Follow ZDNET: Add us as a preferred source on Google.

ZDNET's key takeaways

• New CDW research shows AI use in cyberattacks is increasingly common.
• 43% of organizations surveyed have experienced AI-enhanced phishing attacks.
• 41% of companies plan to use AI in their cyber defenses.
  

Forty-three percent of organizations have experienced AI-enhanced or AI-generated phishing attacks, and 37% have encountered AI-augmented malware, according to a new survey. 

CDW's 2026 Security Research Report is based on a survey of 951 IT decision-makers across a variety of industries. Published Monday, the research reveals what appears to be an AI arms race between cyberattackers and defenders. Many organizations are considering investing in AI threat detection, training, and controls to combat the new face of modern cyber threats: AI techniques, tactics, and technologies. 

AI-driven cyberattacks, by the numbers

There are serious numbers in the report that deserve our particular attention. One or two cyber incidents against high-profile organizations involving a sophisticated AI model is one thing, but there's an undercurrent of quiet, malicious AI attack development that is far more likely to impact the average company. 

According to the report:

• 43% of organizations have experienced AI-enhanced or AI-generated phishing attacks.
• 37% of respondents reported encountering AI-powered malware.

Also: AI agents are fast, loose, and out of control, MIT study finds

In addition, when survey respondents were asked which AI-enabled cybersecurity threats pose the greatest risk to their organizations, 25% said AI-generated phishing and social engineering attacks were most concerning, followed by AI-powered malware and automated attack tools (21%). These attack vectors appear to have overshadowed worries about deepfakes, with only 8% of respondents citing deepfake impersonation as the biggest risk to their companies. 

An AI breach is a matter of when, not if

For years, security experts have warned companies to adopt the mindset that they will experience a security breach at some stage -- it's a matter of when, not if.

With the rapid emergence of AI-backed, fully autonomous, agentic attacks, this message is more pertinent than ever. 

Also: OpenAI's attack agent did exactly what it was told - just more relentlessly than expected

It was only this month that Hugging Face revealed an intrusion by agentic AI. Although the organization's own AI defenses caught it, the case highlights what companies face in keeping their systems, data, and customer records safe.

In total, 41% of respondents to the CDW survey said they planned to deploy AI-driven threat detection systems in the near future, with 49% focusing on threat and anomaly detection, 47% exploring threat intelligence analysis, and 42% opting for phishing and fraud detection. 

"We should be concerned about the increasing ability of AI as a technology to discover and exploit weaknesses," commented Buck Bell, director of CDW's Global Security Strategy Office. "It's incumbent now on security practitioners to leverage similar tools to find those weaknesses before the bad guys find them."

There are also risks associated with the internal use of AI for business and productivity purposes. Without proper training and controls, employees may accidentally feed sensitive corporate data into LLMs -- exposing information and potentially handing it over for AI training. Without safety guardrails, AIs tasked with company functions could exceed their assigned roles and disrupt operations.

Thankfully, more organizations are now aware of these risks. In total, 46% of respondents say they frequently assess AI infrastructure and closely monitor it, while 45% intend to train their employees on safe and secure AI use. Furthermore, 44% are working on implementing data protection controls for AI systems and integrating AI systems into existing security monitoring workflows.

Also: 10 ways AI can inflict unprecedented damage 

What portion of organizations' AI-related budgets should go to near-term productivity goals versus longer-term security and resiliency needs? If we are going to stop malicious AI from overwhelming organizations already hard-pressed to handle traditional security threats, we face some difficult decisions about investment priorities.   

Security

How to get free Windows 10 security patches until October 2027 - and avoid the $30 fee

Your smart home may be at risk - 6 ways experts protect your devices from attacks

The 10-step phone security tune-up you should run every year - and why

There are 3 obvious signs someone is stealing your Wi-Fi - and several ways to stop them

• How to get free Windows 10 security patches until October 2027 - and avoid the $30 fee
• Your smart home may be at risk - 6 ways experts protect your devices from attacks
• The 10-step phone security tune-up you should run every year - and why
• There are 3 obvious signs someone is stealing your Wi-Fi - and several ways to stop them

ZDNET's key takeaways

• The Synology DS225+ is available now for $364.
• It's well-priced for a pro-grade unit, and can take drives all the way up to 24TB. 
• However, Synology has generated some bad press for itself with some unpopular policies. 

