AI and hyper-realistic fraud: how to lead a resilient organisation in the age of digital disinformation

This article is the result of research carried out by the Ciberseguridad 720 team with the firm aim of adjusting our portfolio of solutions to the current security landscape. Along these lines, the main problems detected over the last year call for services that are agile, scalable and suited to the budgets and real operations of Spanish SMEs, avoiding oversized tools that nobody knows how to use.

It cannot be ignored that small and medium-sized companies are precisely the ones suffering the greatest impact in this new scenario. It is not only the virulence of external threats, with Spain established as one of the most attacked countries in the world according to ESET data, but also growing regulatory pressure that suffocates those who are not prepared. This combination of professionalised cybercrime and mandatory compliance turns protection into a pillar of survival. For Ciberseguridad 720, an executive is not looking to "buy software" but to prevent a digital disaster from stopping production or bringing a penalty that compromises their financial stability.

The metamorphosis of cybercrime: from craft to technology industry in 2026

The research carried out by Ciberseguridad 720 shows that the digital security landscape in Spain has undergone an unprecedented structural transformation. The isolated attacker is no longer the norm; on the contrary, threat actors have adopted organisational structures that mimic legitimate tech start-ups, offering support services, malware updates and affiliate models that "democratise" access to advanced offensive capabilities. This industrialised professionalisation is the direct reason why Spain became the second-largest global target of cybercrime in 2025, with 122,000 incidents handled by INCIBE, a year-on-year increase of 26%.

Another important factor is artificial intelligence (AI), which acts as the definitive catalyst of this offensive: according to the data analysed, 57% of Spanish SMEs say they have suffered AI-related attacks in the last twelve months. On top of this, the emergence of so-called agentic AI allows autonomous systems to scan attack surfaces, identify vulnerabilities and execute the most effective exploit in a matter of minutes, drastically reducing any defence team's reaction time. This technology has also removed language barriers, generating hyper-personalised campaigns in flawless corporate Spanish that are indistinguishable from legitimate communications.

Along these lines, the evolution of identity threats during 2025-2026 shows a paradigm shift towards hyper-realistic fraud. The following table details the attack vectors that are currently compromising companies' stability:

Asymmetric impact: critical sectors in cybercrime's crosshairs

From the data gathered in Ciberseguridad 720's research, it is clear that criminal activity is not evenly distributed; on the contrary, incidents are strategically concentrated in sectors that keep essential services running and underpin the country's economic stability. As illustrated in the table on the Distribution of Incidents by Sector in Spain (2025), attackers prioritise targets where operational disruption creates maximum pressure to pay ransoms or where the density of financial data is high. As a result, SMEs that are part of these supply chains face disproportionate risks because of their role as vulnerable links in the networks of large operators.

On the one hand, banking and financial services remain the top target, accounting for 34% of reported incidents. It should be noted, however, that this siege is not limited to large banks: financial SMEs such as accounting and administrative firms, insurance brokers and investment services companies suffer attacks that combine credential theft through infostealers with the abuse of misconfigured SaaS tools and APIs. At the same time, the exfiltration of financial data feeds a black market where stolen information is used to enrich future hyper-realistic fraud campaigns, multiplying the long-term damage.

Next, transport and logistics is the second hardest-hit sector, with 14% of incidents. This vulnerability is largely due to the accelerated digitalisation of logistics and the convergence of IT (information technology) and OT (operational technology), which has exposed legacy industrial systems lacking adequate protection. A successful attack in this area can therefore translate into the total disruption of national supply chains, generating a systemic economic impact that goes beyond the affected company itself. Likewise, energy and utilities (8%) and manufacturing face geopolitically driven sabotage and extortion risks, where the deployment of industrial IoT devices that cannot be updated leaves these SMEs highly fragile against targeted attacks.

On another note, the tourism and hospitality sector must be mentioned. Although tourism SMEs are not always classed as "essential operators" in global statistics, the research identifies specific attack patterns that exploit seasonality and the high volume of digital transactions. Sophisticated fraud has been detected on booking platforms, where attackers impersonate leading brands to contact guests, as well as breaches in channel manager systems for the mass theft of card data. All in all, the conclusion is clear: regardless of the sector, criminals look for the path of least resistance. For Ciberseguridad 720, therefore, protecting an SME cannot be generic; it must respond to the specific vertical risks of its business activity to guarantee business continuity.

