Generative AI is increasingly becoming a crucial part of business operations, promising significant productivity gains by automating routine tasks and streamlining workflows. However, this shift also introduces new security considerations that organizations must address to contain the growing risk of ransomware attacks.
As AI assistants and agents interact with sensitive data and systems, they can inadvertently amplify the speed and scale of cyberattacks if not properly governed. AI does not create a new threat but rather amplifies techniques attackers already use, particularly during reconnaissance, credential abuse, and data theft. Understanding how AI changes the attack surface is becoming an essential part of enterprise cyber resilience.
There are two primary ways in which AI can contribute to ransomware risk: attackers using AI to improve their own operations and organizations deploying enterprise AI. In the first scenario, attackers rely on AI to generate phishing emails, write malicious code, automate reconnaissance, analyze stolen information, and streamline extortion. This allows them to work faster and operate at greater scale without fundamentally changing how ransomware campaigns unfold.
In the second scenario, organizations deploy AI assistants and agents that are increasingly connected to document repositories, collaboration platforms, SaaS applications, and internal knowledge bases. If attackers compromise the identities or permissions associated with these systems, AI can accelerate their ability to locate sensitive information, navigate connected systems, and abuse legitimate access.
Not every AI application presents the same level of risk. AI assistants primarily retrieve information or generate content in response to prompts, whereas AI agents go further by interacting with business applications, invoking APIs, and performing actions on a user’s behalf. The greater an application’s autonomy and permissions, the greater the potential impact if its associated identity is compromised.
The real issue lies in delegated authority. Modern ransomware campaigns typically begin with vulnerability exploitation, credential compromise, or abuse of trusted third-party access. Attackers then perform discovery, escalate privileges, identify valuable data, and exfiltrate information before deciding whether to encrypt systems, extort victims, or both.
Microsoft reports analyzing approximately 38 million identity risk detections every day underscores the central role identity attacks play in ransomware campaigns. The Cloud Security Alliance has also documented large-scale OAuth device-code phishing campaigns targeting Microsoft 365 users.
To contain this growing risk, organizations must extend their cyber resilience to AI-powered workflows. This requires identifying shadow AI usage, monitoring prompts and AI interactions, detecting policy violations, and providing visibility into AI-related risks alongside endpoint, identity, SaaS, and backup telemetry. A unified cyber resilience platform can help strengthen detection, response, and recovery.
Ultimately, the key takeaway is that AI does not inherently increase ransomware risk but rather amplifies existing threats if not properly governed. Organizations must understand how their AI deployments may inadvertently expand the attack surface and take proactive measures to mitigate this risk by extending their cyber resilience to AI-powered workflows.
Source: Bleeping Computer — 2026-07-22