Follow ZDNET: Add us as a preferred source on Google.

Almost every NAS or external hard drive review these days will tell you having your own storage box at home is a guaranteed way to save money as you'll be able to kiss your cloud storage subscriptions goodbye. I've written similar reviews myself, but I'm doing my best to back that up with receipts this time.

Also: I tested my USB-C cables with this free Mac app - some weren't what they claimed

The thing is, it's getting harder to say that a NAS (or a large external hard drive, for that matter) makes sense. For those who do need big storage, the Synology DS225+ can be a great idea, but it's hard to recommend. 

ZDNET RECOMMENDS

Synology DS225+

This two-bay NAS has 2.5GbE support, tool-free trays for drives, and Synology's DiskStation Manager software.

details

View at Amazon

Why is it hard to recommend a NAS?

Bottom line: spiraling storage costs. And AI is to blame. Specifically: AI data centers acquiring all the components for themselves.

A lot has been written about how RAM prices have gone through the roof thanks to overwhelming demand from data centers that can make use of a thousand laptops' worth of RAM in a single rack. This, in turn, has pushed up the price of everything that relies on RAM, from smartphones and computers to the humble Raspberry Pi.

But it's not just RAM that's in crazy demand, the same is true for hard drives. AI companies are buying them up at an unprecedented rate. Earlier this year, hard drive maker Western Digital reported that it had "pretty much sold out" of hard drives, with 89% of its revenue coming from cloud/hyperscaler customers (read: data centers) with the consumer market accounting for only 5%.

Also: I built a whole-home ad blocker with a $7 ESP32-S3 board - and it took just minutes

It's a similar story from other hard drive manufacturers. As with RAM, this demand from AI data centers is pushing up the cost of drives. In the four months up to January 2026, prices were up an average of 46% as reported by Tom's Hardware editor Stephen Warwick. He noted at the time that a 4TB Seagate IronWolf and 24TB Seagate BarraCuda cost $99 and $499, respectively. Now, they'd be closer to $220 and $750 -- if you can even find them.

At the time of writing, the cheapest 4TB NAS drive I found from a reputable outlet was the Western Digital Red Plus, at $195. The sweet spot in terms of price per terabyte is the 8TB Seagate BarraCuda, which you can pick up for $280. 

This means that even the smallest dual-drive NAS kitted out with two 4TB drives and using RAID 1 mirroring (which means that the two drives give you 4TB of usable space), will set you back at least $400. Start putting a serious number of drives into a box -- especially NAS-grade CMR (Conventional Magnetic Recording) drives -- and the math gets ugly fast.

Note: There are two different types of drives that you'll come across in your search for suitable drives -- CMR and SMR (Shingled Magnetic Recording). Without getting into the nitty-gritty technical differences, SMR drives will be cheaper, but you always want to go for CMR drives for NAS units; otherwise, you'll run into problems. Don't believe me? Back in 2020, Western Digital got caught up in a scandal when it shipped SMR drives inside WD Red drives for NAS use. This resulted in multiple class-action suits and settlements that included the court demanding that the company make its labeling clear.

Compare these stratospheric price increases with cloud storage prices. Both iCloud and Dropbox will give you 2TB for $9.99 a month, and that's cloud storage accessible 24/7 from anywhere you have a connection. You're paying for it to be managed by someone else so there's essentially no learning curve, and the scope for user-initiated data-loss is minimal.

Also: Why I switched to a NAS storage drive to backup files - and ditched iCloud and Dropbox for good

But there's another huge advantage to cloud storage: data resilience. Even with the best possible NAS, you're one fire, flood, or theft away from losing your data. There's an old military adage that's equally applicable for backup: "two is one, and one is none." 

