Tech • AI • Robotics • Game
The Cyberattack Apocalypse Is Here
6/10TL;DR
Cyberattacks against European businesses are accelerating sharply, with monthly incident rates rising from about 0.6%-0.8% to 1.5%, as generative AI makes phishing and vulnerability scanning easier to industrialize.
KEY POINTS
A sharp rise in attack frequency
Stoïk, a French cyber insurer and incident-response provider focused on companies from 0 to 1 billion euros in revenue, says the rate of client companies reporting attacks has climbed dramatically. Historically, 0.6% to 0.8% of insured businesses were hit each month, then the figure moved to 1% in the second quarter and reached 1.5% in August-September. Annualized, that implies as many as 18% of companies suffering an attack in a year.
200 attacks handled in one month
With about 15,000 clients, the firm says it managed 200 cyberattacks in a single month, or roughly seven per day across weekdays and weekends. Those incidents came from companies operating in several European languages, including French, German, Dutch and Spanish. Not every case was catastrophic, but each involved an actual compromise requiring investigation and support.
How a cyberattack unfolds
A typical attack follows three stages. First, an intruder gains initial access, often by compromising an email account or exploiting a technical flaw in an exposed system. Second, the attacker moves laterally and seeks higher privileges, aiming for accounts with broad powers such as IT administrators or finance staff. Third, the attacker monetizes the intrusion through fraud, ransomware, or business disruption.
Email remains a critical weak point
Corporate email is described as one of the most sensitive entry points because fraud schemes almost always pass through it at some stage. Even a limited compromise can give criminals visibility into conversations, payment habits and internal processes. Once that access is established, the attacker can wait, escalate or impersonate employees to trigger fraudulent transfers.
AI is lowering the barrier to entry
Generative AI is making phishing more convincing and scalable. Attackers no longer need strong language skills to produce credible messages in any language, sharply increasing the volume and quality of lures. That shift turns what used to require specialized social-engineering talent into a more accessible, automated process.
Human error is only part of the problem
Simulated phishing campaigns still show meaningful failure rates even in digitally mature organizations. But technical vulnerabilities remain just as important: outdated software, poor patching and exposed services create direct openings. AI also helps attackers scan the internet continuously for those weaknesses, giving them a faster and more exhaustive way to identify targets.
Shared software creates systemic risk
Common technologies can become mass attack surfaces. A flaw in widely used software such as WordPress, which powers a large share of websites, can trigger a race between defenders applying patches and attackers exploiting unpatched systems. The spread of shared tools means one newly discovered weakness can suddenly expose thousands of businesses at once.
The biggest losses reach into the millions
Extortion and fraud demands can reach the millions of euros. In some cases, payment is considered because the company faces an existential crisis, with operations halted or core systems locked. That severity matters alongside frequency: insurers and defenders are tracking not just how often incidents occur, but how badly they damage balance sheets and continuity.
A fast-growing European cyber player
Stoïk, founded in 2021, says it is expanding from 12 to 25 million euros in annual recurring revenue by the end of the year. The company argues that few private firms in Europe handle more cyber incidents on a day-to-day basis in its segment. Its model combines insurance with prevention and response, giving smaller companies a 24/7 contact point when suspicious activity appears.
CONCLUSION
The data points to a cyber threat environment that is becoming both more industrialized and more accessible to attackers. For businesses, especially SMEs and mid-sized firms, the combination of AI-driven phishing, shared software vulnerabilities and faster attack tempo is turning cyber defense into an operational necessity rather than a compliance exercise.
Ask a question