Artificial intelligence (AI) systems have permeated every modern society aspect performing a functions variety from driving vehicles and helping doctors diagnose diseases to interacting with customers as online chatbots [1][2]. This remarkable progress is primarily due to significant breakthroughs in machine learning (ML), deep learning, and the enormous increase in computing power [3]-[5]. However, even as AI technology has advanced and become more sophisticated it remains highly vulnerable to an ever-increasing number of cybersecurity threats and malicious attacks. Hackers can deliberately confuse or even “infect” AI systems to cause them to crash, and developers currently have no reliable means of protecting against this. Unlike traditional software, AI systems possess unique characteristics that significantly expand their attack surface and introduce fundamentally new threat vectors. These characteristics include a strong dependence on the quality and integrity of training data, the complexity and opacity of many models (“black box”), and their adaptive nature [6]-[8]. Attackers can exploit these features to manipulate the behavior of AI systems, extract sensitive information, or disrupt their normal functioning, potentially causing significant financial losses, reputational damage, and, in some cases, a threat to human safety [9]. Expert assessments and reports highlight the urgency of the issue, showing that the proportion of properly secured AI applications remains low, and many organizations face AI security challenges, including vulnerability management and maintaining regulatory compliance [10].

The following statistics clearly demonstrate the alarming and significantnature of this trend. The number of incidents related to cyber attacks on AI systems in 2025 was about 16,200 cases, which is 49% more than in 2024. The average cost of an incident reached $ 4.8 million in 2025 [11][12]. Table 1 provides major incidents brief description involving attacks on AI over the past 3 years and their consequences.

Table 1.Description of attacks on AI systems and their consequences.

AI system components include data, a machine learning model, the infrastructure and processes needed to use it. Because machine learning approaches rely on large amounts of data, AI systems face additional security and privacy concerns beyond classic cyber threats. Additionally, AI tools are increasingly being connected to corporate documents and databases for specific use cases. This integration into existing systems only increases the attack surface exposing organizations to the threat of attackers gaining access to confidential and proprietary information.

The purpose of this review article is to conduct a comprehensive and systematic analysis of the AI cybersecurity landscape, identify key vulnerabilities, classify the main attack vectors, and propose effective countermeasure strategies throughout the AI lifecycle.

To achieve this goal, the following objectives were set to:

systematize and classify the main types of vulnerabilities inherent in AI systems at various stages of their design, development, and deployment;develop a comprehensive taxonomy of cyberattacks on AI systems, detailing the mechanisms, targets, and potential consequences of attacks on data, algorithms, and platforms;identify and describe the most effective technical, organizational, and regulatory countermeasures and risk mitigation strategies;identify existing gaps in current research and practical approaches to ensuring AI cybersecurity, and outline promising areas for future research.

The scientific novelty of this work lies in the presentation of a comprehensive, multi-layered framework for the analysis and mitigation of cybersecurity risks of AI systems, integrating vulnerabilities, attacks, and countermeasures at each stage of the AI life cycle.

Unlike existing reviews, which often focus on individual aspects, such as adversarial attacks or data protection, this paper offers a holistic view that covers a unique classification of vulnerabilities linked to the phases of the AI lifecycle (see Table 2), allowing for more targeted application of protective measures. It also presents an expanded attack taxonomy (see Table 3) that categorizes threats not only by target (data, algorithm, platform) but also by their mechanism and deployment location, providing a more detailed understanding of impact vectors.

Furthermore, the paper provides an integrated set of countermeasures proposed in the context of the identified vulnerabilities and attacks, facilitating the development of comprehensive defense strategies rather than isolated solutions. This framework serves as a foundation for a more structured and proactive approach to ensuring the security of AI systems, providing researchers and practitioners with a systematic knowledge base for analysis, risk assessment, and the development of effective defense mechanisms.

Advancements in Data Science and Computer Science have led to the emergence of ML, the most prominent type of AI in organisational cyber security [13][14]. The vast amounts of data generated by organisations provide opportunities for a wide range of ML applications in cyberspace, including threat intelligence, anomaly detection, and automation of cybersecurity-related tasks [15]. ML’s role in cybersecurity dates to the 1990s with the development of anomaly detection systems (ADS) and intrusion detection systems (IDS) [16], though progress was hindered by data and computing limitations [17]. Today, AI is integral to cybersecurity, transcending corporate jargon [18][19]. It can simulate human intelligence and behaviours, resulting in automation in cyber security beyond human capability, which can detect a security breach in a network within seconds [20]. General information about AI systems, their cybersecurity state, as well as the classification and attack mechanisms description on them are presented in many different works [21]-[24]. Abuse attacks that are typical for generative AI used by intruders in the process of manipulating tools such as chatbots and image generation tools are described in detail by Chen Yang [25], Garbuk S.V. [26], Jie Yang, Jun Zheng [27].

