Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Steve Visconti, CEO, Xiid
Human trust – not technology – has always been the weakest link in enterprise security. By 2026, artificial intelligence will turn that trust into a weapon on a large scale, transforming phishing from a volume game into a precision war. Credential-based breaches already take an average of 292 days to identify and contain. That gives attackers up to 10 months to operate freely in a compromised environment. When combined with automation made possible by AI, a single compromised credential can serve as a springboard for rapid lateral movement across entire networks and infrastructures.
The Efficiency Multiplier
The data is clear: In just two years, the number of AI-assisted phishing emails doubled, rising from 5% to 10% of all malicious communication. According to the 2025 Verizon Data Breach Investigations Report, phishing and compromised credentials together make up 31% of all initial attack vectors, with each breach costing businesses an average of $4.88 million. However, the productivity gap raises the most concerns about this disparity. According to IBM X-Force, experienced social engineers need 16 hours to plan and conduct research for a successful phishing campaign, whereas an AI system can complete the same task in five minutes. This time difference represents a startling 192-fold increase in attacker efficiency.
CrowdStrike’s 2025 Global Threat Report documented that vishing campaigns increased by 442% between the first and second halves of 2024, during which these attacks combined AI-generated voice clones with social engineering to bypass multi-factor authentication. One particularly effective variant floods a target’s inbox with spam, then calls the frazzled victim to “help” resolve the email issue, guiding them through installing remote access software within four minutes of initial contact.?
Financial institutions have seen devastating results. In early 2024, criminals used a deepfake video of a CFO to deceive a finance officer into authorizing 15 transfers totaling $25 million. The attack succeeded because the deepfake appeared on a legitimate videoconferencing platform during what seemed like routine meeting cadences. Research shows that 92% of businesses have lost money due to deepfakes, with average incidents costing financial technology companies $630,000 each.?
What 2026 Will Look Like
Three converging trends will fundamentally reshape the social engineering landscape:
1. Context-Aware Prompting at Scale: AI systems now have the capability to aggregate data from LinkedIn, company websites and leaked credential databases to build detailed target profiles automatically. Security researchers have documented AI-generated phishing that accurately mentioned recipients’ recent purchases and internal terminology specific to their departments. Click-through rates reached 54%, which is more than four times that of traditional attacks. By 2026, these systems will incorporate real-time data streams, adjusting approaches based on news events and social media as attacks unfold.?
2. Polymorphic Campaigns: Traditional email security relies on pattern recognition. AI-generated phishing renders this technique obsolete through mass variation: think thousands of unique variants with different subject lines, body text and links. CrowdStrike notes that 79% of detections in 2024 were malware-free, indicating adversaries bypass technical controls by focusing on identity and access. MIT Sloan researchers found that 80% of 2,800 ransomware attacks incorporated artificial intelligence somewhere in the attack chain.??
3. Autonomous Post-Compromise Movement: CrowdStrike documented that average breakout time for eCrime intrusions fell to just 48 minutes in 2024, with the fastest at 51 seconds. In 2026, AI-enabled automation will compress these timelines further. Unit 42 simulated ransomware attacks integrating generative AI at each stage and found dramatically accelerated progression, from reconnaissance through privilege escalation without any human intervention.??
What CISOs Should Do
Effectively combating the convergence of AI-assisted attacks and credential abuse requires four priority defenses:
1. Deploy Phishing-Resistant Authentication: Move beyond SMS codes to FIDO2 security keys or certificate-based authentication that creates cryptographic proof of identity. Hardware tokens generate session-specific credentials that cannot be intercepted or replayed. For organizations unable to deploy hardware tokens immediately, behavioral biometrics analyzing typing patterns and mouse movements provide an interim layer, disrupting automated post-compromise tools.?
2. Adopt Zero Trust for Identity and Data: Traditional security assumes that internal traffic is trustworthy, but this approach fails when attackers manage to authenticate as legitimate users. Zero trust requires continuous verification for every access request, validating not just identity but context: Is this access consistent with the user’s role and typical patterns? Unit 42 found that 36% of incidents began with social engineering, succeeding because identity verification occurred only at initial authentication.?
3. Build Unreachable Infrastructure: If attackers cannot address or route to a resource, they cannot exploit it. Organizations should close all inbound network ports to critical resources, requiring connections initiated from inside the protected network. This architecture forces access requests through tightly controlled intermediaries applying granular authorization policies. When AI systems compromise credentials and scan for lateral movement, they uncover no listening services and no addressable targets.?
4. Implement Ephemeral Credentials: Persistent credentials like API keys in repositories or service account passwords in scripts represent constant risk. Move toward ephemeral, session-bound credentials that exist only for specific transactions. When credentials are needed, systems generate temporary access, then destroy it. Even if intercepted, they’re already expired.?
The Path Forward
Organizations can no longer rely on users to consistently identify sophisticated social engineering. IBM’s Cost of a Data Breach Report found that breaches involving AI and automation in security had average costs $1.88 million lower than those without. Defense must match offense in technological capability.?
In 2026, successful security programs will combine undiscoverable infrastructure, credential-less authentication, and rapid automated response. While it’s impossible to prevent every phishing attempt, IT and security teams can architect systems where compromised credentials cannot enable lateral movement and where anomalous behavior triggers containment before damage occurs. The weak link is not technology. It is human trust under machine-precision pressure.
##
ABOUT THE AUTHOR
Steve Visconti is a Senior Executive and serial Business Strategist, has devoted nearly 20+ years to advancing operational efficiencies, system indomitability, and overall organizational success, driven by a strong focus on people and integrity-led progression. Currently serving as the President and CEO of Xiid Corp, Steve brings a wealth of experience to the table, encompassing agile risk mitigation, security architecture, cross-functional technical leadership, regulatory compliance, Cloud integrations, and the art of fostering high-performing team environments that are both positive and productive.
