Identity attacks surpass vulnerabilities as top ransomware cause

Identity-based attacks have overtaken system vulnerabilities as the primary cause of ransomware. According to the Semperis 2026 Ransomware Risk Report, 87% of cases targeted identity systems such as Active Directory, Entra ID, and Okta ^[3].

Semperis and research firm Censuswide surveyed 1,200 IT and security professionals across eight industry sectors and nine countries during the first half of 2026 ^[3]. Every participating organization had experienced at least one successful ransomware attack that disrupted business operations ^[3].

The data shows attackers have shifted from brute-forcing system flaws to using stolen legitimate credentials to enter networks "through the front door" ^[4].

Identity systems as primary entry points

Phishing and malicious emails now cause half of all ransomware attacks, overtaking vulnerabilities ^[2]. Compromised access allows attackers to expand their reach, placing identity providers at the center of organizational risk ^[3].

Active Directory was targeted in 51% of surveyed cases, followed by Entra ID at 48% and Okta at 27% ^[3]. The report noted these categories overlap, meaning a single organization could report attacks involving more than one identity platform ^[3].

Bypassing defenses and scaling access

Attackers continue to succeed despite security tools. Multi-factor authentication (MFA) was deployed in 97% of credential-based attacks ^[2].

Once inside, attackers use identity permissions to deepen their hold. "attackers with suitable permissions can use Active Directory to move between machines and encrypt systems across an organization," said security research executive Tomer Bar ^[3].

Artificial intelligence has introduced new vectors. Forty percent of respondents reported AI-based attacks, and 44% reported attacks exploiting their own AI agents or systems ^[3]. While 49% of respondents successfully used AI for detection or response, 23% said defensive AI tools failed to detect or respond successfully ^[3].

Repeat infections and ransom payments

Many organizations fail to eject intruders after a breach. Nearly a quarter of respondents who paid ransoms said they could not eject the attackers ^[3].

This contributes to a high rate of repeat infections; 69% of surveyed victims suffered multiple successful attacks within a single year ^[3].

Payments do not guarantee security. While 59% of victims paid a ransom, 53% of those who paid made multiple payments ^[3].

Recovery and crisis management gaps

A lack of specialized backups hinders recovery. Only 50% of surveyed organizations maintain dedicated identity backups ^[3]. Additionally, only 42% used automated identity recovery solutions ^[3].

Documented recovery procedures are scarce for some platforms. Only 28% of organizations had procedures for Okta, compared to 52% for Entra ID and 60% for Active Directory ^[3]. Semperis warned that restoring identity systems without addressing hidden backdoors or malware can allow attackers back into the environment ^[3].

Organizational friction also slows response times. Undefined roles and responsibilities blocked effective crisis response for 48% of organizations ^[3]. Communication gaps and outdated response plans each affected 44% of respondents ^[3].

What we don't know

• Why MFA was present in 97% of credential-based attacks but failed to prevent them.
• The specific methods used in the AI-based attacks reported by 40% of respondents.
• Whether the lack of identity backups stems from technical limitations or a lack of awareness.