Semperis report: Identity systems targeted in 87% of ransomware attacks
A Semperis report shows identity systems are targeted in 87% of ransomware attacks, highlighting critical gaps in hybrid architectures and recovery backups.
Key figures
| Ransomware attacks targeting identity systems | 87% |
|---|---|
| IT and security professionals surveyed | 1,200 |
| Active Directory targets | 51% |
| Entra ID targets | 48% |
| Okta targets | 27% |
| Victims experiencing multiple attacks within a year | 69% |
Timeline
- Attackers accessed Okta's customer support system to download session tokens
- Vulnerability in Okta's Classic app experience allowed users to skip MFA
- Semperis conducted a survey of 1,200 IT and security professionals
A Semperis report found that 87% of ransomware attacks targeted or exploited identity systems including Active Directory, Entra ID, and Okta [4].
The data comes from a survey of 1,200 IT and security professionals across eight industry sectors and nine countries conducted in the first half of 2026 [4]. According to the report, identity is at the center of ransomware risk because compromised access can help attackers expand their reach [4].
The central role of identity systems in ransomware
The Semperis study shows that ransomware victims frequently face attacks directed at their core identity infrastructure [4]. Among those surveyed, Active Directory was targeted in 51% of cases, followed by Entra ID at 48% and Okta at 27% [4].
The high frequency of these attacks reflects the strategic value of identity platforms. Tomer Bar, a security research executive at Semperis, warned that "attackers with suitable permissions can use Active Directory to move between machines and encrypt systems across an organization" [4].
Vulnerabilities in hybrid Okta environments
Many organizations manage a three-way identity architecture consisting of on-prem Active Directory, Microsoft Entra ID, and Okta [1]. This hybrid model creates "seams" where policy enforcement can fail [1].
Legacy authentication protocols, such as NTLM and Basic Auth, can bypass Okta's policy engine entirely [1]. This allows attackers with stolen credentials to authenticate against legacy endpoints without triggering MFA prompts [1].
Other documented platform risks include a 2024 vulnerability in Okta's Classic app experience that allowed users with valid credentials to skip MFA [1]. Additionally, attackers accessed Okta's customer support system in October 2023 to download session tokens from support case files [1].
Management gaps and recovery failures
Security gaps persist in how organizations manage their application stacks and recovery processes. An average company runs approximately 130 SaaS applications, but roughly 40% lack SSO, SCIM, or API hooks into Okta [1]. Those tools require a human to log in and manually remove the account [1].
Recovery from identity-based attacks is also a significant weakness [4]. Only 50% of ransomware victims maintained dedicated identity backups, and only 28% had documented recovery procedures for Okta [4].
According to the report, repeat attacks underline this concern [4]. Among surveyed ransomware victims, 69% experienced multiple successful attacks within a single year [4].
The evolution of threats and adaptive defenses
According to the Semperis report, AI added another layer of risk [4]. According to the Semperis report, 40% of ransomware victims reported AI-based attacks, while 44% reported attacks exploiting their own AI agents or systems [4].
Adaptive authentication tools that evaluate risk signals in real time are intended to resolve the tension between prompting every user for MFA and challenging nobody [2]. According to one ranking, Microsoft Conditional Access ranks first on policy depth per dollar and integrates signals from identity, device, and location [2].
Okta has also moved into the runtime path via its Agent Gateway to evaluate what agents seek to do beyond the initial login [5]. Charlotte Wylie, senior vice president and deputy chief security officer of Okta, said "we have to galvanize as an industry to solve this problem for our customers at a speed that they are scrambling to run after" [5].
What we don't know
- What specific "hidden malware or backdoors" does Semperis warn can allow attackers back into an environment during identity restoration?
- Which specific vendors are part of the "Blueprint Alliance" collaborating on the reference architecture for AI agent security?
- Why does Okta specifically lack the functionality to refuse NTLM v1?
Sources
- Why IAM Breaks in Hybrid Okta Environments, and How to Fix It ... — technologymatch.com, Oct 24, 2026
- Top 10 Best Adaptive / Risk-Based Authentication Tools in 2026 [Ranked & Scored] — cybersecuritynews.com
- 87% of Ransomware Attacks Target Active Directory, Entra ID and Okta — cyberpress.org
- Three insights you may have missed from theCUBE’s coverage of Okta’s Oktane event — siliconangle.com, Oct 24, 2026
Photos and video from the reports
- Photo: An illustration showing attacks targeting Active Directory and Okta.
- Photo: A diagram showing how authentication can fall back to legacy NTLM protocols.
- Photo: A diagram illustrating how legacy authentication can bypass multi-factor authentication.
- Photo: A diagram illustrating common failure points in the Okta AD Agent.
Further reading
- Entra ID / Okta Compromise — IdP Incident Playbook
A playbook for containing Entra ID or Okta takeovers and evicting rogue federation or OAuth persistence.
- ARTEX AI Agent Attacks on Okta, Entra ID, and AWS Cognito: Storm-0940 ...
Details on an AI attack agent tied to Storm-0940 targeting Okta, Entra ID, and AWS Cognito.
