Eight in ten ransomware victims say artificial intelligence helped the criminals hit faster, harder, and cheaper.
Story Snapshot
- Semperis reports 84% of surveyed ransomware victims saw some AI in the attack.
- The split: 40% faced AI-based attacks; 44% saw their own AI tools turned against them.
- The survey covers 1,200 IT and security pros across nine countries and eight sectors.
- Some outlets note it is a victim survey, not a forensic count of all attacks.
What the new number really says
Semperis’s 2026 Ransomware Risk Report says most respondents—84%—faced attacks that used artificial intelligence in some way. The firm breaks that into two buckets. Forty percent reported an AI-based attack. Forty-four percent said attackers hijacked their own artificial intelligence tools or systems. This places artificial intelligence across the kill chain: phishing, privilege hunting, and noisy cleanup jobs. The figure reflects what victims reported, not a universal registry of all ransomware events, but it is a signal too large to shrug off.
CBS News says the study reached 1,200 information technology and security professionals in nine countries and eight sectors. That gives a broad window into how victims experienced attacks. It also explains why the number moves headlines. People who clean up breaches say artificial intelligence is there, often. The pattern aligns with what frontline responders have warned for two years: automation lowers the bar to launch, speeds recon, and sharpens social engineering.
Where artificial intelligence shows up in the attack
Attackers lean on artificial intelligence in three obvious spots. First, in social engineering, to write clean emails, clone voices, and adapt lures in minutes. Second, in recon and lateral movement, to map identity systems and spot weak paths to crown jewels. Third, in scripting and tooling, to chain exploits, rotate infrastructure, and evade watchlists. Semperis’s split—AI-based attacks and the flip of victims’ own agents—tracks with these realities and with today’s identity-first attack paths.
Victims who run chatbots, code copilots, or predictive models face a twist. Those systems hold tokens, roles, and data. If criminals seize them, they get reach and speed. That is not a sci-fi threat; it is the same principle as turning a help desk tool into a skeleton key. The message is simple: your artificial intelligence is part of your attack surface. If it talks, stores, or acts, it must authenticate, log, and fail safe like any admin tool.
The healthy skepticism—and what still stands
The Eastern Herald reminds readers the 84% figure comes from a vendor survey, not a census of every ransomware case. It questions how “AI involvement” was defined, who qualified as a respondent, and notes mixed percentages in public materials. Runtime Wire flags a release that cited 87% versus 84% on the report page and says the sample targets recent victims. Those caveats are fair. They anchor expectations and protect against hype while we sort signal from noise.
The core takeaway still holds under scrutiny. A large, cross-industry sample of people who handled real ransomware events reports broad artificial intelligence use by attackers. That does not prove a global rate. It does show where defenses must harden now: identity systems, help desk flows, artificial intelligence agent permissions, and response playbooks. Common sense says treat survey precision cautiously, but do not wait for a perfect denominator before fixing known gaps.
What to do before your name is on the board
Close the doors criminals like most. Lock down identity providers, directory services, and single sign-on with strong multifactor, least privilege, and just-in-time access. Put every artificial intelligence agent—chatbot, code helper, data pipeline—behind role-based access, with scoped tokens and explicit deny on high-risk actions. Log prompts, outputs, and actions. Send those logs to your detection stack. Run purple-team drills that assume an artificial intelligence-boosted phish and fast lateral movement. Practice clean restore at scale.
Semperis's 2026 report surveyed 1,200 IT/security pros across 9 countries — real ransomware victims only. 84% of attacks used AI. 87% targeted AD/Entra ID/Okta. Just 50% back up identity systems separately.https://t.co/pABQ1tC08g
— Bugtraq Solutions (@BugtraqSolution) October 15, 2026
Pare your crown-jewel blast radius. Segment networks. Put service accounts on a diet. Rotate keys often. For small shops, pick managed identity and backup services with built-in ransomware detection and immutable snapshots. For boards and agency leads, set one metric you will read each month: mean time to detect and to contain. That is how you beat automation—by training for speed and by making sure no single tool, human or artificial, can break your whole house in one bad click.
Sources:
cbsnews.com, easternherald.com, newser.com