What this means is that if you only have one copy of something, you have a single point of failure waiting to bite you. For a proper, reliable backup, you need to follow the 3-2-1 principle -- three copies, two media types, and one that's offsite. Since offsite invariably means cloud, most people with a NAS will still need cloud storage.

Who needs a NAS? It's complicated

So, outside of the deep pockets of AI data center moguls, who are NAS boxes economically viable for? My take has changed over the past year. If you'd asked me back in early 2025, I'd have said that a NAS was for everyone, especially those with a data hoarding habit who didn't want to be nickel and dimed every month.

Nowadays, my answer is more complicated. I'd say you need a specific reason -- scale, speed, privacy/control, or sunk-cost hardware -- and that a NAS is definitely not for people who are chasing a subscription-cancellation fantasy.

So, maybe you're someone with a LOT of data. You have seriously hefty photo and video libraries, big home media collections, or you have multiple devices that all need backing up in one place. I'm talking data well in excess of the 2TB you'd get for $9.99 a month. Even with the currently hugely inflated prices being asked for hard drives, if you factor the hardware costs over several years, a NAS is still the better option.

Then there are those who need access to their data or don't want it anywhere near a third party -- think video editors working with lots of footage, or anyone in a privacy-sensitive line of work. Even for those people for whom a NAS is still right, it's almost always a "NAS-plus-cloud" solution, not a "NAS-instead-of-cloud."

Also: I tested my USB-C cables with this free Mac app - some weren't what they claimed

And it's not just pricing that's putting me off from recommending NAS boxes; the vendors themselves are making it difficult. For example, last year, Synology tried to lock customers into using Synology-validated hard drives. This user-hostile policy was reversed, but only after a backlash, and it remains in place for M.2 drives in NAS boxes that have the appropriate slot. 

Synology also removed both H.264 and H.265 hardware transcoding used for media streaming on hardware physically capable of supporting the feature, shifting the workload to client devices and saving expensive licensing fees for codecs. So much for "you bought it, you own it." At least cloud service providers can only raise prices on you. 

So with all this in mind, and assuming that you are someone who needs a NAS, what unit do I suggest? Well, the Synology DS225+.

Wait, what? Synology?

Yes. Despite the nonsense with drive lock-in and removing the transcoding feature (I'm not walking back on any of that), Synology makes great NAS units. The DiskStation Manager software is, without doubt, the best NAS software I've come across. It turns the NAS box from a Linux server that needs a lot of handholding into a versatile, easy-to-use appliance that you can control locally or remotely, no matter whether you're sitting at a computer, smartphone, or tablet.

The latest DiskStation Manager 7.4 has a built-in AI assistant to help you diagnose and troubleshoot issues quickly and easily. Plus, Synology has a long software and security patch lifecycle that is usually five years or more -- way longer than those of budget competitors, and long enough for the cost-of-ownership math to look good. It also has an active security bug bounty program, which is exactly what I want to see on an internet-facing device housing my data. 

Also: Chrome's next update will kill your adblocker - and make the web less safe

I'm also a big fan of Synology's SHR (Synology Hybrid RAID) disk management system because not only has it proved to be robust, but it also lets you mix and match drive sizes and expand a volume by swapping drives one at a time rather than requiring that you start with a matched set from day one.

Why the DS225+?

First, a 2-bay NAS is the sweet spot in terms of data storage. Yes, 4-bay units and those with more bays are very nice and give you an enormous level of data resilience, but the costs are high, and they encourage rampant data hoarding. If two 24TB drives (the largest that the DS225+ supports) in a RAID 1 setup aren't enough, you probably need to take a close look at why you need so much data.

