AI-powered cyberattacks are attacks in which criminals use artificial intelligence and large language models (LLMs) to automate and personalize phishing, impersonation, and vulnerability scanning at a scale manual campaigns could never reach. According to IBM’s 2025 Cost of a Data Breach Report, 16% of the breaches it studied involved attackers using AI, most often for phishing or deepfake impersonation.
A recent episode of Tecnologia Circolare, produced by ProXima Distribution, focuses on this shift, with Gianluca Sammarchi, Managing Director of CyberGlobal Italy, looking at what AI means for attackers and defenders. The conversation skips the hype and stays with what real assessments show.
You can watch the full episode on YouTube (in Italian).
His core message is simple: attackers have more computing power than ever, but they still rely on the same two weaknesses: people and open doors. Defense has to become a continuous process, not a one-time purchase.
In this article, we’ll walk through the main takeaways from the episode, add the context behind them, and show what MSPs, system integrators, and IT leaders can do next, including how NIS2 fits in.
How are AI-powered cyberattacks different from traditional attacks?
A few years ago, a phishing email was often easy to spot: awkward wording, clumsy translation, an unlikely sender. Sammarchi notes that this is no longer true, because today’s emails arrive polished and aimed at the specific person who receives them.
Let’s look at what AI changes for attackers:
- Flawless language. LLMs remove the spelling and translation errors that once gave phishing away.
- Personalization at scale. Campaigns are tailored to each target instead of sent as generic spam. In Italy, even small and mid-sized businesses now receive targeted attacks as often as they once received spam.
- Speed. Work that took an attacker several days a few years ago can now be produced in a very short time.
- Deepfakes. Synthetic audio and video add convincing impersonation to the toolkit, which makes attacks harder to recognize.
What hasn’t changed in AI-powered attacks?
AI gives attackers more computing power, not new tactics. Sammarchi points out that attackers still aim at two things: human emotion, through phishing that pushes people to click, and the open doors companies leave behind, found through continuous scanning for vulnerabilities.
| Before AI | With AI | |
|---|---|---|
| Phishing emails | Often poorly written or badly translated | Polished and targeted at the recipient |
| Attacker effort | Several days to build a convincing campaign | A very short time |
| Scale | Tailored attacks required manual work | Tailored attacks produced at industrial scale |
| Main targets | Human emotion and exposed vulnerabilities | The same: human emotion and exposed vulnerabilities |
Why is cybersecurity a process and not a product?
Sammarchi argues that the old IT partner model, selling licenses or running an occasional check, no longer holds up. Organizations have bought technology for years, yet attacks keep succeeding, because few built a cybersecurity process around the tools they own.
Here’s what a process brings together:
- Technology. Tools that work together instead of isolated purchases.
- Awareness. An organization where everyone understands the risks, not only the IT team.
- Process. Regular analysis, visibility, and verification, with remediation to close what is found.
Because AI created this problem, adding another closed black-box AI tool is not enough. At CyberGlobal Italy, we combine automated vulnerability screening with penetration testing run by certified experts. The machine accelerates, and people interpret. If you’d like to see how AI-driven pen testing fits into that picture, we’ve covered it in detail.
The same idea applies to remediation. In our web application penetration test for a national research platform, support during remediation and an independent retest turned a one-off test into a measurable improvement.
What do security assessments reveal most often?
According to figures shared in the episode, CyberGlobal completed more than 2,500 assessments in 2025 and identified more than 5,000 critical vulnerabilities. The common thread, Sammarchi explains, is limited awareness: organizations feel safe because nothing has gone wrong in years, so they skip the checks that would reveal weaknesses and the remediation that would close them.
Here are the gaps we see most often:
- Limited visibility on the attack surface. Many organizations lack a clear picture of what they expose to the internet. An infrastructure vulnerability assessment is a practical way to map it.
- Misconfigurations. Settings left in an insecure state, including exposed test servers.
- Weak credentials. Passwords that are easy to guess or reuse.
- Outdated and unpatched systems. A firewall that is not updated or patched is one example Sammarchi mentions.
- Human awareness. Employees need to treat their computer as a window to the whole world, not just a screen. Social engineering testing shows how your team responds to realistic attacks.
How does NIS2 turn this into a roadmap in Italy?
