44% say attackers exploited their organization’s own AI agents or systems, and 23% say their AI defense tools failed to detect or stop an attack.
Key Takeaways
- Semperis reports that 84% of the 1,200 IT and security professionals it surveyed, all at organizations hit by ransomware in the past year, had an attack that involved AI. It gets the 84% by adding the two answers below.
- 44% said attackers exploited their organization’s own AI agents or systems. 40% said attackers used AI to carry out an attack.
- 49% said they used AI successfully to detect or respond to an attack, but 23% said the AI tools they used for defense failed to detect or stop one.
- 87% said attackers targeted the systems that control who can log in and what each person or program can access. Only 50% had dedicated backups of those systems.
In a survey published Oct. 14 by Semperis, 84% of IT and security professionals at organizations hit by ransomware in the past year had an attack that involved AI in some way.
Semperis, a cybersecurity company, surveyed 1,200 professionals in nine countries. The 84% is the combination of two answers. 44% said attackers exploited their organization’s own AI agents or systems, and 40% said they were hit by what Semperis calls an “AI-based attack.”
23% say their AI defense tools failed to detect or stop an attack
Companies are using AI to defend against ransomware, and Semperis says the “results are mixed.” 49% of respondents said they used AI successfully to detect or respond to an attack. 23% said their AI defense tools failed to detect or stop one.
87% say attackers targeted their company’s login systems, and only half kept separate backups of them
87% of respondents said attackers targeted their identity systems, the software that controls who can log in and what each person or program can access.
Only 50% had dedicated backups of these systems, and 42% had tools that restore them automatically. Semperis says that without such backups, a restored system can bring back malware and hidden entry points that let the attackers back in.
AI agents raise the stakes for login systems: an attacker who takes over an agent gets everything the agent can reach. Semperis CEO Mickey Bresman said, “Organizations have no way of predicting what an AI agent will decide to do and what unexpected effect its actions might have. An attacker that exploits that agent gains that same level of access.”
Methodology
Semperis surveyed 1,200 IT and security professionals in the first half of 2026. Every organization surveyed suffered at least one ransomware attack in the past 12 months that disrupted its business. The survey covered organizations in the US, UK, France, Germany, Italy, Spain, Singapore, Canada, and Australia, across eight industries, including finance, healthcare, manufacturing, and government.
