New research from Databarracks has revealed that the number of UK businesses facing AI-driven cyber attacks has more than doubled in the last twelve months, increasing to 25% from 12% in 2025.

Unsurprisingly given this increase in volume, the research also found that for the second year running, AI-driven cyber threats are identified as the biggest resilience challenge facing organisations over the next five years.

The findings are revealed in Databarracks’ Data Health Check 2026, an annual survey of 500 IT decision-makers across UK businesses.

The report revealed that businesses are taking steps to respond to the growing AI threat, with 85% of organisations now assessing AI risk at least annually.

The research comes as the threat of AI becomes a reality and garners international headlines. OpenAI recently disclosed that its own AI model gained access to the internet from a controlled and isolated testing environment and autonomously launched a coordinated cyber attack against an organisation.

The AI agent successfully exploited a chain of vulnerabilities to obtain credentials and access data from its servers before the activity was discovered.

Large organisations have been hit hardest by AI-driven attacks, and perhaps unsurprisingly, AI threat response is now a resilience priority for 41% of them.

Despite growing concern around AI-enabled attacks, organisations are still positive about the potential of AI: 79% of organisations still believe it is a greater benefit than threat to security.

AI is becoming embedded across resilience operations. The vast majority of resilience teams use AI in some form (93%), while 3 in 10 rate the maturity of their AI programme as “advanced” or “optimised”.

AI is the leading priority for budget increases: 61% of organisations increased their AI budgets, compared with 55% for security and 36% for backup and disaster recovery.

“The findings reveal the new reality of cyber risk. Even before AI, cyber was the fastest-developing threat. We’ve seen it grow from being the leading cause of downtime for just 6% of organisations ten years ago to 30% today,” James Watts, Managing Director at Databarracks, said.

“With AI now capable of autonomously exploiting the vulnerabilities it finds, attackers have gained a significant advantage.

“At the same time, AI brings powerful new capabilities to cyber defence and broader resilience, which helps explain why organisations remain optimistic about it.

Recommended reading

• Anthropic Investigates Claimed Unauthorised Access to Mythos
• OpenAI and Anthropic Called to White House Over AI Hacking Risks
• “Sloppy” OpenAI Hack Hit More Than Hugging Face
• OpenAI Model Goes Rogue In Testing, Hacks Hugging Face
• Is Mythos as Dangerous as Anthropic Claims?

“The conclusion we reached on cyber response remains the same, and it is now even more important: organisations must plan for a breach and prepare for recovery. Even the most mature organisations cannot prevent every incident.

“How should we adapt and prepare? If an AI model can identify vulnerabilities, adapt to defensive controls and execute attacks at machine speed, organisations will have significantly less time to make critical decisions during an incident.

“Decision-making that once happened over hours may soon need to happen in minutes. Technology alone cannot solve that challenge. Only preparation can.

“That preparation now needs to go further. We have reached a point where we must plan for scorched-earth situations, for a total loss of IT systems and effectively rebuilding from scratch.

“Cyber response has improved quickly to keep pace over the last decade, but even organisations with mature capabilities need to review and advance again.

“Boards should have confidence that their organisation can recover critical services, protect essential data, communicate effectively with stakeholders and continue operating under significant pressure. Those capabilities cannot be found during a crisis. They must already exist.”