AI-driven deepfake attacks hit 65% of Indian organisations: Thales report

New Delhi, March 9. Nearly two-thirds of organisations in India have experienced deepfake-related cyberattacks as the rapid adoption of artificial intelligence (AI) creates new data security risks, according to the 2026 Data Threat Report released by Thales Group.

The report, based on research conducted by S&P Global’s 451 Research unit, found that 64 percent of organisations in India identify AI-enabled attacks as their top data security risk, slightly lower than the global average of 70 percent.

The study highlights that 65 percent of organisations in India reported experiencing deepfake-driven incidents, while 55 percent said they suffered reputational damage due to AI-generated misinformation or impersonation campaigns. AI-powered deepfakes and misinformation are making identity-based cyberattacks more convincing and effective.

Credential theft remains the most common method used to breach cloud infrastructure, cited by 68 percent of organisations in India, compared with 67 percent globally. The report notes that as AI tools gain wider access to enterprise systems and data, weak identity governance, access policies and encryption frameworks can amplify security vulnerabilities much faster than human actions alone.

“The rapid adoption of AI is driving a surge in next-generation cyber threats, particularly deepfakes,” said Ankur Kanaglekar, Vice President for India at Thales.

He added that stronger legal and regulatory frameworks are essential to counter emerging AI-driven risks.

The report also points to widening gaps in data visibility as companies deploy AI across operations such as analytics, customer service and software development. Only 35 percent of organisations in India know where all their data is stored, while 36 percent are able to fully classify their data, indicating limited oversight of sensitive information.

Globally, nearly 47 percent of sensitive cloud data remains unencrypted, increasing exposure in case of credential compromise. The challenge is compounded by the growing complexity of managing machine identities, application programming interface (API) keys and security tokens.

Human error continues to play a significant role in cyber incidents, contributing to 26 percent of data breaches in India. With AI-driven automation, the report warns, small mistakes could escalate rapidly across systems.

Despite rising risks, investment in AI security is still evolving. About 30 percent of organisations in India and globally now allocate dedicated budgets for AI security, while 53 percent continue to rely on existing cybersecurity budgets and traditional defence frameworks designed primarily for human users.

Eric Hanselman, Chief Analyst at S&P Global 451 Research, said organisations must treat data security as a foundational element of AI innovation.

“As AI becomes deeply embedded in enterprise operations, continuous data visibility and protection are no longer optional,” he said.

The report concludes that as automated systems gain broader access to corporate data, organisations must strengthen identity management, encryption and data visibility frameworks to prevent AI from becoming a new insider threat within enterprise networks.