Also: Your Tenda router could have a hidden firmware backdoor - disable this setting ASAP

The DS225+ is also a good choice thanks to its 2.5GbE port, capable of supporting the unit's 280 MB/s read and 210 MB/s write speeds. This Ethernet port is a massive upgrade over the DS224+'s 1GbE port, which limited its transfer speeds to about 110 MB/s. For this alone, I was more than happy to stomach the $360 to upgrade from older DS220+ and DS224+ 2-bay Synology units.

It's as simple as moving the drives from one unit to the other. And don't worry about fitting drives into a DS225+. If you're using 3.5-inch drives, the process is totally tool-free, and all you need for 2.5-inch drives is a screwdriver. It's about as simple as drive fitting gets and is consistent with how Synology's Plus-series trays have worked for years.

You do have to live with a few compromises, however. First: the Intel Celeron J4125 processor dates back to 2019 and definitely isn't the fastest around for this kind of application. The unit ships with only 2GB of RAM, though this can be upgraded to 6GB -- but remember what I said about the cost of RAM these days. And while the 2.5GbE network port is good enough for most people, especially on a 2-bay NAS, there's no way to add a faster Ethernet port.

Also: Why your RAM options cost 4X more now than last year - even legacy tech prices aren't immune

That said, I can't say that I really care about the hardware spec. It does what I need it to do, and for the price it's more than acceptable. I've tested two DS225+ units over the past few weeks, and I've been nothing but impressed by them. Don't get me wrong, I still vividly remember the drive-lock debacle of 2025 and how transcoding was canned, but despite that, it's a super NAS box.

ZDNET's buying advice

While the base Synology DS225+ is $360, expect the complete NAS to be a lot more once you start adding hard drives into the mix. By the time you've thrown in a couple of 4TB Western Digital Red Plus NAS drives (which, yes, are CMR drives) for just shy of $200 each, the setup is already $760, but it's a package that should give you quite a few years of use.

Featured reviews

I walked 3,000 steps with my Apple Watch, Google Pixel, and Oura Ring - this tracker was most accurate

After using the MacBook Neo for weeks, switching to the Air has been refreshingly sweet

I bought an earwax camera for my toolkit and use it for everything but my ears

LG G6 vs. Samsung S95H: I compared the best OLED TVs of 2026 and made a tough choice

• I walked 3,000 steps with my Apple Watch, Google Pixel, and Oura Ring - this tracker was most accurate
• After using the MacBook Neo for weeks, switching to the Air has been refreshingly sweet
• I bought an earwax camera for my toolkit and use it for everything but my ears
• LG G6 vs. Samsung S95H: I compared the best OLED TVs of 2026 and made a tough choice

Apricorn Aegis Secure Key 3

4.5 / 5

Very good

pros and cons

Pros

• Quantum-resistant encryption
• Totally platform independent
• Very tough, crush-resistant, and IP68 rated

Cons

• Very expensive
• Overkill in terms of capacity for most users.

$199.75 at Amazon$270.19 at Best Buy$200.99 at B&H Photo-Video

more buying choices

Follow ZDNET: Add us as a preferred source on Google.

Losing a laptop is inconvenient, but usually the worst that happens is some finger-pointing and a bit of awkward explaining. Losing an unencrypted USB drive containing client data can trigger a breach notification under HIPAA or GDPR, even if nobody ever plugs it in.

And that's why I recommend hardware-encrypted storage drives. They don't stop you from losing the drive, but they do make the data on it worthless.

Also: Why I still recommend Synology's DS225+ NAS - even if it can't replace your cloud storage

Apricorn is a manufacturer of encrypted storage drives that I've been reviewing -- and using personally -- for years, including the 3NX, the 3Z, and other Aegis keys. Last week, it released a 4TB version of its Aegis Secure Key 3, the highest-capacity hardware-encrypted USB drive of its kind. 

And this isn't some bulky thing that sits on your desk. No, this is a quantum-resistant hardware-encrypted flash drive that you can slip into your pocket.

What is 'quantum-resistant hardware encryption'?

