The Vast Majority of Cyber Attacks Now Involve AI, Report Shows

Cybercriminals used AI in their attacks in the vast majority of occasions and many of the attacks focused on attacking identity infrastructure, new data shows.

The findings were reported in the 2026 Ransomware Risk Report by cybersecurity firm Semperis, which polled 1,200 IT and security professionals across nine countries and eight industry sectors.

Most survey respondents, 84 percent, said that they dealt with attacks that used AI in some way. About 40 percent said they were the victims of an AI-based attack, and another 44 percent said the attack involved the manipulation of their own AI agents or systems.

Semperis AVP of Crisis Management Courtney Guss said that the rapid adoption of AI is complicating the defense posture for many organizations.

“If your company is adopting AI agents, you should consider that at some point, those agents will try to compromise your identity systems — even if that action isn’t meant to be malicious,” Guss said. “That’s just how they operate. AI agents typically try to accomplish their assigned tasks by any means they can.”

She went on to say that this situation can lead agents to try to gain more permissions in other systems, broadening the environment they can work in.

“The fastest path to get those permissions is to compromise your identity system, which effectively puts the agent into ‘god mode,’ enabling it to grant itself whichever permissions it needs to accomplish its task. Unfortunately, the agent then becomes a ticking time bomb.”

The targeting of identity systems has become increasingly common. According to the survey, 87 percent of ransomware attacks targeted identity systems such as Active Directory (AD), Entra ID, and Okta. Despite the frequency of the attacks, the survey found that only about half the companies surveyed have dedicated identity backups, automated identity recovery solutions, and identity-specific crisis response procedures.

The vast majority of U.S. companies that endured a ransomware cyberattack paid the ransom. The survey found that 87 percent of companies paid, something cybersecurity experts warned could encourage further attacks.

“So, you pay, you exercise the deductible in your cyber insurance, and you figure you’re done,” Cyber Resiliency and Human Defense expert Sarah Gosler said. “But if you pay but don’t fix the hole in your cybersecurity dam, you’re likely to be hit by another threat actor — sometimes within the same week or month — because now you have a record of payment.”

Sixty-nine percent of respondents said they’d been successfully attacked multiple times. About 30 percent said they experienced two or more attacks on the same day, while 29 percent said attacks happened in the same week. Another 15 percent said attacks occurred in the same month.