Bosnia and Herzegovina tops a new global ranking of countries most exposed to artificial intelligence (AI)-driven cyber threats, scoring zero across all cybersecurity measures despite one in five organisations already using AI, according to a Check Point Software Technologies study of 38 nations.

The report, which assesses countries by three criteria—extent of AI integration, cybersecurity preparedness, and overall threat exposure—reveals a widening governance gap where governments are adopting AI far faster than they are building the defences to protect it.

Bosnia and Herzegovina recorded the lowest Security Index score of 22 out of 100. Its 20 percent AI adoption rate across public, business, and technology sectors is matched by a complete absence of cybersecurity policy frameworks, critical infrastructure protection, and cyber crisis management plans. Botnet attacks, which involve the remote infection of devices on a mass scale, are the most common threat the country faces.

Kuwait ranks second, carrying the highest cyber threat exposure in the entire top 10. Nearly 19 percent of Kuwait’s digital infrastructure is vulnerable to attack, even as the country expands AI use at a similar pace to Bosnia. Gaps in critical infrastructure protection and crisis management leave it persistently exposed.

Qatar, third on the list, integrates AI at a significantly faster rate than its neighbours. Around 38 percent of the country’s organisations already use the technology, yet cybersecurity measures for critical infrastructure remain largely absent. Ransomware is the primary weapon used against Qatari systems.

Jamaica and Costa Rica complete the top five. Both countries have adopted AI across a fifth or more of their tech and business sectors without implementing matching regulatory or security responses. Jamaica scores only 40 out of 100 on cybersecurity policy, while Costa Rica leaves just 6 percent of its digital systems exposed for now, a figure experts warn will rise as hackers increasingly target fast-adopting nations.

New Zealand leads the study in AI diffusion, with 41 percent of public, business, and technology sectors already using the technology, placing it ninth on the vulnerability ranking with a security index of 64. Sweden, which recorded the highest cybersecurity score in the top 10, still only achieved 72 out of 100.

A Check Point expert warned that AI has fundamentally changed attack mechanics: “AI agents handle reconnaissance, launch infections, and adapt to defences, compressing multi-day operations into minutes.”

The study, which evaluates threat exposure across botnets, infostealers, banking trojans, ransomware, and mobile attacks, adds urgency to calls from Check Point for governments to embed security-by-design principles into national AI strategies from the outset, rather than treating cybersecurity as an afterthought once adoption is already underway.