AI showed up in most ransomware stories this year, and 84% of victims reported it.
Story Snapshot
- A Semperis survey says 84% of victims saw AI used in ransomware attacks.
- The split: 40% faced AI-based attacks; 44% saw their own AI tools turned against them.
- The sample covered 1,200 security pros across nine countries and eight sectors, based on surveys, not case counts.
- Commentators question methods and mixed percentages but not the rise of AI in crime.
What the 84% number really measures
Semperis published a Ransomware Risk Report that puts a bold figure on today’s fear: most respondents, 84%, said their ransomware incidents involved artificial intelligence in some way. The report breaks this into two buckets. Forty percent reported an AI-based attack. Forty-four percent said criminals flipped the victim’s own AI tools against them. This matters because it shows two fronts: smarter attackers and unsafe internal automation. Both raise risk right now, not later.
The survey reached 1,200 information technology and security professionals across nine countries and eight industries, and focused on organizations that faced ransomware. That scope tells us we are hearing from recent victims, not a census of all attacks. That still has value. People closest to the pain often spot pattern shifts first. But readers should read the figure as a field signal, not an official crime statistic.
Where critics push back
The Eastern Herald framed the 84% as a vendor survey result, not a counted share of all ransomware incidents, and asked for clearer definitions and fieldwork details. Runtime Wire flagged a messaging mismatch, noting that one Semperis release cited 87% while the live report page showed 84%. Those critiques focus on method and wording, not the broader truth that criminals now use artificial intelligence to speed research, write lures, and probe networks.
Common sense says to treat precise survey percentages with care. The claim can still be useful if we understand limits and watch the breakdown. The split between outside artificial intelligence use and misuse of a victim’s own tools highlights a practical lesson: if you deploy automation, protect it like a crown jewel. Lock models, restrict prompts, and log access. Do not leave the keys in the ignition for thieves to drive.
How attackers use AI across the playbook
Attackers use artificial intelligence to draft better phishing emails, copy employee tone, and find exposed systems faster. They can test stolen passwords in seconds, shape deepfake voices for social engineering, and auto-translate scams at scale. The result is speed and reach. That does not make every incident a science project. It makes criminals faster and sloppier-proof. Semperis’s respondents described that lived reality when they tagged attacks as “AI-based” or flagged abuse of their own agents.
Semperis's 2026 report surveyed 1,200 IT/security pros across 9 countries — real ransomware victims only. 84% of attacks used AI. 87% targeted AD/Entra ID/Okta. Just 50% back up identity systems separately.https://t.co/pABQ1tC08g
— Bugtraq Solutions (@BugtraqSolution) October 15, 2026
IBM’s public briefings have also charted a rise in automation and ransomware-as-a-service alongside familiar break-in methods, which pairs with the trend line victims report, even if it does not confirm any single percentage. The takeaway is straightforward: artificial intelligence lowers the bar for entry and raises the ceiling for scale. When that happens in crime, volume and damage climb unless defenders change their habits fast.
What actually works to cut risk now
Start with identity because attackers do. Enforce multifactor on all admin accounts. Remove standing admin rights and use just-in-time access. Watch for impossible travel, sudden token minting, and new service principals. Segment backups and test restore. For artificial intelligence systems you run, lock prompts and tools behind strong roles. Record who calls model endpoints and from where. Treat training data as sensitive. If a criminal can hijack your agents, they can move inside your walls as you do.
For email and web, block scripts by default and filter attachments in detonation sandboxes. Train staff on short, plain scripts tied to real examples you faced. Keep it adult: “Here is how the scam beat Bob’s guard last week.” Patch exposed edge devices first. Rotate secrets after any vendor breach. If a ransom note hits, call law enforcement fast. The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency can connect you to keys, playbooks, and victims who have been there before.
How to read the headline without getting played
Do not anchor on 84% as gospel. Anchor on the direction of travel. Victims across sectors say attackers are using artificial intelligence tools in more steps of the kill chain. Commentary that picks at wording and survey methods serves a purpose, but it does not erase the clear message: prepare for faster lures, quicker discovery, and insiders’ tools turned outward. Conservative thinking says fix the roof before the storm. The roof here is identity, backup, and control of your own automation.
Sources:
cbsnews.com, easternherald.com, newser.com, ibtimes.com, thehill.com