Many companies criticize NIS2 as one more hidden tax. Sammarchi sees a major opportunity instead. Following its requirements means analyzing the organization from both a governance and a technology point of view, then building a roadmap that raises the bar across the company, not only for the IT manager. Together with compliance and GDPR work, it creates the continuous process described above.
The timing is concrete. As of October 2026, ACN’s published requirements set the following calendar for entities in Italy’s national NIS list:
| Basic security measures | Within 18 months of the inclusion notice, which is October 2026 for entities listed in 2025 |
| Incident notification to CSIRT Italia | Within 9 months of the inclusion notice (January 2026) |
| Annual registration and update | Every year from January 1 to February 28 on the ACN portal, as described in the NIS Vademecum |
| Reference framework | National Framework for Cybersecurity and Data Protection, 2025 edition |
In the episode, the host adds that ACN has announced it will stop accompanying companies after October 31, and that companies without a compliant security posture can face sanctions from then on. We support organizations with readiness and implementation through risk assessment and management and compliance audits, while ACN remains the authority that supervises NIS2.
What should MSPs, system integrators, and IT leaders do next?
For MSPs, IT resellers, system integrators, CIOs, and CISOs, the shift is from tools to strategy. Sammarchi’s closing advice is to leave the logic of the single instrument behind and move to a long-term plan.
Here are a few steps to start with:
- Map your attack surface. Know what you expose to the internet, including test servers and forgotten systems.
- Test regularly, not once. Treat vulnerability screening and penetration testing as a recurring cycle, since attackers scan continuously.
- Pair automation with expert review. Let tools speed up screening, and let certified testers interpret results and prioritize fixes.
- Build awareness beyond IT. Include leadership and every employee, because attacks target people as much as systems.
- Use NIS2 as a roadmap. Its governance and technology requirements give you a structure for a continuous process.
- Move from vendor to advisor. For MSPs and system integrators, the opportunity is to guide customers on risk, not only to deliver technology. Our MSP partner program is built around that shift.
Frequently asked questions
What are AI-powered cyberattacks?
AI-powered cyberattacks are attacks in which criminals use artificial intelligence and large language models to automate and personalize phishing, impersonation, and vulnerability scanning. According to IBM’s 2025 Cost of a Data Breach Report, 16% of the breaches studied involved attackers using AI, most often for phishing or deepfake impersonation.
Why is AI-generated phishing harder to detect?
AI-generated phishing removes the spelling and translation errors that once gave scams away, and it can be tailored to each recipient in very little time. Deepfake audio and video add convincing impersonation on top. Spotting an attack by its wording alone is no longer reliable.
Is more AI the answer to AI-powered attacks?
Not on its own. A closed black-box AI tool does not replace visibility into your own environment. A hybrid approach works better: automated vulnerability screening to move fast, plus penetration tests by certified experts who interpret the results. The machine accelerates, and people decide what matters.
What weaknesses do security assessments find most often?
The most common issue is limited visibility on the attack surface, including misconfigurations, exposed test servers, and weak credentials. Outdated systems and low human awareness appear often as well. CyberGlobal completed more than 2,500 assessments in 2025 and identified more than 5,000 critical vulnerabilities, according to figures shared in the episode.
What is the NIS2 deadline for basic security measures in Italy?
Under ACN Determination 379907/2025, entities included in Italy’s national NIS list have 18 months from their inclusion notice to adopt the basic security measures. For entities listed in 2025, that falls in October 2026. Incident notification to CSIRT Italia applied after 9 months, which was January 2026.
How should MSPs and system integrators change their role?
They should move from selling tools to advising on risk. Security is a continuous process of analysis, visibility, and verification, so partners add the most value by helping customers see their attack surface, test it regularly, and build a roadmap. NIS2 gives that conversation a clear structure.
Strengthen your cybersecurity process with CyberGlobal Italy
AI has raised the speed and polish of attacks, but the fundamentals of defense have not changed: know your exposure, test it, fix what you find, and keep going. That is a process, and you don’t have to build it alone.
But with the right partner by your side, it becomes manageable. At CyberGlobal Italy, we combine automated screening with expert-led penetration testing and support organizations on the road to NIS2 readiness. Our global network already protects enterprise brands across industries, and that same quality is available to growing businesses, MSPs, and system integrators in Italy.
But behind our advanced technology, there are real people. Professionals who want to work together with your team, step by step.
Reach out to CyberGlobal Italy and let us be your ally against today’s and tomorrow’s cybersecurity challenges. Reach out today!