Avoidable gaps: critical digital hygiene mistakes in SME leadership

Although 92% of Spanish companies plan to increase their cybersecurity investment this year, the effectiveness of these defences is repeatedly undermined by basic digital hygiene failures. In this regard, Ciberseguridad 720's research stresses that the human factor remains the most exploited link, since today's attacks are designed to manipulate employees' trust and sense of urgency. In fact, the lack of continuous, realistic training leaves staff defenceless against social engineering techniques that, thanks to AI, are now practically indistinguishable from reality.

It is therefore essential to identify the structural failures that turn a theoretical vulnerability into an operational disaster. Below we analyse the critical mistakes detected among Spanish companies during 2025-2026, together with the corrective actions management must lead:

From regulatory obligation to competitive advantage: the new paradigm of 2026

In the current climate, the legislative environment in Spain is no longer a set of good-practice recommendations but an unavoidable framework of requirements. With the consolidation of the NIS2 Directive and the DORA Regulation for the financial sector, compliance now sits at the heart of corporate strategy. Spanish SMEs are therefore under scrutiny not only from the competent authorities but also from their own corporate clients, who, by legal imperative, can no longer afford suppliers that pose a risk to their own resilience.

That said, the NIS2 Directive is the main catalyst for this change, drastically broadening the range of entities covered. Indeed, SMEs that operate as essential links in sectors such as energy, transport or healthcare must now demonstrate robust technical maturity to avoid penalties that, in cases of negligence, can reach 2% of their global turnover. This "cascade effect" makes it necessary to carry out rigorous security audits and incident response plans that guarantee traceability across the entire supply chain. What was once perceived as an administrative expense has therefore proved in 2026 to be an indispensable requirement to bid for and retain major contracts.

At the same time, this regulatory pressure has driven a positive transformation in organisational governance. According to the data analysed by Ciberseguridad 720, the Chief Information Security Officer (CISO) is closer to senior management than ever: 76% of CISOs in Spain now report directly to the executive committee, compared with 53% the previous year. In the most resilient companies, the role of the BISO (Business Information Security Officer) is also emerging, tasked with aligning technical protection with profitability goals. In this way, cybersecurity stops being an operational "brake" and becomes an enabler that allows the company to operate with confidence in complex digital markets.

Ultimately, facing the threats of 2026 requires moving from reactive models to a "security by design" strategy based on the Zero Trust model. Since the traditional perimeter has faded with the rise of remote work and cloud infrastructure, the premise of "never trust, always verify" is the only effective defence. This requires, on the one hand, strict network segmentation that prevents a slip on an isolated device from becoming a systemic disaster and, on the other, identity and access management (IAM) based on biometric and conditional authentication.

In short, resilience is not a static state but a dynamic capability that separates the companies that will lead the market from those that will disappear at the first serious blow. At this point, management must ask itself a fundamental question: given the pressure of NIS2 and the sophistication of today's attacks, is your organisation really protected, or is it simply waiting for its lack of preparation to present the final bill?

The Ciberseguridad 720 team

Sources consulted (in Spanish):

1. Tendencias clave de ciberseguridad 2026: ataques con IA y evolución del ransomware - CISET, accessed 23 March 2026, https://www.ciset.es/publicaciones/blog/894-tendencias-clave-de-ciberseguridad-2026-ataques-con-ia-y-evolucion-del-ransomware

2. Crecen los ciberataques en España: sectores más vulnerables, accessed 23 March 2026, https://www.solunion.es/blog/crecen-los-ciberataques-en-espana-sectores-vulnerables/

3. Las mayores amenazas a la ciberseguridad de 2026 - Lazarus Alliance, Inc., accessed 23 March 2026, https://lazarusalliance.com/es/the-biggest-cybersecurity-threats-of-2026/

4. El 60% de las Pymes Españolas Sufrió Ciberataques en 2025: Protege Tu Negocio Antes de Que Sea Tarde, accessed 23 March 2026, https://lojobrokers.com/el-60-de-las-pymes-espanolas-sufrio-ciberataques-en-2025-protege-tu-negocio-antes-de-que-sea-tarde/

5. INCIBE detectó más de 122.000 incidentes de ciberseguridad en 2025, accessed 23 March 2026, https://www.incibe.es/incibe/sala-de-prensa/incibe-detecto-mas-de-122000-incidentes-de-ciberseguridad-en-2025

6. Los ciberataques se disparan un 26% en España en 2025 con la banca en la diana, accessed 23 March 2026, https://www.rtve.es/noticias/20260209/ciberataques-2025-banca-aumento-espana/16929807.shtml

