conversation regularly normalizes it," Leachman says.