AI-Powered Cyber Threats and the Security of Business Information Systems: A Systematic Literature Review of Emerging Attack Vectors and Defensive Countermeasures

Abstract

While the same Generative and Adversarial AI (GAN) techniques that are playing a role in revolutionizing enterprise cybersecurity defense are being leveraged by threat actors to attack business information systems at an unprecedented rate, scale, and sophistication. This paper is a systematic literature review on AI-powered cyber threats that are faced by business information systems that integrates findings from peer-reviewed surveys, IEEE Access and IEEE Communications Surveys & Tutorials publications, cyber standards & policy documents, and up-to-date threat intelligence information in the industry. In the review, the five major AI threat categories identified — AI-enhanced phishing and social engineering, deepfake-enabled fraud and impersonation, AI-generated and polymorphic malware, adversarial attacks on defensive machine learning systems, and automated reconnaissance and exploitation — and empirical data on their prevalence, business impact and growth are analyzed and summarized. The review also covers documented real-world incidents with malicious variants of LLMs like WormGPT and FraudGPT, as well as a detailed examination of defensive AI technologies such as explainable AI, adversarial robust test, behavior anomaly detection, and multimodal deepfake detection, and an overview of the ongoing regulatory framework, including the NIST Adversarial Machine Learning taxonomy and the EU Artificial Intelligence Act. Synthesized survey findings show that 87% of organizations faced an AI-fueled cyberattack last year, AI-generated phishing has now become more than 80% of the observed phishing emails, while just 26% of security professionals are confident detecting sophisticated AI-driven attacks, creating a significant capability-adoption gap in enterprise defenses. The review concludes with a proposed defense in depth approach for business information systems and outlines some future research directions such as adversarial robustness benchmarking, cross organizational threat intelligence sharing, and governability of dual use generative AI.