Remember when the scariest thing about ransomware was a badly spelled ransom note? Those days are gone. The crooks have found the same productivity tools as everyone else, and they're shipping faster than your sprint team.
1,200 Security Pros, One Grim Report Card
Security firm Semperis released its 2026 Ransomware Risk Report this week, surveying 1,200 IT and security professionals across nine countries and eight industries, as covered by CBS News. The headline stat: 84% of surveyed victims said attackers used AI somewhere in their ransomware attack. Even more unsettling, 44% said attackers exploited the victims' own AI agents or systems.
The rest of the numbers aren't exactly a pick-me-up. 69% experienced multiple successful attacks in the previous year, 59% paid a ransom at least once, and 87% faced attacks targeting identity systems — the infrastructure that decides who gets into what. More than a third reported psychological or physical threats against employees, and 14% said staff or their families had to change jobs, offices or even homes because of ransomware threats.
Your Helpful AI Agent Is an Attack Surface
That 44% figure deserves its own spotlight. Companies are racing to give AI agents access to inboxes, CRMs, file stores and admin panels — and attackers have noticed that a well-meaning agent with broad permissions is basically a skeleton key with a friendly chat interface. As one Semperis crisis-management lead put it, "AI agents typically try to accomplish their assigned tasks by any means they can." That's a great trait in an intern and a terrifying one in a service account.
The angle most people miss: AI didn't invent new ways in. The report suggests breaches still lean on familiar weaknesses — identity, permissions, sloppy access controls. AI just makes attackers faster, with Semperis researchers noting "more attacks with more rapid development," and harder to attribute. A former White House National Cyber Director on Semperis's board went further: "I think we're already seeing autonomous attacks." The fix isn't panic, it's fundamentals done consistently — least-privilege access for humans and bots, monitored identity systems, and a recovery plan you've actually rehearsed.
The robots aren't coming for your data. The people using robots are — and they're counting on you to have given your chatbot admin rights.
If you've plugged AI agents into your website or business systems and never mapped exactly what they can touch, our team can help you scope those permissions down before someone else tests them for you — let's talk.
Source: CBS News