Semperis Report Finds AI Used in 87% of Ransomware Attacks

Semperis said in a press release that attackers used AI in 87% of ransomware incidents covered by its 2026 Ransomware Risk Report. The study included only organizations hit by ransomware during the previous 12 months across the United States, United Kingdom, France, Germany, Italy, Spain, Singapore, Canada, and Australia.

The report found that 40% of attacks involved psychological or physical threats against employees or their families. Respondents said attackers followed through on threats in 53% of reported cases, while 23% of victims or relatives experienced swatting. Another 25% sought psychological or medical treatment, and 24% hired personal security.

Nearly 70% of surveyed victims were attacked more than once, and 31% made multiple ransom payments. Identity systems such as Active Directory, Entra ID, and Okta were targeted in 87% of attacks. Only half of respondents maintained dedicated identity backups, fewer than half automated identity recovery, and 40% lacked Active Directory recovery procedures in their disaster or crisis plans.

Semperis sells identity driven cyber resilience and recovery products for systems such as Active Directory, the area where the report finds gaps.