What $21 Billion in Cybercrime Losses Means for AI-Shipped Products
FBI's 2025 cybercrime report shows $21B in losses. Here is what CTOs shipping AI-generated code need to understand about the threat landscape they are entering.
$21 Billion and Rising
The FBI's Internet Crime Complaint Center reported 1.1 million complaints in 2025 with losses approaching $21 billion. That number is record-breaking, but the more relevant figure for CTOs shipping software today is not the total. It is the distribution.
Investment fraud, business email compromise, and tech support scams accounted for the headline losses. But infrastructure compromise, credential theft, and ransomware represented a disproportionate share of incidents affecting software businesses specifically. And the entry points are changing.
The Attack Surface That AI Code Creates Fastest
AI-assisted development compresses timelines. A developer who might have taken three weeks to build a user authentication system can now ship something functional in three days. The problem is that the security review cycle does not compress at the same rate. The code ships faster than the scrutiny.
The specific vulnerabilities that show up most often in AI-generated codebases are not exotic. They are the classics:
// Insecure direct object reference: AI generates this pattern constantly
app.get('/api/document/:id', async (req, res) => {
const doc = await db.getDocument(req.params.id);
res.json(doc);
});
// What it should look like
app.get('/api/document/:id', authenticate, async (req, res) => {
const doc = await db.getDocument(req.params.id);
if (doc.owner_id !== req.user.id) {
return res.status(403).json({ error: 'Forbidden' });
}
res.json(doc);
});
The insecure version gets generated because the model learned from examples that often omitted the authorization check. The examples worked. The examples also would have failed a security review.
Why Business Impact Analysis Matters More Than Vulnerability Counts
The traditional way to report on software security uses vulnerability counts: CVSS scores, severity levels, open findings. This framing makes security feel like a compliance exercise. The FBI data reframes it as a business continuity question.
A single exploited IDOR (insecure direct object reference) in a B2B SaaS product can expose every customer's data. At the average breach cost of roughly $4.5 million, that is not a security issue. It is an existential event for an early-stage company.
The business case for scanning AI-generated code before it ships is not about compliance. It is about the gap between how fast AI creates attack surface and how fast traditional review processes close it.
Where the Risk Concentrates
Not all AI-generated code carries equal risk. The highest-risk areas are:
Authentication and session handling because these are complex and context-dependent. LLMs produce patterns that work syntactically but fail at edge cases like concurrent sessions, token invalidation, and privilege escalation.
Data access layers because the AI does not know your data model's sensitivity classification. It generates database queries without the context of which fields contain PII, which objects have ownership constraints, and which operations require audit logging.
Third-party integrations because the AI generates code that connects your system to external APIs. If it hardcodes credentials, logs responses verbatim, or fails to validate webhook signatures, you have handed an attacker a useful foothold.
The Practical Response for CTOs
The goal is not to slow down AI-assisted development. It is to close the gap between code-generation speed and security-review speed. Automated scanning can cover most of the gap:
# .github/workflows/security.yml
jobs:
security-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run Semgrep
run: |
pip install semgrep --break-system-packages -q
semgrep --config=auto --error .
This runs on every pull request and catches the pattern-level vulnerabilities that AI assistants introduce most often. It is not a complete security program. It is the minimum viable gate for code that ships at AI velocity.
Key Takeaways
- The FBI's $21 billion in 2025 cybercrime losses reflects a threat environment where the fastest-growing attack surfaces are the ones that AI-assisted development creates first: exposed endpoints, missing authorization checks, and hardcoded credentials
- Business impact analysis is more useful than vulnerability counts for making the case for automated security scanning. The cost of one exploited IDOR in a production SaaS product dwarfs the cost of any scanning toolchain
- Authentication, data access layers, and third-party integrations are the three areas where AI-generated code concentrates the most risk and where automated review adds the most value