The article purpose to consider AI systems cybersecurity ensuring features taking into account their vulnerabilities, possible attacks and countermeasures. Research methodology combines system and comparative analysis, modeling, forecasting, grouping, scenario assessment.

The term “AI cybersecurity” refers to a broad range of factors, strategies, technologies and regulatory measures aimed at protecting AI systems from cyber risks, threats and malicious attacks. It includes identifying, assessing and addressing potential vulnerabilities in AI systems, as well as developing specific measures to protect these systems from malicious actors [23][28][29]. Assessing cyber risks in the evolving AI landscape is challenging due to AI growing complexity and interconnectedness with many vital systems. Research institutions, government agencies and leading AI organizations are actively exploring effective approaches to address these challenges.

Effective protection of AI systems requires a comprehensive, multi-layered approach spanning their entire lifecycle, from design to operation. Because AI systems face unique threats, traditional cybersecurity measures must be complemented by specialized strategies. It is important to apply the principles of “secure by default” and “security by design”, which integrate security measures from the earliest stages of development. However, the development and implementation of these countermeasures occurs in the context of a dynamic “arms race,” where new defenses inevitably lead to the emergence of more sophisticated adaptive attacks that bypass specific defense.

Data Level Security

Data is the foundation of AI, so protecting it is critical to the integrity and privacy of the system. Robust data validation and sanitization are essential to prevent data poisoning by implementing rigorous input validation procedures to identify and filter malicious or anomalous records during the training and inference phases (See Table 3, column “Countermeasure Examples”, row “Data Poisoning”). This involves using algorithms to detect outliers, noise, and adversarial examples in the input data before feeding it to the model.

Data confidentiality and integrity are ensured by using encryption for data both at rest and in transit, and by using anonymization and pseudonymization techniques such as differential privacy to protect sensitive information (See Table 3, column “Countermeasure Examples,” row “Data Leakage/Inference Attacks”). Strict role-based access control (RBAC) mechanisms for databases and storage used by AI systems also play a key role. “Privacy by Design” principles require the integration of privacy protection mechanisms at every stage of the AI lifecycle.

Model/Algorithm Level Security

Protecting the AI model itself from manipulation and theft is a key aspect of AI cybersecurity. Robustness against adversarial attacks is increased through adversarial training, in which the model is trained on data supplemented with adversarial examples, which increases its resilience (See Table 3, column “Countermeasure Examples,” row “Adversarial Examples”). The use of robust optimization and regularization methods helps create models that are less sensitive to small changes in input data. Defensive distillation, which trains a “student” model on “softened” outputs of a “teacher” model, also contributes to increased robustness. Input randomization, adding small random noise or transformations to the input data, can destabilize adversarial examples. When comparing these countermeasures, it’s important to note the tradeoffs. While adversarial training can significantly improve a model’s robustness to known attack types, it often increases computational costs and can degrade model performance on typical (non-adversarial) data. Differential privacy (see Table 3, column “Examples of Countermeasures”, row “Data Leakage/Inference Attacks”), while providing strong mathematical guarantees of privacy, typically entails a decrease in model accuracy, which is a critical trade-off for many applied scenarios. Robust optimization, in turn, is a more general approach, but its effectiveness depends heavily on the choice of robustness metrics and model complexity.

Protection against model theft and inversion includes encryption and obfuscation of model parameters during storage and transmission, and the use of Model Watermarking to track model usage (see Table 3, column “Examples of Countermeasures”, row “Model Theft”). Federated learning is an approach that allows models to train on decentralized datasets without directly sharing the data itself, which protects privacy and reduces the risk of model inversion. Model monitoring and anomaly detection involve continuously monitoring the model’s performance, bias, and anomalous behavior in real time. This also includes drift detection—identifying changes in the distribution of input data or output predictions that indicate attacks. Using explainable AI (XAI) helps understand the reasons behind model decisions, facilitating attack detection and diagnosis.

Prompt injection protection for generative AI requires strict validation of user prompts for malicious instructions and clear separation of system instructions for Large Language Model (LLM) from user input. Sandboxing limits LLM’s ability to interact with external systems, and output filtering and sanitization validate AI-generated content before it is used (see Table 3, “Countermeasure Examples” column, “Prompt Injection” row).