Modern encryption has moved well ahead of letter substitution codes. Imagine a combination lock, but rather than three wheels with 0 to 9 on them, as you have on a locker or toolshed offering 1,000 possibilities, this has roughly the same number of possibilities as atoms in the universe (a mind-bogglingly massive number: a 1 followed by 77 zeros).  

These are not numbers anyone will be able to guess at -- or brute-force -- even with a powerful computer at their disposal.

Also: I ditched Google Drive for my own self-hosted storage - and I wish I'd done it sooner

Well, not yet…

The problem is that computers are getting faster, and quantum computers could boost performance to the point that something considered secure today could be trivial to crack down the line. So, if you're holding data with a long confidentiality shelf life (like health records, company data, or the plans for the Death Star), you want any encrypted data that might have leaked into the wild to stay encrypted for as long as possible.

"Quantum-resistant" encryption protects against the threat posed by "harvest now, decrypt later," and that's what the AES-256 XTS encryption used by Apricorn provides. 

How Apricorn protects against real-world attacks

But while we tend to think of breaking encryption as involving big, fancy supercomputers, most attacks are far simpler, relying on things like default passwords, people using weak ones, or keypads revealing the PIN because the often-used keys show signs of wear.

Yes, high security can fail because of something that simple.

Apricorn has this covered. From shipping the drive with no default passwords or PIN codes, to blocking short PINs and passcodes, to building the keypad from a wear-resistant polymer.

Think you can break open the drive and get it to spill its secrets? The drive has been packed full of epoxy resin to prevent tampering.

Unlike a lot of encrypted flash drives, this one is easy to use and self-contained. There's no app or executable you have to run. You plug it into a USB port, press a button, enter the passcode, and you're in. And because the drive doesn't rely on running an app, it's totally platform-independent, so you can use it on any device that supports USB storage.

Also: The best external hard drives: Expert tested and reviewed

The drive features anti-brute-force protection that wipes the drive if someone tries to guess the passcode, and a built-in unattended auto-lock that secures the drive if you walk away or become distracted.

For an added level of security, there's also the ability to set a self-destruct PIN to quickly wipe the drive of its contents, yet make it seem like it is fully working.

Apricorn says the drive meets and exceeds FIPS 140-3 Level 3 requirements and has submitted it to NIST for formal validation.

It's also IP68 rated against dust and water ingress (completely dustproof and protected against prolonged water immersion), and built from tough, extruded aluminum, so it's drop-resistant and crushproof to 6,500 pounds. 

How it compares to iStorage and Kingston

Apricorn isn't the only player in this market, and the Aegis Secure Key 3 has competition from the likes of the iStorage datAshur PRO+C and Kingston IronKey.

And what's interesting is that when you compare these two against the Aegis Secure Key 3, they're very similar -- until you look at maximum capacity.

Apricorn's real differentiator isn't the drive's security -- AES-256 XTS offers the same quantum resistance across all devices -- it's capacity. Nobody else makes a hardware-encrypted USB flash drive above 512GB, so the 4TB Aegis Secure Key 3 has no direct competitor at that tier.

Who needs 4TB for pocketable storage?

Not a lot of people do, and this is exactly why Apricorn makes the Aegis Secure Key 3 in nine capacities, going from 16GB to 4TB.

Also: This coin-sized flash drive doubles my laptop's storage space - and it's cheaper than you think

However, as Apricorn points out, government agencies, defense contractors, healthcare providers, financial institutions, legal professionals, and digital forensic investigators may find themselves handling sensitive information. There are also all sorts of data that shouldn't travel across networks and require an air-gapped transfer method.

ZDNET's buying advice

A 4TB flash drive that uses quantum-resistant cryptography isn't cheap, and the Aegis Secure Key 3 certainly isn't cheap -- given its $3,000 price tag. But at the lower end of the capacity spectrum, prices start at $169, making this kind of encryption within reach of most.

On paper, the Aegis Secure Key 3 has quite a fair bit of competition, but not when it comes to capacity. If you want a hardware-encrypted flash drive that's bigger than 512GB, you'll be going with Apricorn.