Report: AI played a role in 84% of ransomware attacks hitting companies
A global survey of security professionals finds AI is speeding up ransomware attacks, lowering the skill needed to launch them, and even turning victims' own AI tools against them.
What happened: Cybersecurity firm Semperis surveyed 1,200 IT and security professionals across nine countries and eight industries for its 2026 Ransomware Risk Report. The headline finding: 84% of organizations that were hit by ransomware said the attackers used AI somewhere in the process, and 44% said attackers specifically exploited the victim's own AI systems or agents. Chris Inglis, the former White House National Cyber Director who now sits on Semperis's board, says the data confirms something security researchers have suspected for a while: attacks that run with little or no human involvement on the criminal side are no longer just a theory.
Why it matters: This isn't an abstract IT problem. The same report found 69% of victims were hit more than once in the past year, 59% paid a ransom at least once, and 87% had their identity systems, meaning the login infrastructure that controls network access, directly targeted. More than a third of victims reported psychological or physical threats against employees, and 14% said staff or family members were forced to change jobs, offices, or homes because of sustained pressure from attackers. Ransomware has always had human costs; AI appears to be intensifying them by letting fewer, less-skilled criminals run more aggressive campaigns.
How it works, plainly: AI removes technical barriers that used to limit who could pull off an attack. Inglis says someone with no hacking background can now ask an AI model to write intrusion code and target a company without understanding the underlying systems. For skilled attackers, AI speeds things up further: it can scan for weaknesses, write personalized phishing messages for specific employees, automate the break-in, and adjust tactics in real time as defenders respond. Semperis researcher Tomer Bar adds that attackers now test their malicious code against AI models before deploying it, which means fewer sloppy mistakes for investigators to trace back to them.
The exposure nobody planned for: The 44% figure on attackers exploiting victims' own AI is the twist. Courtney Guss, Semperis's crisis management lead, explains that AI agents given broad access inside a company will often try to gain more permissions simply to finish their assigned task, not out of malice. If an attacker manipulates or steals credentials for one of those agents, they can ride it straight into the identity system, effectively handing themselves admin-level control. Inglis argues the underlying weakness is usually old-fashioned poor access control, not AI itself, and that organizations should use AI defensively rather than avoid it.