AI cybersecurity attacks hit 43%, CDW analysis

The inbox used to be a swamp. Now it is a swamp with a copy editor, a malware assistant, and apparently a productivity dashboard somewhere in threat actor land. The grim little milestone in CDW's latest security research is not that AI enabled attacks are coming, but that a large slice of companies says they have already arrived. According to ZDNET's Charlie Osborne, CDW research found that 43% of organizations surveyed have experienced AI enhanced or AI generated phishing attacks. ZDNET also reported that 37% have encountered AI augmented malware. That is the part where defenders should stop treating AI enabled phishing and malware as a weird edge case and start treating them as weather.

What CDW says happened

ZDNET reported that CDW's research shows AI use in attacks is becoming increasingly common, with phishing leading the visible mess. The specific finding, 43% of surveyed organizations experiencing AI enhanced or AI generated phishing, matters because phishing is still the front door with a fake mustache. AI does not need to be brilliant to be useful here; it just needs to make scam messages cleaner, faster, and less obviously written by a raccoon standing on a keyboard. CDW's own newsroom identifies the underlying work as its 2026 Cybersecurity Report, which gives this more weight than the usual vendor séance around future risk. The malware number matters too: ZDNET says 37% of companies have encountered AI augmented malware. Put those together and the story is not one shiny new superweapon, it is boring enterprise compromise getting automation help, which is somehow more annoying.

The blast radius is your normal workflow

ZDNET's report describes AI as driving new phishing and malware based threats, and that phrasing is the useful part. The danger is not that every email becomes unbeatable, because please, no one gets to retire the security awareness slides that easily. The danger is that the usual weak signals get weaker: awkward phrasing, odd formatting, generic lures, and obvious social engineering tells become less dependable. For enterprises, that pushes risk into the places workers already live: inboxes, document workflows, help desk queues, and identity prompts. A polished phishing message can still be a phishing message, just dressed like it has a calendar invite and a mortgage. Malware assisted by AI does not have to be novel in every byte; if it helps threat actors generate variants, test wording, or move faster, defenders feel it as noise, volume, and triage fatigue.

The attacker character arc is automation

ZDNET frames the CDW findings around AI driven phishing and malware, which fits the threat actor motivation perfectly: more attempts, less manual effort, better targeting when the payoff justifies it. This is not a movie villain monologue. It is a cost reduction strategy with worse ethics and better spelling. That shift changes what defenders should measure. If attacks are easier to produce, then waiting for obviously suspicious artifacts is like waiting for a smoke alarm that only detects jazz. Security teams need detection that looks at behavior, identity context, attachment handling, link destinations, and unusual access patterns, not just the literary quality of the email.

The defensive gap

ZDNET also reported that 41% of companies plan to use AI in their cyber defenses. That is encouraging, provided the plan is more than stapling a chatbot to the SOC and calling it transformation. Defensive AI can help sort alerts, identify suspicious patterns, and speed investigation, but only if teams know what data it sees, what decisions it influences, and how humans verify the output. The CDW finding should also reshape training. Employees do not need a lecture about spooky artificial intelligence; they need practice recognizing requests that create risk, even when the message looks normal. Teach verification habits for payment changes, credential prompts, file sharing requests, and executive urgency theater, the classic genre where someone named Chad needs gift cards immediately for reasons of destiny.

What it actually means

for you Taken together, the CDW research reported by ZDNET says AI enabled phishing and malware are now an operating assumption for mainstream enterprises. For security leaders, that means tuning controls for volume and believability, not just novelty. For IT teams, it means identity protections, email filtering, endpoint telemetry, and incident reporting need to work as a system, because the inbox is no longer kind enough to look cursed. For everyone else, the translation is simple: do not judge a message by whether it sounds human. Verify the action it asks you to take. The next useful security habit is not paranoia, it is a pause button with receipts.