By Shannine Daniel for Techie.Lk
As artificial intelligence becomes embedded in cybersecurity, organisations are moving past experimentation and building it into their core security infrastructure.
Kaspersky’s Head of Sales Sam Yan spoke to Techie.lk about how AI is reshaping both attack and defence, where Sri Lankan businesses remain exposed, and what leaders should do next.
How is generative AI changing the way cybercriminals operate? Are we entering an era where AI-powered attacks will become the norm?
In many ways, we are already there. Security providers use AI to speed up detection, reduce analyst workload and counter attacks that move faster than people can. Cybercriminals use the same technology to automate reconnaissance, write convincing phishing content and operate at a scale that once needed significant resources and skill. Every AI capability available to defenders is also available, or adaptable, to attackers.
Our latest research found that 21% of organisations believe cybercriminals are ahead in this race, and 43% say criminals are using technologies like AI to make their attacks more effective.
Attackers are now building generative AI into the full attack chain, from phishing lures and malicious code to evasive payloads and social engineering. Our Global Research and Analysis Team (GReAT) saw this in the RevengeHotels campaign against hospitality businesses in Latin America, where AI-generated code produced more convincing phishing and more evasive malware than earlier waves of the campaign.
For security leaders, the answer is AI-powered protection that is properly integrated into daily workflows, not a collection of isolated tools.
How is Kaspersky using AI to detect and respond to threats more effectively?
We have built AI across our portfolio so security teams can see what is happening, why it matters and what to do next, without adding to their workload.
Behavioural correlation rules learn what normal login activity looks like and automatically flag anomalies as potential account theft. AI-powered asset scoring ranks assets by risk based on the sequence and context of security events, so teams put limited resources where exposure is greatest. AI-generated incident summaries explain the attack chain, entry point and adversary actions in plain language, removing a major bottleneck for under-resourced SOC teams. And AI assistants de-obfuscate command lines and produce concise investigation reports, which speeds up analysis of complex, multi-stage incidents.
How can organisations successfully navigate the convergence of AI and cybersecurity over the next three to five years?
Appetite is not the problem. A 2025 Kaspersky survey found that 99% of companies planning to set up a SOC within the next two years intend to enhance it with AI. Implementation is the hard part.
AI is only as good as the data it works with, so organisations need centralised telemetry across endpoints, identity, cloud and network before AI correlation can deliver. AI added as isolated features to a fragmented stack brings cost and complexity without real benefit. Tools that demand deep configuration can widen skills gaps rather than close them. Governance matters too. Kaspersky signed the European Commission’s AI Pact in January 2025, committing to an AI governance strategy, mapping of high-risk AI systems and AI literacy among staff.
In practice, that means consolidating telemetry before layering AI on top, judging tools by analyst time saved rather than features listed, choosing platforms where AI is built in rather than bolted on, setting internal governance standards that match emerging regulation, and rolling out in phases with measurable baselines.
What are the biggest cybersecurity weaknesses you see among Sri Lankan businesses today?
Many organisations still run legacy systems or delay critical patches, which leaves known vulnerabilities open to attackers, while zero-day exploits add another layer of exposure. With IT environments ranging from government departments to private firms, a one-size-fits-all approach does not work. Organisations need tailored vulnerability management with continuous patching, automated scanning and staff training.
Phishing shows the pressure businesses are under. According to the Kaspersky Security Bulletin 2024, businesses in Sri Lanka faced 9,218 phishing attacks that year from criminals impersonating financial institutions. Regular penetration testing and cyber drills help find weaknesses before attackers do, and government agencies, vendors and security firms need to share information and coordinate their response.
For a country like Sri Lanka that is rapidly digitising government services, banking, commerce and businesses, what should be the biggest cybersecurity priorities?
As government services and banking move online, the cost of a breach rises, because these systems hold exactly the data and money attackers want. The priority is shifting from reactive defence to proactive threat hunting and response, backed by threat intelligence and endpoint detection and response (EDR) tools that shrink the window attackers have to operate.
Kaspersky Endpoint Detection and Response Expert and our Managed Detection and Response service are built to stop attacks at an early stage. For organisations without a large security team, managed detection is often the most practical route.
How would you assess Sri Lanka’s current threat exposure?
Threats grew across the board in 2025. Our systems detected an average of 500,000 malicious files a day, up 7% on 2024, with password stealers up 59% and spyware up 51%. In Asia Pacific, password stealers rose 132% and spyware 32%, a clear sign that criminals are going after credentials across the region.
Sri Lanka recorded 14,960,244 local malware incidents on user computers in 2025, according to the latest Kaspersky Security Bulletin. In total, 37.4% of users were attacked by threats spread through USB drives and other offline media, placing Sri Lanka 48th worldwide for local threat exposure.
Offline infection gets far less attention than internet attacks, but it remains a serious weakness. Businesses need strict control over removable devices, up-to-date endpoint protection with real-time scanning, isolated backups of critical data, and platforms such as Kaspersky Next for visibility across their infrastructure.
How important is cybersecurity awareness among ordinary users, and where do you think Sri Lanka still has the biggest awareness gaps?
It is essential, because most attacks still need a person to click, open or plug something in, and AI is making phishing and social engineering far more convincing.
Removable media is one of Sri Lanka’s clearest gaps. It is still common to share drives between computers in workplaces and educational institutions, and many people simply do not see a USB stick as a risk.
The basics go a long way. Do not plug in unknown drives. Keep software updated. Be wary of messages that appear to come from banks, which remain a favourite disguise for attackers. And use a reliable security solution such as Kaspersky Premium on personal devices.
If you could give one piece of cybersecurity advice to every business leader in Sri Lanka today, what would it be?
Stop treating security as a collection of separate tools. Invest in one integrated platform that gives your team full visibility, catches threats early and takes routine work off their hands. Attackers are moving faster with AI, and patchwork defences cannot keep up.
That is the thinking behind Kaspersky Next, which combines AI-powered endpoint protection with EDR and XDR for organisations of any size. It runs in the cloud or on premises and automates tasks such as patch management, IoC scanning and playbooks, so teams spend less time on routine work. Companies can also move between tiers as their needs grow.
What emerging threat do you think will have the biggest impact on businesses and consumers in the next three to five years?
AI-driven fraud and social engineering. Our 2025 analysis of financial threats found attackers using AI to model victim behaviour, write more persuasive lures and probe infrastructure at a pace manual methods cannot match. We see the same pattern in entertainment, where AI runs through the biggest emerging risks for 2026, from deep fakes to content fraud.
The common thread is speed and scale. AI shortens the time between reconnaissance and compromise, and between building a payload and adapting it to evade detection. The response time advantage defenders once had, has been eroding, and that is the shift businesses and consumers will feel most.