Artificial intelligence appeared in ransomware incidents affecting 84% of surveyed victims, while 87% reported attacks targeting or exploiting identity infrastructure.
The findings connect accelerated criminal operations with weaknesses in the systems governing enterprise access.
The study surveyed 1,200 IT and security professionals across nine countries and eight industry sectors. Crucially, it included only organizations that experienced successful ransomware attacks causing business disruption.
The headline figure therefore describes reported experiences within a victim sample, not a verified measurement of all ransomware attacks worldwide.
The findings should be interpreted as survey evidence, rather than independent forensic confirmation of AI involvement across incidents.
These categories distinguish adversaries using AI capabilities from attackers manipulating technology already deployed inside victim environments.
Former US National Cyber Director Chris Inglis told CBS News that AI helps attackers identify weaknesses, tailor social engineering, automate intrusions, and adjust tactics during defensive responses.
He also said autonomous ransomware attacks are already occurring, although the survey does not establish how many incidents were fully autonomous.
Semperis security research executive Tomer Bar warned that large language models can accelerate malicious code development and help criminals test encryption implementations.
His assessment suggests fewer implementation mistakes could undermine opportunities for defenders to recover encrypted information without paying.
The defensive picture remains mixed. Nearly half of respondents, 49%, successfully used AI for detection or response, while 23% said their defensive AI tools failed.
These findings indicate that deploying AI does not eliminate the need for established access controls and recovery planning.
Semperis reported that, 40% of respondents experienced AI-based attacks, while 44% encountered attacks exploiting their own AI agents or systems.
AI-Powered Ransomware Attacks
Active Directory, Microsoft Entra ID, and Okta emerged as prominent targets. The report lists Active Directory at 51%, Entra ID at 48%, and Okta at 27%; organizations could experience attacks involving more than one identity platform.
The technical concern extends beyond encrypted files. Identity infrastructure determines which users, services, and applications receive access.
Compromising this layer can let adversaries abuse trusted privileges, while manipulated AI agents introduce another route for exploiting permissions already available inside an organization.
Semperis crisis management executive Courtney Guss warned that task-driven agents seeking additional permissions could expose identity systems to unintended compromise.
The report consequently recommends restricting agentic AI access to identity infrastructure rather than treating internal automation as inherently trustworthy.
Only 50% of surveyed organizations maintained dedicated identity backups, and 42% had automated identity recovery solutions.
Documented recovery procedures covered Active Directory in 60% of organizations, Entra ID in 52%, and Okta in just 28%.
This gap matters because restoring business systems without returning identity infrastructure to a trusted state risks reintroducing attacker access.
Semperis emphasizes secure identity restoration as a prerequisite for operational recovery, not simply another backup task.
Repeat compromise compounds the pressure: 69% of victims experienced multiple successful attacks, and 59% paid ransom at least once.
Meanwhile, 37% reported threats against employees’ friends or families, demonstrating that extortion increasingly extends beyond corporate systems.
For security leaders, the report’s central implication is operational: constrain AI permissions, prepare identity-specific recovery procedures, and rehearse coordinated crisis response.
Faster detection alone cannot compensate for an identity environment that remains compromised after systems return online.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
