The 2026 Ransomware Risk Report, released by cybersecurity company Semperis, surveyed 1,200 IT and security professionals across nine countries and eight industry sectors, exposing significant weaknesses in corporate identity protection and recovery capabilities.
The findings indicate that cybercriminals are exploiting artificial intelligence to strengthen their operations while increasingly attacking the systems responsible for managing employee identities, authentication and access to critical business resources.
Among respondents, 44% reported that attackers exploited their organisations’ own artificial intelligence systems or agents. This finding highlights an additional vulnerability as businesses deploy automated technologies with access to sensitive information and internal applications.
The research covered organisations that had experienced successful ransomware attacks during the preceding 12 months. Consequently, its findings describe the experiences of affected businesses rather than the proportion of all organisations encountering ransomware.
Identity infrastructure emerged as a particularly vulnerable component of enterprise security. Attackers targeted systems including Microsoft Active Directory, Microsoft Entra ID and Okta, which control access privileges and authenticate users across corporate networks.
Compromising these systems can enable criminals to obtain elevated permissions, move between connected networks and obstruct recovery operations. Identity services are also essential for restoring normal business functions after an attack.
Despite widespread targeting, only half of surveyed organisations maintained dedicated identity backup systems. Fewer than half had automated identity recovery capabilities, leaving many dependent on manual restoration procedures during potentially disruptive incidents.
The report also found that 60% of organisations lacked identity-specific recovery procedures within their disaster recovery or crisis response plans, exposing a mismatch between the infrastructure attackers target and the systems businesses prepare to restore.
Semperis chief executive Mickey Bresman said ransomware operations had evolved beyond encrypting corporate information, with criminals adopting additional pressure tactics as organisations improved their backup and recovery capabilities.
The study identified repeated attacks as another persistent problem. Nearly 70% of surveyed victims experienced multiple ransomware incidents, while 31% made more than one payment to attackers.
These figures suggest that an initial compromise or ransom settlement does not necessarily end an organisation’s exposure. Attackers may retain access, exploit unresolved vulnerabilities or return after businesses resume operations.
Financial extortion was accompanied by threats against employees and their families. The research documented psychological intimidation, threats of physical violence and other forms of coercion intended to increase pressure on organisations to pay.
Some victims reported that attackers carried out their threats. The findings also described cases involving police emergency responses triggered by false reports, alongside employees seeking medical or psychological assistance following incidents.
Chris Inglis, the first United States National Cyber Director and now a strategic adviser to Semperis, said attackers sought to make resistance more costly than compliance with their demands.
The growing use of artificial intelligence adds another dimension to these pressures. AI tools can assist criminals with reconnaissance, deceptive communications and the automation of certain operational tasks, although their precise contribution varies between attacks.
The survey’s 84% figure should not be interpreted as evidence that artificial intelligence independently executed every attack. It encompasses reported involvement of AI technologies within broader ransomware operations.
Similarly, the findings do not establish that artificial intelligence caused the attacks to succeed. Exploited credentials, inadequate access controls and weaknesses in identity recovery remain important factors in understanding organisational exposure.
The research was conducted by Censuswide during the first half of 2026, covering respondents from the United States, Britain, France, Germany, Italy, Spain, Singapore, Canada and Australia.
Its focus on previously victimised organisations provides detailed information about attack experiences but limits comparisons with businesses that successfully prevented ransomware intrusions.
The findings also underline the distinction between maintaining conventional data backups and restoring trusted access to corporate systems. Recovering encrypted files alone may not restore operations when identity infrastructure remains compromised.
Security teams therefore face separate challenges involving the protection of privileged accounts, the monitoring of authentication systems and the ability to rebuild identity services without preserving attackers’ access.
The report examined these issues alongside ransom payments, operational disruption and the personal consequences of attacks, drawing on responses from professionals responsible for managing technology and cybersecurity across the eight participating industry sectors.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
