The Pulse
Semperis Says AI Featured in 84% of Ransomware Attacks
Semperis says 84% of ransomware-hit organizations surveyed experienced attacks involving AI, including attacks that manipulated victims’ own AI systems. Its 2026 report also finds repeated attacks, threats against employees and families, an
AI.info Team · Written with AI ·
Eight in 10 ransomware-hit organizations surveyed by Semperis said their attacks involved artificial intelligence, according to the company’s 2026 Ransomware Risk Report, released October 14. The 84% figure covers two reported patterns: 40% experienced AI-based attacks, while 44% said attackers manipulated their own AI agents or systems.
The distinction matters: the figure describes respondents’ reported experience, not an independent count of confirmed attacks or a measure of how much AI contributed to each incident. Semperis partnered with research firm Censuswide to survey 1,200 IT and security professionals across nine countries and eight sectors in the first half of 2026. The company included only organizations that had suffered at least one successful ransomware attack.
Two routes to AI involvement
Semperis groups attacks using AI and attacks exploiting a victim’s AI systems under the same 84% headline. In the report, the former category accounts for 40% of respondents and the latter for 44%. Those figures describe what organizations reported experiencing; the report does not detail how respondents verified AI’s role in each attack.
Organizations also reported using AI defensively: 49% said they used AI to detect or defend against ransomware, while 23% said their defensive AI tools failed to detect or stop the attack. The results point to both sides of the operational challenge: companies are adding AI to security tools while also reporting that attackers have exploited their own AI systems.
“AI is increasing not only the speed, scope, and scale of cyberattacks, but also their sophistication,” Chris Inglis, former U.S. National Cyber Director and a Semperis Strategic Advisor, writes in the report. He adds that some attacks may not be recognized as AI-assisted because they are “too slick, too sophisticated.”
Repeated attacks and threats beyond the network
The report also describes pressure that extends beyond data theft or locked systems. Semperis says nearly 70% of respondents were targeted multiple times and 31% made multiple ransom payments. Forty percent of attacks involved psychological or physical threats against staff, according to the company’s release.
In 53% of cases involving threats, respondents said attackers followed through. The report says 17% faced physical threats and 23% psychological intimidation; it also lists threats to family members and friends among the tactics reported. Those findings concern the people and organizations surveyed, rather than a representative sample of all ransomware incidents.
“An attacker has one goal in mind: They want to extract something from you. And the only way they're going to do that is to make the cost of resisting their demands greater than the cost of giving in,” Inglis said in Semperis’s release. He described physical intimidation as a tactic used after attackers had already applied other forms of pressure.
Identity systems remain a recovery weak point
Semperis reports that 87% of surveyed organizations experienced ransomware attacks targeting Active Directory, Entra ID or Okta. Active Directory was targeted in 51% of cases, Entra ID in 48% and Okta in 27%; organizations could report more than one system.
Preparation for restoring those systems lagged behind their exposure. Half of the organizations maintained dedicated identity backups, fewer than half automated identity recovery, and 60% said their disaster-recovery or crisis-response plans lacked identity-recovery procedures. Those gaps leave identity recovery as a specific weakness in the responses documented by the survey.
The report’s findings describe organizations already hit by ransomware, not the overall rate of attacks across businesses. Within that group, the sharpest contrast is between the 87% reporting attacks on identity infrastructure and the 60% whose response plans omit procedures to recover it.