Cybercrime Hit $21B in 2025: What AI Dev Teams Need to Know
FBI reports $21B in cybercrime losses in 2025. Here is what development teams using AI coding assistants need to know and how to respond.
The Number That Should Change Your Risk Model
The FBI's 2025 Internet Crime Report puts cybercrime losses at nearly $21 billion across more than one million complaints. That is a record. More importantly for software teams, it reflects a changed threat environment, one where AI coding assistants have become a meaningful variable in the attack surface equation.
This is not a scare story. It is a business case for treating security tooling as infrastructure, not an afterthought.
How AI-Assisted Development Changes the Loss Equation
The traditional model for estimating breach exposure starts with the size of your customer database and the cost per record. That model is incomplete for teams using AI coding assistants, because it does not account for velocity.
When a developer using Cursor or Copilot ships a vulnerability, that vulnerability often appears across multiple files and services simultaneously. The AI reuses patterns consistently. A single flawed authentication function generated by an LLM may be called in ten different API routes. A misconfigured environment variable pattern may be replicated across three microservices.
This means the blast radius of a single AI-introduced flaw is larger than the blast radius of the equivalent human-written bug. The developer who writes one unsafe SQL query writes it once. The AI that generates one unsafe SQL query may generate it dozens of times across a session.
Where the $21B Is Coming From
The FBI report points to investment fraud, business email compromise, and tech support scams as the top loss categories. But the attack paths enabling those frauds increasingly route through compromised software infrastructure. Credential theft from vulnerable web applications funds phishing campaigns. Misconfigured cloud storage leaks the customer data that makes social engineering effective.
For software teams, the connection is indirect but real: the code you ship is part of the ecosystem that either enables or prevents these losses.
What Secure-by-Default Looks Like in Practice
The response is not to stop using AI coding assistants. The productivity gains are real and the competitive pressure is not going away. The response is to build security checks into the development workflow so that AI-generated code passes through a gate before it ships.
# .github/workflows/security.yml
name: Security Scan
on: [pull_request]
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install Vouch CLI
run: pip install vouch-cli
- name: Scan for vulnerabilities
run: vouch scan --repo . --fail-on high
The key design choice here is --fail-on high. This means high-severity vulnerabilities block the merge. Medium and low severity issues create a report but do not block. This threshold catches the issues that cause real losses while not creating so much friction that developers route around the check.
The CTO Calculation
For technical leaders, the $21 billion figure translates to a concrete expected value calculation. If your company processes transactions or stores customer data, your breach probability without active security tooling is not zero. The cost of a breach, including regulatory fines, customer notification, remediation, and reputational damage, typically runs between $100,000 and several million dollars for a mid-sized company.
The cost of automated security scanning integrated into your CI pipeline is a fraction of that. The ROI is not ambiguous.
The complicating factor is velocity. Teams under pressure to ship quickly deprioritize security tooling because the benefit is probabilistic and the cost of setup is immediate. The FBI's numbers are a useful corrective to that bias: the probability of a costly incident is high enough that the expected value of prevention is reliably positive.
Key Takeaways
- FBI data puts 2025 cybercrime losses at nearly $21 billion, reflecting a threat environment where compromised software infrastructure is a core attack path.
- AI coding assistants increase the blast radius of individual vulnerabilities because they replicate patterns consistently across a codebase, not just once.
- Building security scanning into CI pipelines as a pre-merge gate is the most cost-effective response, combining low friction with high coverage of AI-introduced vulnerability classes.