IRONSCALES, the email security platform trusted by 18,000+ organizations worldwide, today released its third annual Cybersecurity Threat Report: From Deepfakes to Double Agents: The New Face of AI-Driven Cyber Risk. According to the report, 77% of organizations say an AI agent or tool acted on instructions or content that turned out to be malicious, misleading, or unauthorized in the past 12 months. More than half (57%) report a confirmed case.

The report, conducted with market research firm Censuswide, surveyed 501 U.S. IT and cybersecurity professionals at organizations with 1,000 to 10,000 employees. It finds that AI agents capable of acting on employees’ behalf are now in use at 96% of organizations, and roughly four in five give those agents access to internal systems. Nearly half (49%) let agents into email inboxes or messaging platforms, and 30% grant access to finance, billing, or payment systems.

While all this access offers serious productivity gains, attackers have also taken notice. And they’re relying on familiar tactics. Among organizations with an AI-agent-related incident, the most common types were an AI tool summarizing or acting on a malicious email or message (42%) and an attacker using an AI tool during a phishing or social engineering attempt (41%). Respondents also named acting on a malicious email, prompt, file, or link as the number one way an AI agent could cause a security incident. And 56% now see a deceived AI agent as at least as risky as a deceived employee.

“For years, the goal of a phishing email was to fool a person. Today it only has to fool the agent sitting between that person and their inbox,” said Eyal Benishti, CEO of IRONSCALES. “Organizations have handed AI agents the keys to their email, files, and even payment systems, and attackers are using the oldest tricks in the book to turn those agents against them. Social engineering now has two targets to exploit, people and agents, and modern security strategies must be able to reliably protect both.”

More Key Findings From the Report

  • AI agents are now in use across the modern enterprise. 96% of organizations use AI agents or tools that can take actions on behalf of employees, and 52% say that use is widespread. Only 19% limit agents to the public web with no internal access. The most common systems agents can reach are ticketing and helpdesk tools (67%), cloud storage (56%), email and messaging (49%), internal file repositories (49%), and security tools and logs (47%).

  • Security teams have little say over agentic AI. IT is the primary approver of AI agents, plugins, and connectors at 78% of organizations; security holds that role at just 6%. Among organizations that experienced an AI-agent-related incident, 39% say an employee gave an AI tool access that security would not have approved.

  • The “preparedness paradox” is back. On paper, organizations look ready: 93% say their incident response plan covers AI agents, 93% say training covers safe AI use, and 84% are confident they could identify an AI-driven incident. Yet 77% have already had an agent act on malicious or unauthorized content, and only 52% have formal policies, controls, and incident response processes all in place. Last year, the same gap appeared around deepfakes.

  • Deepfake defense investment is paying off. The share of organizations actively investing in deepfake defense rose from 37% in 2025 to 48% in 2026. Among organizations that lost money to deepfake-related incidents, the estimated average loss fell about 20%, from roughly $280,000 to roughly $225,000, and seven-figure losses were nearly cut in half (6% to 3%). But incidents remain widespread at 84%, and the share calling deepfake defense a “top priority” slipped from 71% to 60% as agentic AI competes for attention.

“Last year’s data showed what happens when organizations take a warning seriously: they invested, and deepfake losses became less severe,” Benishti continued. “Agentic AI demands the same urgency, and it can’t come at the expense of the progress already made against deepfakes. That starts with bringing security into the room when agents are approved and protecting the inbox for agents as well as humans.”

The full report, From Deepfakes to Double Agents: The New Face of AI-Driven Cyber Risk, is available for download here.

About the Research

This research was commissioned by IRONSCALES and conducted by Censuswide among 501 U.S.-based IT and cybersecurity professionals (middle manager level and above), ages 25–55, at companies with 1,000–10,000 employees. Data was collected September 9–17, 2026. Year-over-year comparisons are benchmarked against Censuswide’s 2025 survey of 500 respondents with the same profile. Censuswide abides by and employs members of the Market Research Society and follows the MRS code of conduct and ESOMAR principles.

About IRONSCALES

IRONSCALES is an API-based email security platform that combines Adaptive AI, agentic automation, and crowdsourced human intelligence to detect and remediate phishing, business email compromise, account takeover, deepfake, and GenAI-powered attacks. The platform deploys in minutes via native API integration for Microsoft 365 and Google Workspace with no MX record changes. Beyond threat detection, IRONSCALES includes integrated phishing simulation testing, security awareness training, DMARC management, deepfake protection for Microsoft Teams, and an agentic AI virtual SOC that automates incident response. The platform is powered by a global threat intelligence network of 36,000+ security professionals across 18,000+ organizations and 3,500+ MSP partners. Learn more at ironscales.com.

Media gallery

About The Author
Business Wire