The rise of AI tooling as part of the attacker playbook has become a significant factor in why ransomware attacks have become harder to detect until it is too late.
According to a global survey of cybersecurity professionals by Proofpoint, of those organizations which have been hit by a ransomware attack, almost two thirds (65%) said that AI increased the effectiveness of the attack.
The AI tools did this by helping cybercriminals to produce more convincing phishing emails, impersonation attacks and credential theft campaigns.
“Across the incidents examined in this report, evidence of AI involvement was the norm, not the exception,” said the 2026 AI-Era Ransomware Report, published on July 22.
According to analysis of the incidents, the initial point of entry for a ransomware attack commonly involved human interaction. Of the incidents studied, 47% involved malicious links at some point of the attack chain, 46% involved malicious attachments and 36% involved credential harvesting.
According to the report, when respondents were asked why the ransomware attack was able to bypass their existing controls, 40% said that the initial lure appeared legitimate to the extent that the employee did not suspect anything was wrong.
Previously, many malicious emails, attachments and websites contained subtle signs which might look suspicious enough to provide pause for thought, such as clumsy phrasing, mismatched logos, or ‘official’ login pages that don’t look quite right.
Now, empowered with AI tools, attackers have the capability to make these lures look like legitimate business communications.
Read more: Why Ransomware Remains One of Cybersecurity’s Most Persistent and Costly Threats
“AI hasn’t fundamentally changed ransomware, but it has materially improved the attacks that lead to ransomware,” said Ryan Kalember, chief strategy officer at Proofpoint.
“Today’s attackers are using AI to create highly convincing phishing emails, malware components like scripts, and credential theft campaigns that exploit human trust at scale. Organizations that continue treating ransomware and data extortion as endpoint or recovery problems are missing what these attacks most frequently begin with: people, identities and trusted communications.”
It is not only people who are being duped by AI-based attacks, enterprise software protection solutions and technical controls regularly failed to identify malicious activity.
Of those surveyed, a third said existing email security controls failed to detect the attack entirely, while a quarter cited misconfiguration or gaps in security controls.
“Organizations that want to reduce ransomware risk must focus on stopping attacks at the point of entry, protecting identities from compromise, and responding before attackers can turn access into extortion,” said Proofpoint.
