Most ransomware victims now say artificial intelligence touched their attack, and the details explain why that matters.
Story Snapshot
- Semperis reports 84% of surveyed victims saw artificial intelligence used in ransomware incidents.
- The split: 40% faced AI-based attacks; 44% saw attackers hijack their own AI tools.
- Media echoed the figure, while some outlets flagged survey limits and wording gaps.
- The core risk centers on identity systems like Active Directory and cloud identity, which attackers prize.
What the new report actually found
Semperis surveyed 1,200 information technology and security professionals across nine countries and eight sectors. The firm says most respondents, 84 percent, reported that attackers used artificial intelligence in some part of the ransomware operation. Respondents split that experience into two buckets. Forty percent said the attack itself was artificial intelligence-based. Forty-four percent said the criminals turned the victim’s own artificial intelligence agents or systems against them. That breakdown frames both outside and inside risk.
Coverage reached a wide audience fast. CBS News led with the 84 percent figure and the survey size. Other outlets repeated the topline and the two-bucket split. This matters because many leaders scan headlines and set budgets based on short summaries. The takeaway is clear. Artificial intelligence now plays a role in most ransomware cases the surveyed group faced, and identity systems sit in the blast zone.
Where the number is strong—and where it is not
The 84 percent figure comes from the company’s own instrumented survey, not from a forensic count of every attack in the wild. That is a valid way to gauge lived experience across many firms. It helps show shape and urgency. It does not prove a general rate across all ransomware globally. Some coverage also noted different wording and even a stray 87 percent reference in a release, which calls for tighter definitions from the publisher.
Readers should not throw out the finding because it is a survey. The mix of attack types that respondents cited makes operational sense. Criminals can use artificial intelligence to write convincing phishing emails, scan exposed services, or script basic exploitation. They can also nudge a victim’s own chatbots, code assistants, or workflow agents to leak secrets or change settings. That dual pathway matches what defenders report on the ground and what training teams now simulate.
What aligns with common sense and conservative priorities
The data fits a pattern: criminals pick the cheapest, fastest tool to get paid. Artificial intelligence lowers cost and speeds up work, so criminals use it. Companies that left identity systems open or gave bots too much access invited trouble. That is not a tech mystery; it is a stewardship failure. The right response is sober: lock down identity, log everything, test backups, and drill recovery. Spend on controls that cut risk per dollar, not on flashy hype.
Semperis's 2026 report surveyed 1,200 IT/security pros across 9 countries — real ransomware victims only. 84% of attacks used AI. 87% targeted AD/Entra ID/Okta. Just 50% back up identity systems separately.https://t.co/pABQ1tC08g
— Bugtraq Solutions (@BugtraqSolution) October 15, 2026
Policy should reinforce accountability without smothering innovation. Set clear rules for audit trails on artificial intelligence tools. Require strong identity checks for admin actions. Encourage voluntary incident sharing with safe harbors so others can learn fast. Punish criminals hard, including those sheltered by hostile states, through sanctions and seizures. The state’s role is to raise the cost of crime and backstop victims, not to micromanage tools that also power growth.
How leaders can act this quarter
Inventory every artificial intelligence integration and agent that accesses identity systems. Cut their permissions to the minimum needed. Enable multi-factor authentication for all admins and service accounts. Set conditional access rules and strong token lifetimes. Audit prompt logs and model outputs for data leaks. Train staff to spot synthetic phishing. Run a tabletop on an identity-takeover ransomware event and time each step to restore access. Tie budget to measured risk drop, not to vendor claims.
Measure, then verify. Ask security teams to show the number of privileged accounts, stale credentials, and unprotected service principals. Track how fast your team can rotate keys, rebuild directory services, and restore business apps. Share a plain-English after-action note with your board. If a vendor cites a big percentage, ask for the sample, questions, and definitions. Favor primary evidence. Reward teams for removing attack paths, not for buying more dashboards.
The bottom line
The survey’s message is loud and practical: criminals are folding artificial intelligence into ransomware because it works. The exact global percentage is debatable, but the defensive playbook is not. Secure identity first. Right-size artificial intelligence access. Prove backups and recovery steps under real pressure. Leaders who act on those basics will blunt both flavors of the threat—the artificial intelligence the attackers bring, and the artificial intelligence you already run that they hope to twist.
Sources:
cbsnews.com, easternherald.com, newser.com, ibtimes.com