Platform and Infrastructure Level Security(MLOpsSecurity)

The security of the underlying infrastructure on which AI is deployed and operated is ensured by MLOps (Machine Learning Operations) practices. Secure MLOps practices include integrating security (DevSecOps) into every stage of the MLOps pipeline: from planning and development to testing, deployment, and monitoring (see Table 3, column “Examples of Countermeasures,” row “Attacks on the AI Supply Chain”). Supply chain security involves auditing all third-party libraries, frameworks, and pre-trained models, as well as using tools for generating AI bills of materials (AI-BOMs). Infrastructure protection is achieved by using secure execution environments such as containers or trusted execution environments (TEEs), network segmentation, regular software updates, and patching (see Table 3, column “Examples of Countermeasures”, row “Runtime Vulnerabilities”). Secure storage and management of API keys, credentials, and other secrets is also an important measure. Auditing and logging all operations and access to AI systems is necessary for incident investigation. Automated security testing, including static (SAST) and dynamic (DAST) code analysis, as well as specialized AI security testing, should be integrated into CI/CD pipelines.

Organizational and Regulatory Measures

Beyond technical measures, institutional and legal approaches to AI risk management are critical. AI Governance Frameworks, such as the NIST AI Risk Management Framework (AI RMF), provide a structured approach to managing AI risks throughout the lifecycle, with a focus on reliability, transparency, fairness, accountability, and security. Also important is the OWASP Top 10 for LLM Applications—a list of the most critical security risks specific to LLM applications, such as prompt injection, improper output handling, training data poisoning, and supply chain vulnerabilities, with recommendations for mitigating them. International initiatives, such as the EU AI Act and the OECD Principles, set legal and ethical standards for the development and use of AI. Training and awareness-raising for staff, including developers, data engineers, security specialists, and end users, about specific AI risks and best practices is key. Establishing clear roles and responsibilities for AI security-systems, as well as mechanisms for auditing and evaluating AI decisions, promote accountability. Integrating ethical principles such as fairness, transparency, and accountability into the AI design and development process helps minimize the risks of bias and discrimination.

The comprehensive application of these countermeasures across all levels and stages of the AI lifecycle is the only way to create truly reliable, secure, and ethical AI systems that can withstand the ever-evolving cyber threat landscape.

Despite significant progress in understanding and mitigating AI cybersecurity risks, this area of research is still in its early stages. Numerous unsolved problems and gaps remain that require further attention from researchers and practitioners. Current reports indicate a significant gap between AI adoption and the development of adequate security measures.

The rapid and pervasive adoption of artificial intelligence (AI) systems across various areas of human activity, from critical infrastructure to everyday consumer applications, has created a new and complex cybersecurity landscape. Unlike traditional information systems, AI systems have unique characteristics such as data dependence, complex black-box models, and adaptive nature that give rise to fundamentally new types of vulnerabilities and attack vectors. This review article presented a comprehensive and systematic analysis of AI cybersecurity, covering their unique vulnerabilities, attack taxonomies, and comprehensive countermeasure strategies throughout the AI lifecycle. We categorized vulnerabilities by design, development, deployment, and operational phases (see Table 2), highlighting how weaknesses at each stage can be exploited by attackers. The proposed attack taxonomy (see Table 3) detailed threats targeting data (poisoning, adversarial examples, data leakage), algorithms/models (theft, inversion, backdoors, prompt injection), and platform/infrastructure (supply chain attacks, API exploitation, runtime vulnerabilities), providing deep insight into the mechanisms of impact and concrete examples such as malicious prompts for LLM. In response to these threats, multi-layered countermeasures have been considered, including data protection through strong validation, encryption, and anonymization; model protection through improved robustness to adversarial attacks (comparative analysis of methods such as adversarial learning and differential privacy), anti-theft and anti-inversion methods, as well as continuous monitoring and explainability implementation; platform and infrastructure protection through the implementation of secure MLOps practices, such as DevSecOps for AI, supply chain security, and access management; and organizational and regulatory measures, including AI governance frameworks (NIST AI RMF, OWASP Top 10 for LLM, Applications), personnel training, and ethical principles.

Particular attention was paid to the concept of an “arms race,” emphasizing the need to continually refine defense mechanisms in response to evolving attack techniques. Despite these efforts, the field of AI cybersecurity still faces significant research gaps, such as the need for more proactive and adaptive defense mechanisms, the development of explainable AI cybersecurity, the security of autonomous agent systems, and the creation of comprehensive risk assessment methodologies. Future research directions should focus on the development of autonomous and self-healing safety systems, deeper integration of humans in the loop, formal verification of AI systems, and the development of standards to ensure sustainable and safe AI development. We also formulated specific research questions, concerning security metrics, zero-sum attack detection, black-box verification, and ethical and legal responsibility, highlighting the unresolved challenges in this area.

Ensuring the cybersecurity of AI systems is not just a technical challenge, but also a fundamental requirement for maintaining public trust, the ethical use, and the sustainable development of AI technologies in our ever-changing digital world. Only through the coordinated efforts of researchers, developers, regulators, and users can a truly secure and reliable AI ecosystem be built.