iGaming cyber threats evolving as AI and data risks change industry

The iGaming sector is becoming an increasingly attractive target for cybercriminals, driven by its real-time transactions, high-value users and large volumes of sensitive data.

According to Superbet’s Chief Information Security Officer Jay Balan, the nature of cyber risk has evolved sharply in recent years.

Where fraud and account takeovers once dominated, operators now face more complex threats. These include supply-chain attacks, large-scale identity abuse and AI-driven social engineering.

As Balan puts it, the industry’s threat surface hasn’t just grown, it has fundamentally changed shape.

Operators struggle with prioritisation, not tools

For many operators, the biggest challenge isn’t the cybersecurity tools. It’s about prioritisation. When you have rapid business growth, regulatory demands and systems that are getting more and more complex, gaps form in decision-making. Internal security strategies can’t always keep up with new tech.

Operators end up spending less time on implementation and concentrate more on what’s happening right now and what matters most in the moment.

Artificial intelligence is adding further pressure. Attackers are using AI at scale in their efforts. At the same time, operators are using AI-driven defences to keep up.

However, Balan warns the industry is only partially prepared. Awareness is high, but operational maturity is still developing. The risks with AI aren’t just malicious. There are risks using it internally without oversight or proper governance.

AI may strengthen defences, sure. But it can’t replace strong processes, architecture and skilled teams.

Expanding risks from identity, data and integrations

Three areas are now central to cybersecurity risk in iGaming:

• Identity.
• Integrations.
• Intelligence.

Identity has become the new frontline.  Attackers are increasingly targeting login systems and user credentials. At the same time, third-party integrations, like with payment providers, are creating more potential entry points.

When you add in AI automation, attackers can now probe systems faster than many operators can respond. This is pushing the industry towards predictive risk modelling. Reactive defence isn’t quick enough or good enough.

The sector’s data-heavy nature also increases its appeal. Operators process large volumes of personal and financial data in real time. This makes them high-value targets.

We don’t just want to prevent breaches. We need to detect and contain them quickly. Strong segmentation, limited access controls and better system visibility are now essential. Slow detection and manual responses are what turn incidents into major crises.

Collaboration and cultural change needed

Industry collaboration is increasingly seen as critical. While partnerships with fintech firms have grown in areas such as safer gambling, cybersecurity cooperation is still limited.

Cybercriminals already share intelligence. Operators must start to do the same through joint simulations and shared threat data.

There are also lessons to learn from finance. Their security is treated as a core part of maintaining trust. In iGaming, this means changing the perception of cybersecurity from a cost centre to a form of brand protection.

Operators should focus on three priorities:

1. mapping real-world attack paths.
2. Improving detection and response times.
3. Embedding security into product design from the outset.

Ultimately, the biggest gap is a cultural one. Cybersecurity must be built into every part of the business.