Midyear cybersecurity and fraud threat report: What businesses need to know

Cybersecurity and fraud risks constantly evolve, though not always in the way we expect. Huntington Security teams track emerging threats across industries. This year, what stands out isn’t new threats, but how quickly known tactics are scaling, amplified by digital transformation and artificial intelligence (AI).

Cybersecurity and fraud threats have intensified and become more connected

The threats organizations have faced for years have not fundamentally changed. The frequency, scale and sophistication of these threats have intensified as artificial intelligence accelerates the execution and effectiveness of attack methods.

Industry research underscores how widespread and persistent these threats have become:

• Cyber incidents and data breaches continue to grow in volume and complexity. The FBI’s Internet Crime Complaint Center (IC3) reported $20.877 billion in total losses in 2025 from cyber-related crimes, a 26% increase from the year prior¹.
• A majority of organizations have experienced attempted or successful fraud. The latest IC3 data show that cyber-enabled fraud accounted for 85% of all losses reported in 2025, amounting to more than $17 billion. Business email compromise (BEC) represented more than $3 billion of that figure¹.
• Many attacks now combine technical compromise with human manipulation. Social engineering has become one of the most common threat vectors, representing 16% of all reported breaches in 2025².

Attackers are exploiting unpatched software vulnerabilities, weak or reused credentials, and gaps in third-party environments at increasing speed. Rising concern over these threats has prompted recent U.S. executive orders aimed at curbing cybercrime, fraud, and predatory attacks⁴ and advancing AI innovation and security⁵.

The “human element” remains a critical target

The convergence of cyber and fraud risk is particularly visible in how attackers target organizations' ‘human layer.’ Threat actors prey on employees’ desire to be helpful through social engineering tactics that mimic legitimate business processes, exploit time-based pressure and trust, requiring only one successful interaction to cause damage. These tactics now extend well beyond email to include voice and text-based impersonation, and highly personalized requests designed to create urgency and intimacy. 

Despite technological advances designed to flag malicious attempts, these attacks still succeed at a troubling rate. The “human element” was present in 62% of reported breaches last year².

The good news is that establishing strong security education and culture works. Employees who received recent training reported simulated phishing emails at a 21% rate – significantly higher than those without it². As AI makes attacks more convincing, organizations that build a strong security culture create an environment where employees act as an active detection layer.

AI can be a force multiplier for attackers and defenders

AI is accelerating your organization's defenders and its attackers. On the attack side:

• AI is enabling attackers to automate reconnaissance, generate realistic communications, and execute attacks with greater precision. In 2025, the average threat actor researched or used AI assistance across 15 documented techniques², according to industry research.
• Fraud attempts are becoming more convincing, more consistent, and harder to detect. IC3 received more than 22,000 AI-related fraud complaints in 2025, with adjusted losses exceeding $893 million¹.
• Employee use of AI is growing rapidly, but unapproved or “shadow” AI introduces data exposures. BYOD policies can blur the line between corporate and personal account use. As many as 67% of employees use a non-corporate account on their corporate device to access both authorized and unauthorized AI platforms².

On the defensive side, advances in AI are strengthening capabilities such as unusual behavior detection and threat identification. However, many organizations are still early in adopting and operationalizing these tools, creating a gap where advancing threat capabilities risk outpacing organizations' security controls.

The exposure for businesses and organizations is expanding

As organizations expand their ecosystems by adopting complex payment systems, adding integration points, and relying more on third-party vendors, their exposure grows. Two areas represent the greatest vulnerability:

Technology and systems

Every new tool, application or platform introduced to an organization increases complexity and potential entry paths for attackers. Exploiting security vulnerabilities in networks, software and systems has become one of the most common initial access vectors for breaches. Organizations that don't prioritize vulnerability management and monitor their networks for unusual behavior can face costly consequences.

Third-party relationships

You are only as secure as your vendors and partners, including secondary entities your primary vendors rely on. Third-party relationships, including downstream vendors, are a growing source of exposure. Breaches involving third parties increased by 60% from last year² and depending on external organizations to remediate breaches or secure exposed data introduces additional risk.

Given these expanding attack surfaces, where should organizations focus?

Protecting your organization: Where to focus

The organizations that succeed are those that focus on:

• Executing strong security fundamentals consistently.
• Aligning security controls with business processes, technology workflows and user behavior.
• Extending security risk management beyond the enterprise perimeter by addressing third-party and external risks.

Resilience today depends on mastering the security fundamentals while aligning people, processes, and technology to stay ahead of rapidly scaling, interconnected threats.

Today’s risk environment isn’t defined by new threats, it’s defined by how quickly familiar tactics are scaling, intersecting and amplifying impact across your organization. Success increasingly depends on how well organizations address the “human element” and manage expanding business, technical and third party risk. Organizations that succeed will move beyond reactive controls by executing on security fundamentals consistently while aligning people, processes and technology to reduce exposure and build lasting resilience.