Semperis Survey: 84% of Ransomware Victims Say Attackers Used AI, and 40% Faced Threats Against Staff

Semperis, a New Jersey identity security and crisis response company, released its 2026 Ransomware Risk Report today, Oct. 14. The headline number: in 84% of attacks, threat actors "weaponized artificial intelligence," according to the company.

That figure needs context. The survey covered about 1,200 IT and security professionals in nine countries and eight industry sectors. It was run with the research firm Censuswide in the first half of 2026.

Every respondent worked at an organization that had been hit by ransomware in the previous 12 months. The results describe what victims experienced. They do not measure how common AI-assisted ransomware is across all organizations, and the AI attribution reflects respondents' own assessments rather than independent forensic work.

Threats against people, not just systems

The more unsettling findings involve intimidation. Semperis says 40% of attacks involved psychological or physical threats against staff. The report separately says bad actors used psychological intimidation in nearly 25% of attacks across the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada and Australia.

Where threats were made, victims said attackers followed through in 53% of cases. Semperis reports that 24% of victims or family members were swatted, 25% sought psychological or medical treatment, and 24% hired personal security. Among the other figures, 37% reported threats against family or friends and 25% reported doxxing.

"An attacker has one goal in mind: They want to extract something from you," said Chris Inglis, the first U.S. National Cyber Director and a Semperis strategic adviser. "Holding you at physical risk is the latest phenomenon because we've covered most of the other risks."

Tim Beasley, a Semperis senior incident response consultant, described the toll on security teams. "I have seen CISOs say, 'I'm out. I'm done. I can't do this. It isn't worth it,'" he said. He added that he has seen people leave when leadership blamed them for the breach.

Both Inglis and Beasley work for or advise the company that sells the services the report recommends. Their accounts are worth reading as such.

Identity systems are the target

Semperis says 87% of attacks targeted identity infrastructure. The report breaks that down by platform: Active Directory at 51%, Microsoft Entra ID at 48%, and Okta at 27%.

Tomer Bar, a Semperis security research executive, warned that sufficient Active Directory privileges let ransomware operators move between machines and encrypt systems across an organization.

The recovery side looks thin. Only 50% of surveyed organizations kept dedicated identity backups, and 42% had automated identity recovery. Documented recovery procedures covered Active Directory at 60%, Entra ID at 52%, and Okta at just 28%.

The report argues that restoring identity infrastructure to a trusted state matters more than bringing machines back online. Otherwise, compromised systems can come back with the attacker's access intact.

Repeat attacks and ransom payments

In nearly 70% of cases, victims were targeted more than once. Semperis puts the share at 69% in the preceding year. About 59% of victims paid a ransom, and 31% made multiple payments, per the company's release.

Among organizations that paid, 23% said they could not eject the attackers. The report also found 79% of attacks hit during evenings or weekends, when staffing is typically thinner.

AI on both sides of the firewall

The report says 44% of respondents experienced attacks that exploited their own AI agents or systems. On defense, 49% said they successfully used AI for detection or response. Another 23% reported defensive AI failures.

Semperis recommends restricting agentic AI access to identity infrastructure, so a compromised agent does not inherit powerful permissions. Security leaders quoted in the report's coverage argue that organizations should deploy AI aggressively for defense and tighten identity controls.

What the survey can and cannot settle

The sample is a vendor-commissioned survey of people who were already victims. Respondents were asked about AI involvement, and the 84% figure rests on their judgment of what hit them. Many ransomware investigations never establish whether attackers used AI for phishing text, code or reconnaissance, so respondents may be counting different things under the same label.

The dollar impact is also absent from the figures Semperis released. No payment totals or ransom amounts appear in the findings made public today.

It is unclear whether the identity-recovery gap will close. With only half of victims keeping dedicated identity backups and Okta covered by just 28% of recovery plans, the report's own numbers suggest most organizations are not ready for a repeat attack. By its count, a repeat attack is what most victims should expect.