Semperis report: AI used in 87% of ransomware attacks, physical threats rise
Semperis says attackers weaponized artificial intelligence in 87% of the ransomware attacks covered by its 2026 Ransomware Risk Report, while threats against employees and their families are becoming a standard pressure tactic. The identity security company, based in Hoboken, New Jersey, also found that identity recovery preparation still lags behind the attacks.
- Semperis says threat actors weaponized AI in 87% of the ransomware attacks in its 2026 report.
- 40% of attacks involved psychological or physical threats against staff, and in 53% of cases victims said the threats were carried out.
- In nearly 70% of attacks, victims were targeted multiple times, and 31% made multiple payments.
- 87% of attacks targeted identity systems such as Active Directory, Entra ID and Okta, yet only 50% of companies keep dedicated identity backups.
- 40% of disaster recovery or crisis response plans lack procedures for AD recovery.
AI and repeat attacks shape the ransomware economy
Semperis, which describes itself as an identity-driven cyber resilience and crisis response company, published the results of its annual global ransomware report on Oct. 14, 2026. According to the company, AI plays a significant role in the ransomware economy. In 87% of attacks, threat actors weaponized artificial intelligence.
The study included only organizations that had been victimized by ransomware gangs in the past 12 months. It found that attacks often do not stop after a first incident. In nearly 70% of attacks, the victims were targeted multiple times, and 31% made multiple payments to attackers.
Semperis CEO Mickey Bresman placed the trend in a longer history. Early ransomware focused on data encryption, he said. Once data backup and recovery systems let companies resist ransom demands, attackers moved to double extortion: encryption combined with data theft and threats to expose or sell that data. "So, it makes sense that we'll continue to see attackers trying to find more ways to make victims pay," Bresman said.
Threats against staff and their families
The report states that overall, 40% of attacks involved psychological or physical threats against staff. Bad actors used psychological intimidation in nearly 25% of all attacks across the U.S., UK, France, Germany, Italy, Spain, Singapore, Canada and Australia, according to the findings.
The figures on the consequences are stark:
- In 53% of cases, victims reported that the hackers followed through on their threats.
- 23% of victims or family members were swatted.
- 25% of victims sought psychological and medical treatment because of the ransomware attack.
- 24% of victims or families hired personal security.
Chris Inglis, the first U.S. National Cyber Director and a Semperis Strategic Advisor, said an attacker's aim is to make the cost of resisting greater than the cost of giving in. "Holding you at physical risk is the latest phenomenon because we've covered most of the other risks," he said.
Tim Beasley, Semperis Senior Incident Response Consultant, pointed to the human toll on security teams. He said he has seen CISOs say they are done, and has seen people leave after leadership thought they had mismanaged something that led to a breach. "It all takes a mental toll," Beasley said.
Identity systems remain the main target
Semperis reports that 87% of ransomware attacks targeted identity systems such as Active Directory (AD), Entra ID and Okta. Elsewhere the report says nearly 75% of successful ransomware attacks targeted or exploited the identity system.
Preparation does not match that exposure, according to the survey. Only about half the companies surveyed have dedicated identity backups, automated identity recovery solutions and identity-specific crisis response procedures. Only 50% maintain dedicated identity backup systems, and less than half automate identity system recovery. In addition, 40% of organizations' disaster recovery or crisis response plans do not include procedures for AD recovery.
Inglis described identity as "the coin of the realm" and said that if an attacker can steal an identity, "they're off to the races." He added that insider threats are not always a literal insider, but often an internal person acting on an external attacker's behalf, or sometimes a process that runs amok. In every case, he said, identity is the core issue.
What it means for organizations
The findings come from a vendor that sells identity protection and recovery products, so the conclusions reflect Semperis' own view of the threat landscape. Within that framing, the report suggests that defenders face attackers who use AI at scale, return to the same victims, and add pressure on individuals as well as on systems.
For security and IT leaders, the data points to two gaps: the lack of dedicated identity backup and automated recovery, and the missing AD recovery steps in many crisis plans. The full Ransomware Risk Report is available on the Semperis website.
