Survey Finds AI in 84% of Ransomware Attacks, Identity Systems Primary Target
A new study reveals artificial intelligence tools were present in most recent ransomware incidents, with identity management platforms facing intense criminal scrutiny.
Key points
- Eighty-four percent of surveyed ransomware victims reported AI involvement in attacks.
- Identity infrastructure, including Active Directory and Entra ID, was targeted in 87% of cases.
- Nearly half of organizations successfully used AI for detection, while 23% saw defensive tools fail.
A recent survey of security professionals indicates that artificial intelligence played a role in eighty-four percent of ransomware incidents affecting surveyed organizations. The findings highlight a significant shift in how criminal groups operate, leveraging automated tools to accelerate intrusions and exploit weaknesses in enterprise access controls.
The data comes from a study of one thousand two hundred IT and security experts across nine countries and eight industry sectors. Crucially, the research focused exclusively on organizations that suffered successful ransomware attacks causing business disruption. This means the figures reflect reported experiences within a victim sample rather than a comprehensive global measurement of all ransomware activity worldwide.
Context and Background
The survey results suggest that criminals are increasingly using AI to identify system weaknesses, tailor social engineering efforts, and automate intrusion phases. Former US National Cyber Director Chris Inglis told CBS News that these tools allow attackers to adjust tactics dynamically during defensive responses. He also noted that autonomous ransomware attacks are already occurring, though the survey does not quantify how many incidents were fully self-directed.
Semperis security research executive Tomer Bar warned that large language models can speed up the development of malicious code. These models also help criminals test their encryption implementations more rigorously. Bar’s assessment suggests that fewer implementation errors by attackers could reduce opportunities for defenders to recover encrypted data without paying ransoms.
Who Is Affected
Identity infrastructure emerged as the primary target, with eighty-seven percent of respondents reporting attacks on these systems. Specific platforms faced heavy scrutiny, with Active Directory targeted in fifty-one percent of cases. Microsoft Entra ID appeared in forty-eight percent of incidents, while Okta was involved in twenty-seven percent. Organizations often faced attacks involving multiple identity platforms simultaneously.
The technical concern extends beyond file encryption, as identity infrastructure determines access for users, services, and applications. The defensive landscape remains mixed. Forty-nine percent of respondents successfully used AI for detection or response, but twenty-three percent reported that their defensive AI tools failed. Additionally, forty percent experienced AI-based attacks, while forty-four percent encountered attacks exploiting their own deployed AI agents or systems.
What should you do?
Organizations should review their identity governance strategies to ensure robust access controls are in place. Security teams must monitor for unusual activity in identity platforms like Active Directory and Entra ID. It is essential to maintain established recovery planning procedures, as AI deployment does not eliminate the need for traditional defensive measures.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: Active Directory
- Audit identity infrastructure configurations to minimize exposure to credential theft and privilege escalation.
- Monitor logs for anomalous behavior in Active Directory, Entra ID, and Okta environments.
- Verify that defensive AI tools are functioning correctly and not producing false negatives.
- Maintain offline backups and tested recovery plans to mitigate ransomware impact without paying.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does the study prove AI is used in all ransomware attacks globally?
No, the findings are based on survey responses from one thousand two hundred victims and should be interpreted as survey evidence rather than independent forensic confirmation.
Which identity platforms were most frequently targeted?
Active Directory was targeted in fifty-one percent of cases, followed by Microsoft Entra ID at forty-eight percent and Okta at twenty-seven percent.
Were defensive AI tools effective for most organizations?
Nearly half of respondents, or forty-nine percent, successfully used AI for detection or response, while twenty-three percent reported their tools failed.
