White Paper

From Deepfakes to Double Agents

The New Face of AI-Driven Cyber Risk

Increased investment in deepfake defense is beginning to pay off, but the rapid rise of agentic AI is opening organizations up to a whole new world of risk. 

This research reveals:

  • Organizations followed through on their promise to fight back against deepfakes, but while they did, a new AI-driven threat emerged in the enterprise. 
  • 96% of respondents say their organizations now use AI agents or AI tools that can take actions on behalf of employees.
  • 77% say one of those AI tools has already acted on instructions or content that turned out to be malicious, misleading, or unauthorized.

Read the report to see the data and to learn recommendations on what organizations can do to stay ahead of today's changing threat landscape.

Read 2026 Cybersecurity Threat Report
threat-report-2026-hero-3d-tilt

A Unified Approach
to Email Security

Protect your employees' inboxes from advanced phishing attacks that others miss, with the only technology that combines AI and human insights. Our platform is quick to deploy and dead simple to manage (so you get instant protection).

Protect Better
Block advanced phishing and BEC attacks (and never seen before threats) with our Adaptive AI, dynamically sharpened by real-world user insights and a community of over 36,000 threat hunters.

99.7%

Threats

Automatically Remediated by AI

36,000+

Analysts

Collectively Threat Hunting

protect_better
Simplify Operations
Eliminate the manual grind with agentic remediation that adapts to evolving threats, streamlining response workflows without sacrificing transparency, control, or accuracy.

“IRONSCALES has cut the number of man hours down by 95%.”

augustine_boateng_headshot_

Augustine Boateng

Interim Chief Information Officer, City of Memphis

simplify_operations
Empower your Org

Triple the email security awareness of your workforce. Transform employees into a crucial line of phishing defense with integrated Human Risk Management:

  • Phishing simulation testing
  • Security awareness training (SAT)
  • Dynamic email banners

...and a GPT-powered chat assistant

3X

Awareness

With integrated simulation and training

90%

Reduction

In employees clicking malicious links and attachments

empower_your_org

Join 18,000+ Companies and Counting

Veeam_logo (1)
Logo_SMC_Corporation (1)
ZIM_Logo (1)
biohaven_logo (1)
oneshare_logo (1)
singlepoint_global_logo (1)
Heidelberg Materials 2024

Case Studies

"The ability to provide real-time feedback on both positive and negative performance has proven very effective. It’s a wake-up call for our employees.”
telit_square_hero
valley_ent_webp_
memphis
city of memphis
alchemist-case-study-ironscales
webhelp_square_hero
Back
Next

Frequently Asked Questions

Learn more about the 2026 Cybersecurity Threat Report findings.

What is the 2026 Cybersecurity Threat Report?

It is the third annual Cybersecurity Threat Report from Ironscales, produced with market research firm Censuswide. This year's data tells a story in two parts: organizations followed through on their promise to invest in deepfake defense, and agentic AI emerged as a new source of enterprise risk. 77% of respondents say an AI agent or tool at their organization acted on malicious, misleading, or unauthorized content in the past 12 months.

Is investment in deepfake defense paying off?

The trend is encouraging. The share of organizations actively investing in deepfake defense rose from 37% in 2025 to 48% in 2026. Among organizations that lost money to deepfake or AI voice fraud, the estimated average loss fell about 20%, from roughly $280,000 to roughly $225,000. Incidents are still widespread, though: 84% of respondents reported at least one in the past 12 months.

How widely are AI agents used in the enterprise?

96% of respondents say their organizations use AI agents or AI tools that can take actions on behalf of employees, and 52% say that use is widespread. Among organizations using them, agents most commonly access ticketing and helpdesk systems (67%), cloud storage (56%), and email or messaging platforms (49%). Only 19% limit agents to the public web.

How are attackers exploiting AI agents?

Through the inbox, most often. 57% of organizations report a confirmed case of an AI agent acting on malicious, misleading, or unauthorized content. Among organizations with incidents, the two most common types were an AI tool summarizing or acting on a malicious email or message (42%) and an attacker using an AI tool in a phishing or social engineering attempt (41%).

Who approves AI agents inside organizations?

IT is the primary approver of AI agents, plugins, and connectors at 78% of organizations that use them. Security plays that role at just 6%. Among organizations that experienced an AI-agent-related incident, 39% say an employee gave an AI tool access that security would not have approved.

What is the preparedness paradox?

Confidence is outpacing reality. 93% of respondents say their incident response plan covers AI agents, and 84% are confident they could identify an AI-driven incident. Yet 77% have already had an AI agent act on malicious or unauthorized content, and only 52% have formal policies, controls, and incident response processes in place.

Who conducted the research?

Ironscales commissioned the research, and Censuswide conducted it. The survey polled 501 US-based IT and cybersecurity professionals at middle manager level and above, working at companies with 1,000 to 10,000 employees. Data was collected September 9 to 17, 2026, and year-over-year comparisons use Censuswide's 2025 survey of 500 respondents with the same profile.

Stop Email Attacks.

Dead In Their Tracks.

Experience top-tier email protection with IRONSCALES™, the industry's first Adaptive AI-powered platform to catch the threats that others miss.

Get started See pricing