7. Los principales riesgos de ciberseguridad en 2026 en España | Digital Innovation News, accessed 23 March 2026, https://digitalinnovationnews.es/los-principales-riesgos-de-ciberseguridad-en-2026-en-espana/

8. El estado de la ciberseguridad en España 2026 - Deloitte, accessed 23 March 2026, https://www.deloitte.com/es/es/services/consulting/research/estado-ciberseguridad.html

9. IA y Ciberseguridad 2026: Cómo la Inteligencia Artificial Cambió las Reglas | Netprovider, accessed 23 March 2026, https://www.netprovider.com/post/ia-y-ciberseguridad-2026-como-la-inteligencia-artificial-cambio-las-reglas

10. Ciberseguridad INCIBE 2025 y directiva NIS2 en España, accessed 23 March 2026, https://ibstechnology.com/ciberseguridad-en-las-pymes-espanolas-el-desafio-mas-urgente-de-2026/

11. Ciberseguridad 2026: amenazas críticas y cómo actuar - On Net Center, accessed 23 March 2026, https://www.onnetcenter.es/ciberseguridad-2026-amenazas-criticas-y-como-actuar/

12. Fraude del CEO: el engaño que puede vaciar la cuenta de tu pyme | Empresas - INCIBE, accessed 23 March 2026, https://www.incibe.es/empresas/blog/fraude-del-ceo-el-engano-que-puede-vaciar-la-cuenta-de-tu-pyme

13. Ciberseguridad 2025 en España: amenazas, regulación, casos y estrategias clave, accessed 23 March 2026, https://techconsulting.es/ciberseguridad-2025-en-espana-amenazas-regulacion-casos-y-estrategias-clave/

14. CIBERAMENAZAS 2026 - Madrid - Revista SIC, accessed 23 March 2026, https://revistasic.es/sic168/revistasic168.pdf

15. Tendencias de ciberseguridad 2026: IA, ransomware, credenciales - Computing, accessed 23 March 2026, https://www.computing.es/seguridad/tendencias-ciberseguridad-2026/

16. Cinco casos reales de ciberataques a empresas turísticas ante la temporada 2026, accessed 23 March 2026, https://www.hosteltur.com/174641_cinco-casos-reales-de-ciberataques-a-empresas-turisticas-ante-la-temporada-2026.html

17. Ciberseguridad: amenazas 2026 que ponen en riesgo a tu empresa y cómo protegerla de verdad - Programación Integral, accessed 23 March 2026, https://programacionintegral.es/nos-interesa/ciberseguridad-amenazas-2026-que-ponen-en-riesgo-a-tu-empresa-y-como-protegerla-de-verdad/

18. Estadísticas sobre ransomware en 2025: Últimas tendencias e información imprescindible, accessed 23 March 2026, https://www.fortinet.com/lat/resources/cyberglossary/ransomware-statistics

19. Errores de ciberseguridad más comunes en pymes en 2026 - Asnet, accessed 23 March 2026, https://www.asnet.es/errores-ciberseguridad-pymes-2026/

20. Herramientas gratuitas | Ciudadanía - INCIBE, accessed 23 March 2026, https://www.incibe.es/ciudadania/herramientas

21. Las 20 mejores herramientas de ciberseguridad para 2026 - IMMUNE Technology Institute, accessed 23 March 2026, https://immune.institute/blog/las-20-mejores-herramientas-de-ciberseguridad-para-2026/

22. Principales tendencias y predicciones de ciberseguridad para 2026 - Splashtop, accessed 23 March 2026, https://www.splashtop.com/es/blog/top-cybersecurity-trends-and-predictions-for-2026

23. Cómo la inteligencia artificial está cambiando la ciberseguridad en 2026 - Panda Security, accessed 23 March 2026, https://www.pandasecurity.com/es/mediacenter/como-la-inteligencia-artificial-esta-cambiando-la-ciberseguridad/

24. 15 Herramientas Ciberseguridad para pequeñas y medianas empresas (SMB) - Fortinet, accessed 23 March 2026, https://www.fortinet.com/lat/resources/cyberglossary/smb-cybersecurity-tools

25. 8 programas de ciberseguridad para proteger el 2025 - SentinelOne, accessed 23 March 2026, https://www.sentinelone.com/es/cybersecurity-101/cybersecurity/cyber-security-software/

26. Las 11 mejores herramientas de seguridad de código abierto en 2026 - TuxCare, accessed 23 March 2026, https://tuxcare.com/es/blog/open-source-security-tools/