A new report has found that AI is making ransomware attacks far more effective, with up to 65% of global organizations affected by ransomware saying that AI made the attacks more believable and effective, increasing their lethality in the process.
That’s according to research from Proofpoint, which published the findings in its 2026 AI-Era Ransomware Report. The document surveyed 953 cybersecurity professionals based in 12 different countries and found that “AI is making social engineering attempts increasingly difficult to distinguish from legitimate business communications.”
AI hasn’t achieved this newfound success by fundamentally changing the nature of ransomware, Proofpoint argued. Instead, it’s proven its worth to attackers by making ransomware campaigns much more persuasive to their unsuspecting victims. Indeed, up to 40% of organizations said their employees trusted threats generated by AI actors, Proofpoint claimed, highlighting the strength of the AI weapons now available in an attacker’s arsenal.
As Ryan Kalember, Chief Strategy Officer at Proofpoint, put it, “Today’s attackers are using AI to create highly convincing phishing emails, malware components like scripts, and credential theft campaigns that exploit human trust at scale. Organizations that continue treating ransomware and data extortion as endpoint or recovery problems are missing what these attacks most frequently begin with: people, identities and trusted communications.”
‘Payment leads to escalation, not resolution’
Because AI can craft believable prose akin to that found in a message from a reliable colleague, victims are much more likely to click an infected link or download a malicious attachment, kicking off the initial data breach without any of the friction that might be involved in a non-AI strike.
And it’s not just the language used that gives AI-equipped threat actors an edge. AI can quickly map out organizational structures and understand message patterns, giving adversarial groups a better understanding of structural weak spots and possible entry points.
Ransomware has changed in other ways, Proofpoint stated, with the firm stating that “modern ransomware has evolved beyond an encryption event into a sustained extortion campaign.” For instance, 54% of surveyed companies decided to pay a ransom, but of those organizations, 37% said that they’d been hit with secondary demands after making the first payment. In cases like that, “Payment leads to escalation, not resolution,” Proofpoint noted.
To fight back, Proofpoint advised that “organizations can no longer treat ransomware primarily as a malware problem.” Instead, companies need to focus on human interaction and the ways that AI can harness it as a potential attack vector.
“Preventing ransomware means protecting people, identities and trusted communications before attackers ever reach the endpoint,” Proofpoint observed.
