Identity Infrastructure Hit in 87% of Successful Ransomware Attacks

Identity systems became the primary ransomware target

A survey of 1,200 IT and security professionals who experienced successful, business-disrupting ransomware attacks found that 87% saw attackers target or exploit identity infrastructure. Only 42% had automated identity-recovery capabilities, and just 50% maintained dedicated identity backups.

The Semperis 2026 Ransomware Risk Report, published October 14 across nine countries and eight industries, surveyed only organizations that had already suffered attacks severe enough to disrupt operations. Among that population, 69% experienced multiple successful attacks and 59% paid a ransom at least once.

For enterprise buyers, this means conventional backup programs that cannot rapidly restore Active Directory or cloud identity leave organizations unable to authenticate users, administer systems, or recover encrypted workloads. Budget separately for identity backups, privileged-access protection, automated directory recovery, and AI-agent permissions rather than treating ransomware resilience as an endpoint-only purchase.

The competitive boundary is shifting. Backup vendors now compete with identity-security vendors, while endpoint detection providers must demonstrate recovery capability, not just detection. Identity-resilience platforms from Semperis, Microsoft Entra ID, Veeam, Rubrik, Cohesity, and Commvault compete directly with security platforms from Palo Alto Networks, CrowdStrike, and SentinelOne.

AI agents compressed attack timelines from weeks to hours

Palo Alto Networks researchers analyzed an attack in which AI agents performed every major phase of the intrusion and moved through an enterprise network in less than 10 hours. Comparable work by human operators could have taken roughly two weeks.

This raises the value of autonomous security operations and rapid prevention that operate locally and automatically, rather than defenses dependent on a human SOC analyst reviewing alerts after encryption begins. Security teams should evaluate whether their products can detect and constrain AI-driven reconnaissance, credential use, lateral movement, and data theft.

Procurement tests should include time-to-containment and automated isolation, not simply detection rates or alert volume. AI-agent governance, workload identity, and least-privilege controls are becoming ransomware requirements.

MFA presence did not prevent compromise in 97% of credential-based attacks

The Semperis survey found that 97% of ransomware incidents in which credential compromise was the root cause involved MFA somewhere in the target environment. This does not show that MFA is ineffective. It shows that the presence of MFA alone did not prevent compromise, likely because attackers abused session tokens, compromised recovery paths, bypassed weak enrollment processes, or exploited identities outside protected workflows.

Enterprises should avoid using "MFA deployed" as a sufficient ransomware-control metric. RFPs should distinguish between basic MFA coverage and phishing-resistant authentication, administrator protection, machine and service-account controls, token and session protection, and recoverability of the identity plane.

Phishing-resistant authentication such as FIDO2 and passkeys, conditional access, privileged identity management, identity-threat detection, and identity recovery from Microsoft Entra, Okta, Cisco Duo, CyberArk, BeyondTrust, and specialized identity-resilience vendors compete across these layers.

Attack volume reached a new quarterly high

Comparitech data counted 2,627 publicly claimed ransomware attacks in Q3 2026, the highest quarterly total recorded. The count tracks leak-site claims and excludes attacks that were not publicly disclosed or resolved without a public extortion claim.

A separate NCC Group bulletin reported 1,073 ransomware attacks in August 2026, up 12% from July. The industrial sector accounted for 329 attacks, or 31%, while North America represented 44%.

The concentration in industrial environments benefits vendors with operational-technology and critical-infrastructure capabilities, including Dragos, Claroty, Nozomi Networks, Microsoft, Palo Alto Networks, and endpoint vendors offering network segmentation and immutable recovery integrations. It also increases competition among backup providers over ransomware recovery guarantees and isolated-copy architecture.

Industrial and critical-infrastructure buyers should prioritize offline or logically isolated backups, recovery testing, privileged-access monitoring, segmentation, and protection for internet-facing firewalls and remote-access gateways. Public attack counts do not provide a probability of compromise for an individual company, but the sector concentration supports larger resilience budgets for manufacturing, energy, healthcare, and other operational environments.

What to watch

Move ransomware spending from endpoint prevention alone toward identity resilience and automated recovery. Require security platforms to demonstrate AI-agent containment and sub-hour response, not merely post-event detection. Treat isolated, tested recovery copies and industrial segmentation as core controls, especially where downtime affects physical operations.

The Semperis figures are based only on organizations that already experienced successful, disruptive ransomware attacks and should not be interpreted as prevalence rates for the entire enterprise market.