Germany’s Federal Office for Information Security, the BSI, published a joint study with the Association of Technical Inspection Agencies, TUV, on Wednesday, October 7, 2026, and its message is blunt. German companies are vulnerable and unprepared for a growing wave of AI-driven cyberattacks, and the exposure is now broad enough that the BSI’s vice president, Thomas Caspers, described AI as having “immediate and strategic consequences for national security.”
The study surveyed roughly 500 companies with at least 20 employees. The numbers describe a threat that has already arrived. One in six companies reported experiencing “a cyberattack or fraud attempt in which AI played, or could have played, a role” within the last twelve months. Only one in ten has specific procedures in place to handle AI-related security incidents. Forty-three percent rely on their general IT security processes without having supplemented them with AI-specific guidelines, and 71 percent admit they are poorly informed about the obligations the European Union’s AI Act places on them.
The Number One Vector Is Still Email
The study identifies the most common attack method as AI-generated phishing emails described as “highly convincing and precisely tailored to specific individuals or companies.” Next come automated attack scripts that autonomously scan for IT security vulnerabilities and dynamically adapt to them. The third growing issue is deepfakes, manipulated audio or video that imitates the voices of company executives to trick employees into approving fraudulent transfers.
Read that list again. The top threat and the third threat both converge on the same weak point: the trust a recipient places in a message that looks and sounds like it came from someone legitimate. Generative models have collapsed the cost of writing a convincing, personalized lure. What used to be a broken-grammar email blasted to millions is now a fluent, well-researched message aimed at one purchasing manager, and the traditional human filter of spotting bad writing is gone.
That is precisely where domain authentication earns its keep. DMARC with an enforced policy does not care how well written the lure is. If the message claims to come from your CEO’s domain and fails SPF or DKIM alignment, a p=reject policy stops it before a human ever reads it. Enforcement takes the cheapest form of impersonation, spoofing your exact domain, off the table and pushes attackers toward lookalike domains that are easier to spot, harder to land in the inbox, and far more visible in DMARC aggregate reports.
What a Prepared Company Looks Like
The gap the BSI and TUV describe is procedural as much as technical. Only one in ten companies has an AI-specific incident playbook, yet one in six is already being hit. Closing that gap does not require exotic tooling. It requires the boring fundamentals applied completely:
Enforce DMARC at p=reject on every owned domain. Monitoring at p=none observes attacks but does not stop them. Half measures give reports without protection.
Watch aggregate reports continuously. When a new sending source appears for your domain, or authentication results shift, that is the telemetry layer where AI-driven campaigns show up first.
Prepare for deepfake voice fraud with process controls, not just awareness. Any request to move money that arrives by voice should require out-of-band confirmation. The study notes this pattern is designed to exploit exactly the employees who handle transfers.
Close the AI Act knowledge gap. Seventy-one percent of companies say they are poorly informed about obligations they already carry under a law adopted in 2024. Sending domains are part of that compliance surface, especially when AI is used to generate marketing content.
The Takeaway
The BSI and TUV study is a warning about Germany, but the pattern it documents is global. AI has made tailored phishing cheap, the attacks overwhelmingly arrive by email, and most organizations are running general IT security processes against an adversary that no longer looks like the one those processes were designed for. Enforced DMARC, clean SPF and DKIM alignment, and someone actually reading the aggregate reports are the minimum foundation. Build that floor first, then work upward.
Every phishing attempt against your domain leaves a trace in your authentication data. Excello Mail turns your DMARC, SPF and DKIM signals into a live view of who is sending as you, so AI-crafted campaigns surface the moment they start. Sign up for free to Excello Mail and see what your domain is telling the world.