Cybercrime in 2025 is more sophisticated, more lucrative, and increasingly intertwined with AI, according to Tony Anscombe, Chief Security Evangelist at ESET. “AI is everywhere, but not everything marketed as AI truly is,” he said. “Some of it is clever computing dressed up as intelligence.”

He noted in his session at the CIA Cyber Insurance Bootcamp 2025 that many technologies labeled as AI are simply advanced automation. While AI will play a larger role in attacks, organizations must focus on fundamentals: strong controls, threat monitoring, and realistic assessments of risk.

The Industry of Cybercrime 

Cybercrime in 2025 isn’t a bunch of hooded hackers in a basement. They are organized, financially motivated operations. Tony highlighted that the chance of being caught is under 1%, making cybercrime a low-risk, high-reward industry. Recent attacks in 2025 underline the ongoing risk to both critical infrastructure and the private sector.

“Critical infrastructure continues to be a high-value target,” Tony said. “In 2024, ransomware attacks on infrastructure rose 9%, a trend we expect to continue.”

Real-World Incidents and Emerging AI-Driven Threats

Tony demonstrated just how costly modern cybercrime has become due to AI-driven threats. 

In August 2025, ESET discovered an emerging, AI-driven, highly adaptive malware called PromptLock. It uses AI language models to dynamically generate scripts during an intrusion, and the AI autonomously decides which files to search, copy, or encrypt. “We’re seeing the first signs of AI being used inside an attack flow,” Tony warned. “As these tools mature, defenders will be dealing with threats that learn and adjust in real time.” 

While still early-stage, these experiments reveal a significant shift: attackers can now automate decision-making during an attack, making campaigns faster, more adaptive, and harder to detect. 

The Takeaway on Cybercrime in 2025

For insurers and risk managers, Tony’s insights underscore the growing complexity of cyber risk. From AI-assisted attacks to supply chain vulnerabilities and evolving ransomware ecosystems, coverage decisions must account for both technical sophistication and human behavior. “Cybersecurity isn’t just about technology; it’s about understanding the threat landscape, human factors, and how attacks evolve,” Tony noted. “Insurance and risk strategies must evolve with it.”

Tony Anscombe’s session took place at the 2025 Cyber Insurance Bootcamp. It brought together top industry minds for an intensive, no-nonsense learning experience focused on the trends that will shape cyber risk in 2026.