Financial institutions are facing an increasingly sophisticated wave of AI-enabled cyberattacks, with cybercriminals now using artificial intelligence not only to execute attacks but also to actively disrupt security teams during incident response, according to new research from cybersecurity firm TrendAI.
The company’s Modern Bank Heists in 2026 report, based on a survey of 46 Chief Information Security Officers (CISOs) from financial institutions worldwide, highlights a rapidly evolving threat landscape where cybercrime groups are leveraging AI to automate and scale attacks at unprecedented levels.
Among the report’s key findings, 89% of organizations reported a year-on-year increase in AI-enabled attacks, while 67% experienced “counter incident response” tactics, where attackers interfered with security teams during ongoing investigations. Additionally, 41% of respondents reported destructive cyberattacks over the past year, underscoring the growing severity of cyber threats facing the financial sector.
The study also found that 55% of institutions experienced an increase in API-based attacks, while 46% reported attempts to steal proprietary market intelligence and investment strategies. Despite the escalating risks, more than half of organizations (54%) indicated that their cybersecurity budgets had not increased, raising concerns about preparedness in an era of AI-driven threats.
“The most concerning finding isn’t simply the rise in AI-enabled attacks. It’s that attackers are actively disrupting defenders while incidents are unfolding,” said Sharda Tickoo, Country Manager, India & SAARC, TrendAI. “When adversaries can interfere with your response as well as execute the attack itself, the traditional rules of cyber defence no longer apply.”
According to the report, cybercriminals are increasingly deploying agentic AI systems capable of automating multiple stages of an attack simultaneously, from phishing and fraud to exploitation and persistence. Researchers also highlighted the growing use of steganography, where malicious commands are concealed within seemingly harmless images, allowing malware to evade traditional detection methods.
TrendAI noted that commercially available Remote Access Trojans (RATs) are becoming increasingly sophisticated, giving cybercriminal groups capabilities that were once associated primarily with nation-state actors.
To counter these threats, the company recommends that financial institutions adopt proactive cybersecurity strategies built around AI-powered detection, threat intelligence, virtual patching, managed detection and response, and executive-level cyber resilience leadership. It also advises organizations to develop AI-enabled security operations capable of responding to threats at machine speed.
The findings suggest that as cybercrime organizations industrialize AI adoption, financial institutions may need to rethink traditional security models and move toward continuous, intelligence-led defence strategies to maintain operational resilience and customer trust.
