Semperis survey finds attackers used AI against 84% of the ransomware victims it polled

The unit of measure comes first. Semperis counted victims: 84% of surveyed victims experienced ransomware attacks in which cybercriminals exploited AI ^[2]. CBS goes further and writes that AI has been incorporated into more than eight in ten attacks ^[15]. The two readings differ when victims are hit repeatedly, and 69% of surveyed ransomware victims suffered multiple successful attacks in the previous year ^[5]. If the 84% means at least one AI-assisted incident, a victim attacked twice could have faced one incident with AI and one without.

The report is Semperis's own ^[1], and the voices CBS uses to interpret it are tied to the company. Chris Inglis, a former White House National Cyber Director under President Biden, is a Semperis board member ^[11]. Tomer Bar is the company's associate vice president of security research ^[16]. The CBS account does not say how respondents established that AI was involved, or how many of the 1,200 were victims ^[1]. Nothing there makes the figures wrong. They are what respondents reported, read by the publisher's own people.

The widest claim in the piece is about who can attack. Inglis described a person without technical expertise using AI to write the code needed to hold a company's data hostage ^[9]. "We have democratized AI to the point where even low level models can allow that to happen," Inglis said ^[10]. A survey of victims cannot show whether the pool of attackers has grown, so that point rests on his account. We do not know yet how large the autonomous share is, and it is better treated as a planning question for the next year than as this week's emergency.

The budget choice is between tooling aimed at AI-assisted attackers and hardening that holds whatever the attacker uses. Inglis argued the targets have not moved. "What's not changed is the things that people or organizations had that is of value that they would pay money or time or energy to protect," he said ^[13]. Identity systems are the digital infrastructure that controls access to a network, and 87% of respondents saw them targeted ^[4]. That figure does not depend on the AI number surviving scrutiny. In our view, identity hardening goes first this quarter for that reason.

The playbook change follows next quarter. Inglis said AI helps attackers find weaknesses quickly, tailor social engineering to specific employees, automate an intrusion and readjust tactics as defenders react ^[14]. A response plan that assumes a fixed intruder needs revising, and the AI systems attackers reportedly exploited at respondents' firms ^[3] belong on the asset list that plan covers.

Playbooks also have to reach people. At more than a third of surveyed victims, employees were threatened psychologically or physically ^[7], and 14% said employees or their family members had been forced to change jobs, move offices or move house ^[8]. Those are decisions for HR and physical security, and a runbook written only for system recovery does not address them.