When one attacker can do the work of many, organizations must rethink how they defend themselves.

Sophisticated cyberattacks once required significant technical expertise, resources, and sometimes entire criminal organizations. Artificial intelligence (AI) is changing that equation.

Today, one person with the right AI tools may be able to carry out attacks that once required a coordinated team. For organizations, the size of the attacker no longer reflects the size of the threat.

What Happened in the Recent South Korean Financial Sector Attacks?

Recent cyberattacks against South Korean financial institutions offer a concerning example. Researchers identified the use of AI-powered tools to help discover vulnerabilities and conduct attacks against multiple financial institutions. Evidence suggests that a single individual may have been involved, although the attacker's identity and the full extent of the activity remain under investigation.

Consider the implications: One person, equipped with AI, may now be capable of conducting activities that previously required significantly more resources and coordination.

The size of the attacker no longer necessarily reflects the size of the threat.

How Is AI Changing the Cyber Threat Landscape?

Cybercriminals have always sought ways to operate faster, cheaper, and more effectively. AI offers the ability to accelerate activities such as:

• Identifying vulnerabilities
• Researching targets
• Creating convincing phishing messages
• Analyzing stolen information

While AI does not eliminate the need for technical expertise, it can lower barriers to entry and allow smaller criminal operations to conduct attacks on a much larger scale.

For organizations, that means increased enterprise risk, regardless of size or industry.

What Does the FBI's 2025 Internet Crime Report Say About AI?

And the FBI's latest statistics reinforce that this is no longer a hypothetical concern.

For the first time, the FBI's Internet Crime Complaint Center (IC3) included a dedicated artificial intelligence section in its annual 2025 Internet Crime Report.

The FBI recorded 22,364 complaints involving AI-related information, with reported losses exceeding $893 million.

Although these figures primarily reflect AI-related scams and fraud rather than all AI-enabled cyber intrusions, they demonstrate the growing financial impact of AI-assisted criminal activity.

How Are Regulators Responding to AI-Enabled Cyber Threats?

The financial sector is already examining how to address these evolving risks.

Recent discussions among banking regulators in the United States, United Kingdom, and Europe have highlighted growing concerns about AI-enabled cybersecurity threats, autonomous systems, operational resilience, and the importance of human oversight.

The challenge is twofold.

Organizations increasingly need AI-enabled defensive capabilities to identify threats, monitor activity, and respond quickly. However, adopting AI without appropriate safeguards can introduce additional vulnerabilities.

Using AI to improve cybersecurity does not eliminate the responsibility to use AI responsibly.

Although regulatory requirements vary by industry, this principle extends well beyond financial institutions.

How Can Organizations Fight AI With AI, Responsibly?

How can organizations keep pace when bad actors are using AI without the same policies, oversight, and regulatory considerations?

Embracing AI-enabled cybersecurity tools is an important part of the answer. But strong governance must accompany innovation.

The National Institute of Standards and Technology (NIST) provides a practical foundation through its voluntary AI Risk Management Framework, built around four functions:

1. Govern: Establish accountability.

Determine who is responsible for AI oversight, establish appropriate policies, and define how leadership, cybersecurity, legal, and operational teams participate in decision-making.

Leadership question: Who is accountable for how AI is being used across our organization?

2. Map: Understand where AI is being used.

Identify AI capabilities across the organization, including those embedded in existing technologies. Understand what information they access, what decisions they influence, and what risks they introduce.

Leadership question: Do we know where AI is operating and what it can access or control?

3. Measure: Evaluate effectiveness and risk.

Assess whether AI tools are operating as intended. Test their accuracy, security, limitations, and effectiveness in improving cybersecurity capabilities.

Leadership question: How do we know AI is making us more secure rather than introducing additional risk?

4. Manage: Address risks and maintain control.

Implement safeguards, monitoring, human oversight, and response procedures. Ensure the organization can address unexpected behavior or disable AI capabilities when necessary.

Leadership question: If something goes wrong, do we know how to respond and regain control?

These four functions provide an ongoing approach to managing AI risk as technology and threats continue to evolve.

What Should Executive Leadership Do Now?

Attackers are using AI to lower the cost of attacking. Are you finding ways to lower the cost of defending, responsibly?

Cybercriminals are using AI to reduce the time, cost, and resources needed to conduct attacks. Organizations must consider how AI can strengthen their own defensive capabilities without sacrificing accountability or control.

This is not simply an IT responsibility. Executive leadership, legal, operations, and cybersecurity teams must work together to make AI adoption both effective and responsible.

The organizations best positioned for this changing threat environment will not necessarily be those adopting AI the fastest, but those using it deliberately, with appropriate oversight, safeguards, and resilience.

How Ice Miller Can Help

Ice Miller's Tech, Privacy & Cyber Risk team helps organizations assess AI-related cyber risk, build governance frameworks and prepare to respond when incidents happen. Contact our team to discuss how your organization can adopt AI responsibly and strengthen its defenses.

This publication is intended for general information purposes only and does not and is not intended to constitute legal advice. The reader should consult with legal counsel to determine how laws or decisions discussed herein apply to the reader's specific circumstances.