IBM says AI is accelerating exploitation of basic security gaps in its 2026 X-Force Threat Index

IBM released its 2026 X-Force Threat Intelligence Index on Feb 25, 2026 with a blunt message: attackers are still winning through basic security failures, and AI is making that job easier. According to IBM X-Force, attacks that started with exploitation of public-facing applications rose 44% year over year, driven largely by missing authentication controls and faster vulnerability discovery.

The report says vulnerability exploitation became the leading initial access path in incidents observed by X-Force during 2025, accounting for 40% of cases. That matters because it shifts the focus away from purely phishing-centered narratives and back toward internet-facing services, patch discipline, exposed administrative paths, and inconsistent identity controls. IBM's argument is that AI does not need to invent entirely new attack chains to change the threat landscape. It can simply make familiar weak points faster to find and operationalize.

IBM also says the ransomware and extortion ecosystem became more fragmented. Active groups increased 49% year over year, while publicly disclosed victim counts rose roughly 12%. Smaller operators, reused tooling, and established playbooks lower the barrier to entry, and IBM expects more automation as multimodal models improve. In parallel, infostealer malware exposed more than 300,000 ChatGPT credentials in 2025, a sign that AI platforms are now being targeted like any other core enterprise SaaS system.

The sector and regional breakdowns are notable as well. Manufacturing remained IBM's most-targeted industry for the fifth straight year, representing 27.7% of incidents observed by X-Force, and North America became the most-attacked region with 29% of total cases. Those figures reinforce that the problem is not limited to software companies or AI-native startups. Operational technology, supply chains, and broad enterprise networks remain central targets.

For defenders, the practical takeaway is conservative rather than flashy. IBM is effectively warning that access control, patching, credential hygiene, and exposure management are becoming more important, not less, as AI helps attackers move faster. The report is a reminder that the next stage of AI security competition will reward organizations that can close routine gaps before adversaries automate their way through them.