Check Point Software flags AI-driven cyberattacks in India

Check Point Software Technologies Ltd has released its Cyber Security Report 2026, highlighting a sharp rise in AI-driven cyber attacks across global and Indian networks.

According to the company’s 14th annual analysis, organisations experienced an average of 1,968 cyber attacks per week in 2025. This represents a 70 percent increase since 2023. In India, the weekly average stood at 3,195 attacks per organisation in 2025, marking a 2 percent increase compared to 2024.

The report attributes this growth to increasing use of automation and AI by attackers, allowing them to operate faster and scale across multiple attack surfaces simultaneously.

India among heavily targeted regions

The report identifies sector-specific exposure in India.

Education emerged as the most targeted industry in 2025, recording 7,684 weekly attacks per organisation. It was followed by:

• Government: 4,912 weekly attacks

• Business Services: 3,747

• Construction and Engineering: 3,671

• Consumer Goods and Services: 3,658

• Energy and Utilities: 3,116

• Telecommunications: 3,002

• Financial Services: 2,459

• Industrial Manufacturing: 2,332

• Software: 2,328

The data indicates sustained targeting of institutions handling sensitive data, public services and critical infrastructure.

AI reshaping attack mechanics

The report states that AI is driving one of the fastest security shifts the industry has seen.

Capabilities once limited to highly resourced threat actors are now widely accessible. This has enabled more personalised, coordinated and scalable attacks across organisations of all sizes.

Lotem Finkelstein, VP of Research, Check Point Software, said AI is changing the mechanics of cyber attacks, not just their volume. He noted a shift from manual operations to increasing levels of automation, with early signs of autonomous techniques emerging.

He added that defending against this shift requires revalidating security foundations for the AI era and stopping threats before they propagate.

Rise of autonomous and multi-channel attacks

The Cyber Security Report 2026 outlines several structural changes in attack patterns.

AI-driven attacks become more autonomous

AI is now embedded across reconnaissance, social engineering and operational decision-making.

During a three-month observation period, 89 percent of organisations encountered risky AI prompts. Approximately one in every 41 prompts was classified as high risk, exposing new vulnerabilities as AI becomes part of everyday business workflows.

Ransomware ecosystem fragments

Ransomware operations have decentralised into smaller specialised groups.

The report records a 53 percent year-over-year increase in extorted victims and a 50 percent rise in new ransomware-as-a-service groups. AI is being used to accelerate targeting, negotiation and operational processes.

Social engineering expands beyond email

Attack campaigns are increasingly coordinated across email, web, phone and collaboration platforms.

ClickFix techniques surged by 500 percent, using fraudulent technical prompts to manipulate users. Phone-based impersonation has evolved into structured enterprise intrusion attempts.

As AI becomes embedded in browsers, SaaS platforms and collaboration tools, the digital workspace is emerging as a trust layer that attackers attempt to exploit.

Infrastructure and AI systems under strain

The report also points to growing exposure at the infrastructure level.

Unmonitored edge devices, VPN appliances and IoT systems are being used as relay points to blend malicious activity into legitimate network traffic.

In addition, an analysis conducted by Lakera, a Check Point company, found security weaknesses in 40 percent of 10,000 Model Context Protocol servers reviewed. This highlights rising risk as AI systems, models and agents become embedded in enterprise environments.

Recommendations for security leaders

Check Point Software states that defending against AI-driven cyber attacks requires structural change rather than incremental response.

The report recommends that organisations:

• Revalidate security controls across networks, endpoints, cloud, email and SASE environments

• Apply governance and visibility to both sanctioned and unsanctioned AI usage

• Protect digital workspaces spanning email, browsers, SaaS and collaboration tools

• Inventory and secure edge devices, VPN appliances and IoT systems

• Adopt prevention-first security strategies to stop threats before lateral movement or data loss

• Unify visibility across on-premises, cloud and edge environments

The report concludes that as attacks operate at machine speed, security architecture must adapt accordingly.

The full Cyber Security Report 2026 is available for download, and the company will host a livestream to discuss its findings and recommendations.

Read More: 

Salesforce Great Asia AI Summit 2026

India IT Sector Navigating GenAI Transition

HCLTech Fluid Contact Center with Cisco