Report Links AI to 84% of Ransomware Attacks
A new Semperis report, cited by CBS News, says AI is linked to 84% of ransomware attacks. That is a serious warning signal—but it is not proof that AI caused 84% of attacks, or that autonomous ransomware has already become the norm.
The number is the news. Its definition is the test.
“Linked” Does Not Explain AI’s Role
CBS News reports that cybersecurity firm Semperis found AI connected to 84% of ransomware attacks. The available summaries do not say whether that connection meant AI-generated phishing, faster reconnaissance, malicious code assistance, negotiation support, or autonomous execution.
Those are materially different threat models.
An attacker using AI to polish a convincing phishing email is a real operational advantage. An attacker running a system that independently identifies targets, gains access, encrypts systems, and demands payment would represent a much larger shift in cyber risk. One percentage cannot safely stand in for both.
The Methodology Is the Constraint
The report’s significance depends on the underlying sample: which attacks were studied, over what period, and what threshold qualified an incident as AI-linked.
Without that detail, the 84% figure compresses several possible behaviors into a single headline statistic. It may describe a broad adoption signal—that ransomware groups are increasingly using AI somewhere in their workflows—rather than a measured rise in fully AI-directed attacks.
That distinction should shape how businesses read the claim. The immediate implication is not necessarily that every company needs to defend against autonomous ransomware tomorrow. It is that familiar attack paths may be getting cheaper, faster, and more convincing for criminals to run.
Autonomous Attacks Raise the Stakes—Separately
CBS News also reports that a former White House cyber chief warned autonomous attacks are already here. That warning adds important context: the direction of travel in cybercrime is toward more automated operations.
But it does not validate the 84% number or show that Semperis counted autonomous attacks in its sample.
Modern Ghana’s matching headline suggests the statistic is already circulating beyond its original CBS coverage. Distribution can amplify a claim quickly; it does not independently verify the methodology behind it.
Watch the Attack Chain, Not Just the Percentage
The next useful proof point is an attack-by-attack breakdown. Businesses should ask where AI entered each incident:
- Did it improve social engineering? - Did it automate reconnaissance or vulnerability discovery? - Did it assist with malware development? - Did it control execution after initial access?
That breakdown turns a broad association into an actionable risk model. AI used for phishing points toward identity controls, employee verification, and email defenses. AI used for autonomous lateral movement or ransomware execution would require a different level of detection, segmentation, and response planning.
Semperis’s reported figure is credible as a warning that AI is becoming embedded in ransomware operations. For now, it is not a quantified causal trend—and it should not be presented as proof that autonomous ransomware is already widespread.